dependabot[bot] opened a new pull request, #19938: URL: https://github.com/apache/pinot/pull/19938
Bumps `wire.version` from 6.4.5 to 7.1.0. Updates `com.squareup.wire:wire-schema-jvm` from 6.4.5 to 7.1.0 <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/square/wire/blob/master/CHANGELOG.md";>com.squareup.wire:wire-schema-jvm's changelog</a>.</em></p> <blockquote> <h2>Version 7.1.0</h2> <p><em>2026-09-28</em></p> <h3>Common</h3> <ul> <li>Fix: reject <code>null</code> elements inside repeated fields when decoding JSON, as the ProtoJSON spec requires. Moshi throws <code>JsonDataException</code> and Gson throws <code>JsonSyntaxException</code>, and the message names the field. Before, decoding crashed with a raw <code>IllegalArgumentException</code> that did not explain the rule (<a href="https://redirect.github.com/square/wire/issues/3727";>#3727</a>)</li> </ul> <h3>Swift</h3> <ul> <li>Security: <code>ProtoReader</code> read primitives now throw <code>ProtoDecoder.Error.invalidStructure</code> when the wire type of the current field does not match the type being read, instead of aborting the process with an uncatchable assertion. A <code>do</code>/<code>catch</code> around <code>ProtoDecoder.decode</code> can now handle crafted payloads that put a known field number under a different wire type (<a href="https://redirect.github.com/square/wire/issues/3731";>#3731</a>, [GHSA-35ch-cghp-x9g6][GHSA-35ch-cghp-x9g6])</li> </ul> <h2>Version 7.0.4</h2> <p><em>2026-09-25</em></p> <h3>Swift</h3> <ul> <li>Security: Enforce the recursion limit on nested groups in the Swift runtime, so crafted protobuf payloads throw <code>ProtoDecoder.Error.recursionLimitExceeded</code> instead of overflowing the stack and aborting the process (<a href="https://redirect.github.com/square/wire/issues/3723";>#3723</a>, [GHSA-jmh4-c43f-w43x][GHSA-jmh4-c43f-w43x])</li> <li>Fix: an unrecognized enum value no longer overwrites an earlier recognized value of the same field, or an earlier decoded <code>oneof</code> case, in generated Swift decode. The unrecognized value is still kept in unknown fields (<a href="https://redirect.github.com/square/wire/issues/3725";>#3725</a> by [Ulugbek Kahramonov][bek-kah])</li> </ul> <h2>Version 7.0.3</h2> <p><em>2026-09-16</em></p> <h3>Common</h3> <ul> <li>Fix: validate the value of the <code>java_package</code> and <code>wire.wire_package</code> options before emitting it into generated code. Wire emits the value as written, so a value that cannot be a package name produced generated code that did not match the intent of the option. Wire now rejects such a value with an error naming the option, the proto file, and the character at fault. Builds that relied on a package option value carrying <code>;</code>, <code>{</code>, <code>}</code>, <code>(</code>, <code>)</code>, <code>/</code>, <code>*</code>, <code>"</code>, <code>\</code>, whitespace or a control character will now fail (<a href="https://redirect.github.com/square/wire/issues/3718";>#3718</a>)</li> </ul> <h2>Version 7.0.1</h2> <p><em>2026-09-10</em></p> <h3>Common</h3> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/square/wire/commit/9f62097dfe4995b5709d001ca0187e30ca0530ef";><code>9f62097</code></a> Prepare for release 7.1.0.</li> <li><a href="https://github.com/square/wire/commit/f9c2afeffab2a7d0f4947a3a32397c6a0996d170";><code>f9c2afe</code></a> Merge pull request <a href="https://redirect.github.com/square/wire/issues/3727";>#3727</a> from square/bquenaudon.2026-09-22.null-in-repeated</li> <li><a href="https://github.com/square/wire/commit/36f883bd63496803d5f37e00de2c569c2f439ef2";><code>36f883b</code></a> Merge pull request <a href="https://redirect.github.com/square/wire/issues/3731";>#3731</a> from square/bquenaudon.2026-09-25.proto-reader-throw...</li> <li><a href="https://github.com/square/wire/commit/a55e340dbec27106b15da8a16f0f7f00ef00b244";><code>a55e340</code></a> Throw instead of aborting on wire type mismatches in the Swift runtime</li> <li><a href="https://github.com/square/wire/commit/903fe2c9494096566bc33dffd8737409a9e691d5";><code>903fe2c</code></a> Prepare next development version.</li> <li><a href="https://github.com/square/wire/commit/adf8144fc4809704b511c1036a6987099bcc9d8b";><code>adf8144</code></a> Prepare for release 7.0.4.</li> <li><a href="https://github.com/square/wire/commit/68c14d65c9260ebedd7d614c3280856f629d0686";><code>68c14d6</code></a> Merge pull request <a href="https://redirect.github.com/square/wire/issues/3725";>#3725</a> from bek-kah/bek-kah/swift-skip-unknown-singular-enu...</li> <li><a href="https://github.com/square/wire/commit/57df939cc77a2c0a993b5e244ec32513bc8f9c6d";><code>57df939</code></a> Merge pull request <a href="https://redirect.github.com/square/wire/issues/3726";>#3726</a> from square/bquenaudon.2026-09-22.signing-keys</li> <li><a href="https://github.com/square/wire/commit/a963c7b1cd1326b09ec862dda17b835cd8662edb";><code>a963c7b</code></a> Merge pull request <a href="https://redirect.github.com/square/wire/issues/3723";>#3723</a> from square/bquenaudon.2026-09-21.grouprecursion</li> <li><a href="https://github.com/square/wire/commit/82e72bf3022b8533ad8ffdb20f200b9ed5adb206";><code>82e72bf</code></a> Retrigger CI after joining the square org</li> <li>Additional commits viewable in <a href="https://github.com/square/wire/compare/6.4.5...7.1.0";>compare view</a></li> </ul> </details> <br /> Updates `com.squareup.wire:wire-runtime-jvm` from 6.4.5 to 7.1.0 <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/square/wire/blob/master/CHANGELOG.md";>com.squareup.wire:wire-runtime-jvm's changelog</a>.</em></p> <blockquote> <h2>Version 7.1.0</h2> <p><em>2026-09-28</em></p> <h3>Common</h3> <ul> <li>Fix: reject <code>null</code> elements inside repeated fields when decoding JSON, as the ProtoJSON spec requires. Moshi throws <code>JsonDataException</code> and Gson throws <code>JsonSyntaxException</code>, and the message names the field. Before, decoding crashed with a raw <code>IllegalArgumentException</code> that did not explain the rule (<a href="https://redirect.github.com/square/wire/issues/3727";>#3727</a>)</li> </ul> <h3>Swift</h3> <ul> <li>Security: <code>ProtoReader</code> read primitives now throw <code>ProtoDecoder.Error.invalidStructure</code> when the wire type of the current field does not match the type being read, instead of aborting the process with an uncatchable assertion. A <code>do</code>/<code>catch</code> around <code>ProtoDecoder.decode</code> can now handle crafted payloads that put a known field number under a different wire type (<a href="https://redirect.github.com/square/wire/issues/3731";>#3731</a>, [GHSA-35ch-cghp-x9g6][GHSA-35ch-cghp-x9g6])</li> </ul> <h2>Version 7.0.4</h2> <p><em>2026-09-25</em></p> <h3>Swift</h3> <ul> <li>Security: Enforce the recursion limit on nested groups in the Swift runtime, so crafted protobuf payloads throw <code>ProtoDecoder.Error.recursionLimitExceeded</code> instead of overflowing the stack and aborting the process (<a href="https://redirect.github.com/square/wire/issues/3723";>#3723</a>, [GHSA-jmh4-c43f-w43x][GHSA-jmh4-c43f-w43x])</li> <li>Fix: an unrecognized enum value no longer overwrites an earlier recognized value of the same field, or an earlier decoded <code>oneof</code> case, in generated Swift decode. The unrecognized value is still kept in unknown fields (<a href="https://redirect.github.com/square/wire/issues/3725";>#3725</a> by [Ulugbek Kahramonov][bek-kah])</li> </ul> <h2>Version 7.0.3</h2> <p><em>2026-09-16</em></p> <h3>Common</h3> <ul> <li>Fix: validate the value of the <code>java_package</code> and <code>wire.wire_package</code> options before emitting it into generated code. Wire emits the value as written, so a value that cannot be a package name produced generated code that did not match the intent of the option. Wire now rejects such a value with an error naming the option, the proto file, and the character at fault. Builds that relied on a package option value carrying <code>;</code>, <code>{</code>, <code>}</code>, <code>(</code>, <code>)</code>, <code>/</code>, <code>*</code>, <code>"</code>, <code>\</code>, whitespace or a control character will now fail (<a href="https://redirect.github.com/square/wire/issues/3718";>#3718</a>)</li> </ul> <h2>Version 7.0.1</h2> <p><em>2026-09-10</em></p> <h3>Common</h3> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/square/wire/commit/9f62097dfe4995b5709d001ca0187e30ca0530ef";><code>9f62097</code></a> Prepare for release 7.1.0.</li> <li><a href="https://github.com/square/wire/commit/f9c2afeffab2a7d0f4947a3a32397c6a0996d170";><code>f9c2afe</code></a> Merge pull request <a href="https://redirect.github.com/square/wire/issues/3727";>#3727</a> from square/bquenaudon.2026-09-22.null-in-repeated</li> <li><a href="https://github.com/square/wire/commit/36f883bd63496803d5f37e00de2c569c2f439ef2";><code>36f883b</code></a> Merge pull request <a href="https://redirect.github.com/square/wire/issues/3731";>#3731</a> from square/bquenaudon.2026-09-25.proto-reader-throw...</li> <li><a href="https://github.com/square/wire/commit/a55e340dbec27106b15da8a16f0f7f00ef00b244";><code>a55e340</code></a> Throw instead of aborting on wire type mismatches in the Swift runtime</li> <li><a href="https://github.com/square/wire/commit/903fe2c9494096566bc33dffd8737409a9e691d5";><code>903fe2c</code></a> Prepare next development version.</li> <li><a href="https://github.com/square/wire/commit/adf8144fc4809704b511c1036a6987099bcc9d8b";><code>adf8144</code></a> Prepare for release 7.0.4.</li> <li><a href="https://github.com/square/wire/commit/68c14d65c9260ebedd7d614c3280856f629d0686";><code>68c14d6</code></a> Merge pull request <a href="https://redirect.github.com/square/wire/issues/3725";>#3725</a> from bek-kah/bek-kah/swift-skip-unknown-singular-enu...</li> <li><a href="https://github.com/square/wire/commit/57df939cc77a2c0a993b5e244ec32513bc8f9c6d";><code>57df939</code></a> Merge pull request <a href="https://redirect.github.com/square/wire/issues/3726";>#3726</a> from square/bquenaudon.2026-09-22.signing-keys</li> <li><a href="https://github.com/square/wire/commit/a963c7b1cd1326b09ec862dda17b835cd8662edb";><code>a963c7b</code></a> Merge pull request <a href="https://redirect.github.com/square/wire/issues/3723";>#3723</a> from square/bquenaudon.2026-09-21.grouprecursion</li> <li><a href="https://github.com/square/wire/commit/82e72bf3022b8533ad8ffdb20f200b9ed5adb206";><code>82e72bf</code></a> Retrigger CI after joining the square org</li> <li>Additional commits viewable in <a href="https://github.com/square/wire/compare/6.4.5...7.1.0";>compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
