Skip to content

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github May 15, 2025

Bumps com.google.protobuf:protobuf-java from 4.30.2 to 4.31.0.

Commits
  • 3d4adad Updating version.json and repo version numbers to: 31.0
  • 0fad924 Merge pull request #21743 from shaod2/31-cp
  • aa5410d Remove fast-path check for non-clang compilers in MessageCreator.
  • 0cf5489 Fix silent failure of rb_test rules to run test (#21733)
  • d390631 Add missing include.
  • 01b42bb Cherry-pick Rust fix to 31.x (#21617)
  • ac2bbec Merge pull request #21546 from protocolbuffers/31.x-202504301807
  • ca59567 Updating version.json and repo version numbers to: 31.0-dev
  • 4f81598 Updating version.json and repo version numbers to: 31.0-rc2
  • 1fb0d06 Cherry pick import option for protoc (#21489)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [com.google.protobuf:protobuf-java](https://github.com/protocolbuffers/protobuf) from 4.30.2 to 4.31.0.
- [Release notes](https://github.com/protocolbuffers/protobuf/releases)
- [Changelog](https://github.com/protocolbuffers/protobuf/blob/main/protobuf_release.bzl)
- [Commits](protocolbuffers/protobuf@v4.30.2...v4.31.0)

---
updated-dependencies:
- dependency-name: com.google.protobuf:protobuf-java
  dependency-version: 4.31.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies java Pull requests that update Java code labels May 15, 2025
@dependabot dependabot bot requested a review from pethers as a code owner May 15, 2025 05:54
@dependabot dependabot bot added dependencies java Pull requests that update Java code labels May 15, 2025
Copy link

Dependency Review

The following issues were found:
  • ✅ 0 vulnerable package(s)
  • ✅ 0 package(s) with incompatible licenses
  • ✅ 0 package(s) with invalid SPDX license definitions
  • ⚠️ 1 package(s) with unknown licenses.
See the Details below.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA 877457d.
Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

License Issues

service.impl/pom.xml

PackageVersionLicenseIssue Type
com.google.protobuf:protobuf-java4.31.0NullUnknown License

OpenSSF Scorecard

PackageVersionScoreDetails
maven/com.google.protobuf:protobuf-java 4.31.0 🟢 5.7
Details
CheckScoreReason
Binary-Artifacts🟢 10no binaries found in the repo
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
CI-Tests🟢 1026 out of 26 merged PRs checked by a CI test -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Code-Review⚠️ 0found 28 unreviewed changesets out of 30 -- score normalized to 0
Contributors🟢 1010 different organizations found -- score normalized to 10
Dangerous-Workflow⚠️ 0dangerous workflow patterns detected
Dependency-Update-Tool🟢 10update tool detected
Fuzzing🟢 10project is fuzzed
License🟢 9license file detected
Maintained🟢 1030 commit(s) out of 30 and 13 issue activity out of 30 found in the last 90 days -- score normalized to 10
Packaging⚠️ -1no published package detected
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
SAST🟢 9SAST tool is not run on all commits -- score normalized to 9
Security-Policy🟢 10security policy file detected
Signed-Releases⚠️ 00 out of 5 artifacts are signed or have provenance
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Vulnerabilities⚠️ 19 existing vulnerabilities detected

Scanned Files

  • service.impl/pom.xml

Copy link

@pethers pethers merged commit 9e665a9 into master May 15, 2025
8 checks passed
@pethers pethers deleted the dependabot/maven/com.google.protobuf-protobuf-java-4.31.0 branch May 15, 2025 06:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies java Pull requests that update Java code size/XS
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant