Skip to content

Update pinned tools, replace protoc-gen-contract-rust with protoc-gen-protocontract-buffa, and release 0.4.0. - #3

Merged
amsokol merged 1 commit into
mainfrom
release-0.4.0
Oct 16, 2026
Merged

amsokol merged 1 commit into
mainfrom
release-0.4.0

Conversation

@amsokol

@amsokol amsokol commented Oct 16, 2026

Copy link
Copy Markdown
Collaborator

Tool pins past the 2-day quarantine, the renamed plugin, and the 0.4.0 release.

Pins

Tool From To Checked against
Buf CLI v1.73.0 v1.74.0 (catalog + fallback) sha256.txt
protoc-gen-connect-go v1.21.0, v2.0.0 + v1.21.1, v2.0.1; fallback v1.21.1 checksums.txt
protoc-gen-protovalidate-buffa v0.10.3 + v0.10.4 (fallback) per-asset .sha256
uv 0.13.0 0.13.1 sha256.sum
Node 24.21.0 24.22.0 SHASUMS256.txt
pnpm 12.11.2 12.13.0 npm dist.integrity
govulncheck (x/vuln) v1.8.0 v1.9.0, with x/tools v0.52.0 and x/telemetry sum.golang.org

Every pinned asset was downloaded and checked; publishers are unchanged. Still in quarantine: grpc-gateway v2.32.0, ruff 0.17.1, pnpm 12.14.0, golangci-lint v2.15.0, protovalidate-buffa v0.10.5.

Plugin

  • Added: protoc-gen-protocontract-buffa v0.3.1, the static binaries of the sonalect/protocontract-buffa.rs GitHub Release (the crates.io crates are source only), registered everywhere CLAUDE.md lists.
  • Breaking, removed: protoc-gen-contract-rust (v0.1.0 to v0.2.1) and its labels, hence 0.4.0.

Checks

bazel build //..., bazel test //... (14/14), bazel run //:format, //tests/buf:format, //tests/python:format: green on Linux, nothing changed; MODULE.bazel.lock rebuilt from scratch, unchanged. //tests/buf:plugins runs the new plugin. Windows is checked by this PR's CI only.

🤖 Generated with Claude Code

…-protocontract-buffa, and release 0.4.0.

Buf CLI v1.74.0, protoc-gen-connect-go v1.21.1 and v2.0.1,
protoc-gen-protovalidate-buffa v0.10.4, uv 0.13.1, Node 24.22.0, pnpm
12.13.0, and govulncheck (x/vuln v1.9.0, with x/tools v0.52.0 and
x/telemetry). The plugin, renamed upstream, comes as protoc-gen-
protocontract-buffa v0.3.1 from the sonalect/protocontract-buffa.rs
GitHub Release (the crates.io crates are source only); the old
protoc-gen-contract-rust and its labels are removed, hence the minor
bump. Every pin is past the 2-day quarantine (the sonalect plugin is
exempt) with an unchanged publisher; every pinned asset was downloaded
and checked against the release's checksum file (sha256.txt,
checksums.txt, .sha256, sha256.sum, SHASUMS256.txt, checksums-sha256.txt),
pnpm against its npm integrity, and the Go modules against
sum.golang.org.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Aleksandr Sokolovskii <amsokol@gmail.com>
@amsokol
amsokol merged commit 6588b24 into main Oct 16, 2026
6 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant