[dependabot]

Bumps github.com/bufbuild/buf from 1.72.0 to 1.74.0.

Release notes

Sourced from github.com/bufbuild/buf's releases.

v1.74.0

• Improve the performance of the PROTOVALIDATE lint rule, which is now up to 3x faster and allocates less memory on modules using cel rules or example values.
• Send the module name of each file to check plugins, which is available as FileDescriptor.ModuleName() in bufplugin-go v0.11.0 and later.
• Update buf curl to automatically use HTTP/2 prior knowledge for http URLs when server reflection, the gRPC protocol, or a bidirectional streaming method is used, since all of these require HTTP/2. The --http2-prior-knowledge flag is no longer required in these cases.
• Add --stdin-filepath flag to buf format, which reads a single .proto file from stdin and writes the formatted result to stdout. The path is not read from disk, and is only used to report parse errors and diffs.
• Fix buf convert panic when converting images that contain files without a syntax declaration or with unused imports.
• Fix buf generate with strategy: directory and include_imports: true adding imports to the CodeGeneratorRequest of the directory that imports them. Imports are now split by directory into their own requests, the same as non-imports.
• Fix configuration files silently accepting unquoted values that start with !, such as ignore: [!foo/bar.proto]. Previously they parsed as empty strings, now they rejected with an error.
• Fix lint comment ignores on proto2 group fields being ignored.
• Update the LSP to support named generation templates such as buf.go.gen.yaml and buf.gen.go.yaml.
• Improve the buf curl error message for methods that accept a single request message.
• Add --config flag to buf lsp serve to use a buf.yaml file or data in place of discovering buf.yaml files. Workspaces are resolved from the editor's root folder.
• Deduplicate remote input fetches within a single command invocation, so that multiple inputs in a buf.gen.yaml that resolve to the same archive, git repository, or image are fetched once instead of once per input.
• Fix intermittent concurrent map write crash when compiling Editions files.
• Fix Edition 2024 handling of enum value features, STRICT default symbol visibility, and source locations of export/local types.

v1.73.0

• Fix buf format dropping comments next to commas or semicolons in message literals.
• Fix compilation failing to resolve symbols re-exported through import public when the re-exporting file also reaches those symbols through a non-public import.
• Fix LSP go to definition not resolving across files inside dependency and well-known-type files, and release workspaces when their last open file closes to free resources.
• Fix LSP finding only a subset of references to symbols declared in dependencies, including well-known types.
• Fix buf format non-idempotent trailing comment formatting.
• Update built-in Well-Known Types to Protobuf v35.1.
• Fix managed mode setting java_multiple_files on Edition 2024 files, which is not allowed and causes code generation to fail.

Changelog

Sourced from github.com/bufbuild/buf's changelog.

[v1.74.0] - 2026-10-14

• Improve the performance of the PROTOVALIDATE lint rule, which is now up to 3x faster and allocates less memory on modules using cel rules or example values.
• Send the module name of each file to check plugins, which is available as FileDescriptor.ModuleName() in bufplugin-go v0.11.0 and later.
• Update buf curl to automatically use HTTP/2 prior knowledge for http URLs when server reflection, the gRPC protocol, or a bidirectional streaming method is used, since all of these require HTTP/2. The --http2-prior-knowledge flag is no longer required in these cases.
• Add --stdin-filepath flag to buf format, which reads a single .proto file from stdin and writes the formatted result to stdout. The path is not read from disk, and is only used to report parse errors and diffs.
• Fix buf convert panic when converting images that contain files without a syntax declaration or with unused imports.
• Fix buf generate with strategy: directory and include_imports: true adding imports to the CodeGeneratorRequest of the directory that imports them. Imports are now split by directory into their own requests, the same as non-imports.
• Fix configuration files silently accepting unquoted values that start with !, such as ignore: [!foo/bar.proto]. Previously they parsed as empty strings, now they rejected with an error.
• Fix lint comment ignores on proto2 group fields being ignored.
• Update the LSP to support named generation templates such as buf.go.gen.yaml and buf.gen.go.yaml.
• Improve the buf curl error message for methods that accept a single request message.
• Add --config flag to buf lsp serve to use a buf.yaml file or data in place of discovering buf.yaml files. Workspaces are resolved from the editor's root folder.
• Deduplicate remote input fetches within a single command invocation, so that multiple inputs in a buf.gen.yaml that resolve to the same archive, git repository, or image are fetched once instead of once per input.
• Fix intermittent concurrent map write crash when compiling Editions files.
• Fix Edition 2024 handling of enum value features, STRICT default symbol visibility, and source locations of export/local types.

[v1.73.0] - 2026-09-11

• Fix buf format dropping comments next to commas or semicolons in message literals.
• Fix compilation failing to resolve symbols re-exported through import public when the re-exporting file also reaches those symbols through a non-public import.
• Fix LSP go to definition not resolving across files inside dependency and well-known-type files, and release workspaces when their last open file closes to free resources.
• Fix LSP finding only a subset of references to symbols declared in dependencies, including well-known types.
• Fix buf format non-idempotent trailing comment formatting.
• Update built-in Well-Known Types to Protobuf v35.1.
• Fix managed mode setting java_multiple_files on Edition 2024 files, which is not allowed and causes code generation to fail.

Commits

• 36fdbc5 Release v1.74.0 (#4735)
• 164368c Bump connect-go v2.0.1 (#4734)
• 46a51f4 Add --config flag to buf lsp server command (#4700)
• c17d631 Bump esbuild from 0.17.5 to 0.28.1 in /packaging/npm/buf (#4730)
• 7383c7b Fix LSP out-of-bounds edits for files without a trailing newline (#4693)
• 2d84f23 Fix buf convert panic without syntax or unused imports (#4732)
• 13aec14 Bump protocompile (#4733)
• 91f127d Add NPM package publishing flow (#4695)
• 080adbf Make upgrade (#4729)
• f2fa8c4 Upgrade makego (#4728)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)