build(deps): bump third_party/nanopb/upstream from cad3c18 to 98bf4db - #398
build(deps): bump third_party/nanopb/upstream from cad3c18 to 98bf4db#398dependabot[bot] wants to merge 2 commits into
cad3c18 to 98bf4db#398Conversation
Bumps [third_party/nanopb/upstream](https://github.com/GizClaw/nanopb) from `cad3c18` to `98bf4db`. - [Commits](GizClaw/nanopb@cad3c18...98bf4db) --- updated-dependencies: - dependency-name: third_party/nanopb/upstream dependency-version: 98bf4db69897b53434f3d0ba72e0a3ab1a902824 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 44caf7cab5
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| @@ -1 +1 @@ | |||
| Subproject commit cad3c18ef15a663e30e3e43e3a752b66378adec1 | |||
| Subproject commit 98bf4db69897b53434f3d0ba72e0a3ab1a902824 | |||
There was a problem hiding this comment.
This gitlink now points at 98bf4db, which is nanopb 0.4.9, while the previous cad3c18 is the 0.4.9.1 bugfix release that includes the GHSA fix for memory not being released on pb_decode_ex() error returns. This repo compiles third_party/nanopb/upstream/pb_decode.c into the C SDK and e2e cgo harness, so malformed or untrusted RPC payloads that fail decode can reintroduce that leak; please keep the submodule at cad3c18 or move to a later 0.4.9.1+ descendant instead of downgrading.
Useful? React with 👍 / 👎.
| @@ -1 +1 @@ | |||
| Subproject commit cad3c18ef15a663e30e3e43e3a752b66378adec1 | |||
| Subproject commit 98bf4db69897b53434f3d0ba72e0a3ab1a902824 | |||
There was a problem hiding this comment.
When the C SDK is regenerated on a clean machine, sdk/c/gizclaw/codegen.go runs this submodule's generator/protoc-gen-nanopb while allowing protobuf>=3.20,<7. Moving the gitlink back to 98bf4db restores the 0.4.9 generator, but the committed C outputs and stamp are already 0.4.9.1; with protobuf 6 environments the 0.4.9 generator can hit the deprecated MakeClass path fixed in 0.4.9.1, so regeneration fails or rewrites the SDK with an older generator. Please keep the submodule at a 0.4.9.1+ commit or update the generator dependency/pins together.
Useful? React with 👍 / 👎.
|
The review is correct. This PR moves nanopb from the current 0.4.9.1 bugfix/security line back to an older 0.4.9 commit and can also regress C SDK regeneration. Closing this Dependabot PR; nanopb should remain at the current commit unless a later 0.4.9.1+ descendant is selected and validated. |
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. You can also ignore all major, minor, or patch releases for a dependency by adding an If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
1 participant
Bumps third_party/nanopb/upstream from
cad3c18to98bf4db.Commits
6deca5aRemove leading whitespace in NANOPB_PLUGIN_OPTIONS4474bd3Do not include system paths when finding generator scriptae4959eAdd supported GCC attribute warn_unused_result for IAR compiler9e37f61Add label_override field option7f88274Add migration note about CMake protoc default (#958)f97d573Prefer generator protoc instead of system protoc63f6d65Fix possibly unbound variable error592ff0dtests: Fix compiler warning on new clang2bdf378workflows: Update Mac OS X build to macos-1431a641fbinary packages: Fix issue with grpc_toolsDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)