Skip to content

Update protobufjs to v8#32

Closed
renovate[bot] wants to merge 75 commits into
masterfrom
renovate/protobufjs-8.x
Closed

Update protobufjs to v8#32
renovate[bot] wants to merge 75 commits into
masterfrom
renovate/protobufjs-8.x

Conversation

@renovate

@renovate renovate Bot commented May 19, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
protobufjs ^7.4.0^8.0.0 age confidence

Release Notes

protobufjs/protobuf.js (protobufjs)

v8.4.2

Compare Source

Bug Fixes

v8.4.1

Compare Source

Bug Fixes

v8.4.0

Compare Source

Features

v8.3.0

Compare Source

Features

v8.2.1

Compare Source

Bug Fixes
Performance Improvements

v8.2.0

Compare Source

Features
Bug Fixes
Performance Improvements

v8.0.3

Compare Source

Bug Fixes

v8.0.2

Compare Source

Bug Fixes

v8.0.1

Compare Source

Bug Fixes

v8.0.0

Compare Source

⚠ BREAKING CHANGES
Features

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

thebentern and others added 28 commits April 15, 2026 14:19
Bumps the protobufs submodule to de6de8e which introduces two optional
top-level messages on TAKPacketV2 at tags 25 and 26 for weather readings
and sensor field-of-view cones. Wires them through the full Kotlin SDK:

- TakPacketV2Data gains nested EnvironmentData and SensorFovData data
  classes and two optional top-level fields. The annotations attach to
  any payload_variant rather than living inside the Payload sealed
  class, mirroring the proto layout.
- CotXmlParser captures <environment> (temperature, windDirection,
  windSpeed) and <sensor> (azimuth, range, fov, vfov, elevation, roll,
  model) attributes from any CoT event. A small inferSensorType()
  helper maps ATAK-CIV's free-form model string to the SensorType
  enum via keyword heuristics (flir/thermal -> Thermal, lrf -> Laser,
  nvg -> Nvg, etc.).
- CotXmlBuilder emits <environment> and <sensor> elements inside
  <detail> whenever the fields are set, at the same depth as the other
  payload-agnostic elements (contact, track, takv).
- TakPacketV2Serializer bridges to the Wire-generated Environment /
  SensorFov messages with unit conversions: temperature as deci-degrees
  Celsius (sint32, ~0.1 degC resolution), wind speed as cm/s to match
  TAKPacketV2.speed, all angles as whole degrees. Absent optional
  fields round-trip through proto3 defaults back to null.

Intentional omissions (ATAK-CIV renders these locally from client
defaults): fovAlpha, fovRed/Green/Blue, strokeColor, strokeWeight,
displayMagneticReference, hideFov, fovLabels, rangeLines. The 237 B
LoRa MTU makes shipping RGBA tints for map cosmetics the wrong trade.

Test coverage:
- New pli_with_sensor.xml fixture (PLI + <environment> + FLIR <sensor>)
  drives the existing parameterized round-trip, compatibility, and
  compression tests automatically via TestFixtures auto-discovery.
- Explicit "PLI with sensor parses environment and sensor annotations"
  test in RoundTripTest verifies parse -> compress -> decompress ->
  rebuild preserves every field, including the Thermal type inferred
  from the "FLIR-Boson-640" model string.
- DictionaryTrainingTest grows a 50-sample envsensor_* block in its
  corpus generator so the NEXT zstd dictionary retrain learns the
  new field tags and common sensor models. The committed .zstd dicts
  are unchanged; this is purely seeding for a future retrain.

Measurements on the new fixture:
  774 B XML -> 165 B raw proto -> 152 B compressed wire
  85 B headroom under the 237 B LoRa MTU

Incidental cleanup: testdata/compression-report.md plus casevac.bin and
casevac_medline.bin were regenerated by the `generate compression
report` test. They were stale drift from the initial squash commit
(casevac_medline.xml grew to 1046 B but the report still listed 808 B);
the regenerated values now match the actual fixtures.

No changes to Swift / Python / C# / TypeScript in this commit — the
cross-language rollout follows the same pattern as the v2.x CASEVAC
extension, one focused session per language.

269/269 jvmTest green. No dictionary retrain required: existing
fixtures encode byte-identically (new optional fields absent), and the
new fixture compresses fine without dict hits.
Bumps the protobufs submodule to 9b123f3 which renames the proto
message type from `Environment` to `TAKEnvironment`. The bare name
collided with SwiftUI's `@Environment` property wrapper, making the
generated Swift module unusable in any iOS consumer that imports both
SwiftUI and the proto bindings — the Meshtastic-Apple app had 78 such
files.

Only `TakPacketV2Serializer.kt` changes in the SDK: the Wire import
and the `toWire` / `toData` bridge helpers now reference `TAKEnvironment`
instead of `Environment`. The SDK's internal data class stays named
`TakPacketV2Data.EnvironmentData` to match the source `<environment>`
CoT XML element name (we only renamed the wire type, not the internal
model).

Wire format is unaffected — proto3 encoding is tag-number-based, so
every fixture's compressed bytes are byte-identical before and after
the rename. All 269 jvmTest cases stay green with no golden file
regeneration required.
All 40 test fixture XML files now cluster within ~0.01 degrees of the
T-or-C anchor point (33.1284, -107.2528) instead of being scattered
across the Philippine Sea and San Francisco. This makes the 40-marker
test visually coherent when viewed on iTAK/ATAK — every marker, shape,
route, casevac, and emergency beacon lands near the same map viewport.

Fixture-internal coordinates (link points for shapes/routes, chat anchor
points, aircraft positions) are updated to match. Golden .bin/.pb files
and the compression-report.md are regenerated against the new positions.

RoundTripTest assertions that hard-coded old fixture coordinates
(pli_basic lat/lon, drawing_rectangle_itak longitude range check) are
updated to reflect the new T-or-C area. Also added roundToInt() import
to avoid IEEE 754 off-by-one on the pli_basic longitude assertion.

269/269 jvmTest green on clean build.
Cross-platform audit identified correctness bugs, performance issues,
and non-idiomatic patterns across all 5 SDK implementations. This
commit addresses the HIGH and MEDIUM severity findings.

C# (HIGH — correctness):
- Add CultureInfo.InvariantCulture to all 33 double.Parse/TryParse/
  int.Parse/uint.Parse call sites in CotXmlParser.cs. Without this,
  systems with comma decimal separators (de-DE, fr-FR) would parse
  "37.7749" as 377749.0 or throw FormatException.
- Fix CotXmlBuilder.cs speed/course formatting to use the F() helper
  for culture-invariant output.
- Convert 7 inline Regex allocations to private static readonly fields
  with RegexOptions.Compiled (6 aircraft-from-remarks patterns +
  detail extraction regex).
- Fix stale pli_basic coordinate assertion in TakTests.cs.

Python (HIGH — correctness):
- Add `from __future__ import annotations` to all 7 source files for
  Python 3.9 compatibility. The `bytes | None` union syntax in
  tak_compressor.py requires 3.10+ without the future import, but
  pyproject.toml declares requires-python >= 3.9.
- Migrate dictionary loading from fragile os.path relative paths to
  importlib.resources (Python 3.9+). Dictionaries moved into a
  meshtastic_tak.resources subpackage so they bundle correctly in
  wheel builds.
- Remove sys.path hack from tests/conftest.py; add pythonpath = ["src"]
  to pyproject.toml [tool.pytest.ini_options] instead.
- Fix stale pli_basic coordinate assertion in test_round_trip.py.

Swift (MEDIUM — performance + consistency):
- Cache ISO8601DateFormatter instances as static let properties in
  CotXmlParser and CotXmlBuilder. Previously allocated new formatters
  on every parse/build call.
- Make parse() throw CotXmlParserError.prohibitedXmlConstruct for
  DOCTYPE/ENTITY instead of silently returning an empty TAKPacketV2.
  Aligns Swift with the other 4 platforms which all throw exceptions.
- Update all test call sites to handle throws.
- Fix stale pli_basic coordinate assertion in RoundTripTests.swift.

TypeScript (MEDIUM — packaging):
- Remove phantom fzstd dependency (listed but never imported).
- Change moduleResolution from "node" to "node16" for proper ESM
  support with module: ES2022.
- Add "exports" field to package.json for modern ESM resolution.
- Fix stale pli_basic coordinate assertions in test files.

New files:
- CLAUDE.md — comprehensive instructions for Claude Code sessions
- .github/copilot-instructions.md — concise instructions for Copilot
  and other AI assistants

All platform test suites pass:
  Kotlin: 269 tests (unchanged — cleanest implementation)
  C#: 242 tests
  TypeScript: 211 tests
  Python: 193 tests
  Swift: 193 tests
…TypeScript

The entire TypeScript codebase previously passed protobuf packets as
Record<string, unknown>, requiring unsafe casts like
(packet.cotTypeId as number) ?? 0 on every field access — zero
compile-time type checking on the packet structure.

New file: typescript/src/types.ts (281 lines)
Hand-written TypeScript interfaces for the full TAKPacketV2 schema
including all 13 nested message types: TAKPacketV2, GeoChat,
AircraftTrack, DrawnShape, Marker, RangeAndBearing, Route, RouteLink,
CasevacReport, ZMistEntry, EmergencyAlert, TaskRequest, TAKEnvironment,
SensorFov, CotGeoPoint. All fields optional with correct types,
matching protobufjs camelCase runtime conventions.

Updated files:
- CotXmlParser.ts: parseCotXml() returns TAKPacketV2, all payload
  construction uses specific nested types (GeoChat, DrawnShape, etc.),
  stripZeros generic constraint changed to object
- CotXmlBuilder.ts: buildCotXml() accepts TAKPacketV2, ~80 unsafe
  casts removed, emit* helpers typed to specific payload interfaces
- TakCompressor.ts: compress/decompress/fallback methods use
  TAKPacketV2 instead of Record<string, unknown>
- index.ts: re-exports types.ts

All 211 tests pass. Structurally compatible with existing plain objects
via TypeScript structural typing — no breaking change for downstream
consumers.
The JVM publication of the SDK previously bundled the Wire-generated
`org.meshtastic.proto.*` classes alongside the SDK's own
`org.meshtastic.tak.*` classes. Any consumer that also generated the
same proto classes from the same submodule (e.g. Meshtastic-Android's
core:proto module) hit R8 "Type org.meshtastic.proto.... is defined
multiple times" errors during release builds.

This commit splits the JAR into two artifacts published from the
same Gradle project:

  takpacket-sdk-jvm        -- SDK classes only (org.meshtastic.tak.**).
                              Declares takpacket-sdk-protos-jvm as a
                              transitive runtime dep in its POM.
  takpacket-sdk-protos-jvm -- the Wire-generated proto classes
                              (org.meshtastic.proto.**). Depends on
                              wire-runtime-jvm.

Standalone consumers pick up both jars transitively — no behavior
change. Consumers with their own copy of the proto classes can exclude
the protos jar:

    implementation("com.github.meshtastic.TAKPacket-SDK:takpacket-sdk-jvm:v0.2.0") {
        exclude(group = "com.github.meshtastic.TAKPacket-SDK", module = "takpacket-sdk-protos-jvm")
    }

This is implemented via a single Gradle project rather than a
multi-project layout (the latter fights KMP's strong assumption that
the kotlin("multiplatform") plugin owns the whole project) — the
jvmJar task is mutated in place to drop org/meshtastic/proto/**, and
a sibling jvmProtosJar task packages just those classes from the
already-compiled JVM classpath.

iOS klibs (iosArm64, iosSimulatorArm64) are unaffected — the proto
classes still ship as part of their commonMain since iOS targets
don't have the duplicate-class problem.

Verified locally with publishToMavenLocal:
  takpacket-sdk-jvm-0.2.0.jar       : 0 proto, 35 tak classes
  takpacket-sdk-protos-jvm-0.2.0.jar: 115 proto, 0 tak classes

Bumps the SDK version 0.1.x -> 0.2.0 (packaging-shape change affects
consumers).

testdata/compression-report.md is regenerated by the jvmTest run --
reflects the v2 dictionary (16KB non-aircraft + 4KB aircraft) that
the dictionaries on disk have used since the last retrain session;
the previous report was stale at v1 (8KB).

Closes #5
…ssue #5)

v0.2.0 split the proto classes into a sibling `takpacket-sdk-protos-jvm`
publication. That solved the R8 duplicate-class problem but it asked
consumers to take on a second JitPack dependency entry — which is out
of scope for downstream Meshtastic-Android, the canonical consumer
that already has a `:core:proto` module providing those same classes.

v0.2.1 takes the simpler route: just strip `org/meshtastic/proto/**`
from the JVM JAR. The SDK's compiled bytecode still REFERENCES the
proto types (TAKPacketV2, CotType, GeoChat, ...), but the consumer is
expected to provide them on the runtime classpath. For Meshtastic
ecosystem consumers (the only known consumers), that classpath already
includes them.

Behavioral / packaging shape:
  takpacket-sdk-jvm-0.2.1.jar : 0 proto classes, 35 tak classes
  No sibling protos artifact.
  iosArm64 / iosSimulatorArm64 klibs unchanged — they still ship
  protos inline because iOS has no analogous duplicate-class problem
  and no equivalent proto module on the Apple side.

The build script comment block at the bottom of kotlin/build.gradle.kts
documents the requirement for standalone JVM consumers (run Wire codegen
against meshtastic/atak.proto themselves, or depend on a module that
does — Meshtastic-Android's `:core:proto` is the reference example).
The 0.2.x JAR stripping strategy (issue #5 fix) traded one fragility for
another: it eliminated R8 duplicate-class errors at the cost of leaving
the SDK's bytecode pointing at proto method signatures the consumer's
own codegen had to materialize. When the protobufs submodule advanced
in one repo but not the other, signatures drifted — the most recent
break was SensorFov.getRange_m() flipping from `int` to `Integer` when
`range_m` became optional, leaving the SDK linked against the old
signature and the app's `core:proto` generating the new one.

Switch to the inverse strategy: the SDK is now the single owner of
atak.proto Wire codegen. The JVM JAR ships `org.meshtastic.proto.**`
(115 classes including TAKPacket, TAKPacketV2, GeoChat, Contact,
CotType, SensorFov, TAKEnvironment) alongside the existing
`org.meshtastic.tak.**` (34 classes). Consumers stop generating those
types themselves — they prune the atak.proto messages out of their own
Wire config and pull the SDK's classes transitively.

Changes:

- Remove the `jvmJar { exclude("org/meshtastic/proto/**") }` block from
  kotlin/build.gradle.kts. Replace the issue-#5 explanatory comment
  with one documenting the new strategy and the ABI rationale.

- Switch the protobufs submodule's tracked branch from
  `takv2_geometry` to `master` in .gitmodules. The current pointer
  (1c62540) is already an ancestor of origin/master, so no submodule
  bump is needed in this commit. This unblocks Renovate from keeping
  the submodule on the same line as Meshtastic-Android's tracking
  pointer.

- Add .github/renovate.json with `git-submodules: enabled` so
  protobufs submodule advances arrive as automated PRs. Mirrors the
  Meshtastic-Android renovate setup so both repos auto-sync on the
  same proto cadence.

Downstream consumer change (Meshtastic-Android, not in this commit):
the app's `core:proto` Wire config needs `prune("meshtastic.TAKPacket")`,
`prune("meshtastic.TAKPacketV2")`, and prunes for the other atak.proto
message types so it stops generating duplicates.

Verified locally:

    ./gradlew clean jvmJar jvmTest    # BUILD SUCCESSFUL
    jar tf takpacket-sdk-jvm-0.2.1.jar | grep -c "^org/meshtastic/proto/"
    # 115
    jar tf takpacket-sdk-jvm-0.2.1.jar | grep -c "^org/meshtastic/tak/"
    # 34

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The issue #6 fix (33f04a0) restored full proto-class shipping in the
JVM JAR. Running the downstream Meshtastic-Android prune-and-consume
pattern surfaced a wrinkle:

`meshtastic/module_config.proto` defines

    message ModuleConfig {
      message TAKConfig {
        Team team = 1;
        MemberRole role = 2;
      }
    }

so `core:proto`'s Wire codegen needs to keep generating `Team` and
`MemberRole` — Wire's prune is cascading, and pruning the enums silently
drops the `takConfig.team` / `takConfig.role` fields. The app side
verified this empirically: with `prune("meshtastic.Team")` in place,
the compiler reports `Unresolved reference 'team'` at every call site
that reads from `TAKConfig`.

Result: ONLY these two classes need to live on the consumer side; every
other atak.proto type can ship from the SDK. Strip just `Team` and
`MemberRole` (and their inner `$Companion`/`$ADAPTER$1`/etc. classes)
from the JVM JAR. The SDK's bytecode references to them still resolve
at the consumer's classpath, the same way the rest of the SDK's
hand-written code resolves any other proto type.

Verified locally:
- `./gradlew clean publishToMavenLocal` builds the JAR
- `jar tf takpacket-sdk-jvm-0.2.1.jar | grep -E "Team|MemberRole"`
  returns empty (previously listed Team.class, MemberRole.class,
  and their $Companion/$ADAPTER$1 inner classes)
- Downstream `./gradlew :app:assembleGoogleRelease` in Meshtastic-Android
  passes R8 (previously failed at
  `:app:minifyGoogleReleaseWithR8` with
  `Type org.meshtastic.proto.MemberRole$Companion$ADAPTER$1 is defined
  multiple times`)

iOS klibs are unchanged — they ship Team/MemberRole the same as
before because Apple consumers don't run a parallel proto codegen.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Replace JitPack-only maven-publish with com.vanniktech.maven.publish 0.30.0
to publish KMP artifacts to Maven Central under org.meshtastic:takpacket-sdk.

Changes:
- Add vanniktech maven-publish plugin with mavenPublishing {} config block
  (Maven Central target, conditional GPG signing, full POM metadata)
- Create kotlin/gradle.properties with publishing coordinates
  (GROUP, POM_ARTIFACT_ID, VERSION_NAME=0.2.3)
- Add pluginManagement to settings.gradle.kts for plugin resolution
- Update release workflow to publish to Maven Central on tag push
- Add snapshot publishing job to CI on master push
- Update VERSION file to 0.2.3 (matches latest git tag)
- Note in jitpack.yml that Maven Central is now preferred

Required repository secrets for CI:
  OSSRH_USERNAME, OSSRH_PASSWORD (Sonatype OSSRH credentials)
  SIGNING_KEY_ID, SIGNING_KEY, SIGNING_PASSWORD (GPG in-memory signing)

Consumers can now depend on:
  implementation("org.meshtastic:takpacket-sdk-jvm:0.2.3")
from Maven Central instead of the JitPack coordinate.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
feat(kotlin): Add Maven Central publishing via Vanniktech plugin
Replace JitPack-only maven-publish with com.vanniktech.maven.publish 0.30.0
to publish KMP artifacts to Maven Central under org.meshtastic:takpacket-sdk.

Changes:
- Add vanniktech maven-publish plugin with mavenPublishing {} config block
  (Maven Central target, conditional GPG signing, full POM metadata)
- Create kotlin/gradle.properties with publishing coordinates
  (GROUP, POM_ARTIFACT_ID, VERSION_NAME=0.2.3)
- Add pluginManagement to settings.gradle.kts for plugin resolution
- Update release workflow to publish to Maven Central on tag push
- Add snapshot publishing job to CI on master push
- Update VERSION file to 0.2.3 (matches latest git tag)
- Note in jitpack.yml that Maven Central is now preferred

Required repository secrets for CI:
  OSSRH_USERNAME, OSSRH_PASSWORD (Sonatype OSSRH credentials)
  SIGNING_KEY_ID, SIGNING_KEY, SIGNING_PASSWORD (GPG in-memory signing)

Consumers can now depend on:
  implementation("org.meshtastic:takpacket-sdk-jvm:0.2.3")
from Maven Central instead of the JitPack coordinate.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
fix(ci): remove signing password env var from workflows
Gradle's in-memory signing can auto-detect the key ID from the ASCII-armored
key itself. Passing an explicit KeyId was causing 'key ID must be in a valid
form' errors when the secret value didn't match the expected 8-char hex format.

Only SIGNING_KEY is needed (no KeyId, no password).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
fix(ci): remove signingInMemoryKeyId from publish workflows
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
@renovate renovate Bot added the dependencies Pull requests that update a dependency file label May 19, 2026
jamesarich and others added 6 commits May 19, 2026 16:50
Add concurrency settings to both CI and Release workflows so that new
runs on the same branch or tag automatically cancel stale in-progress
runs, saving Actions minutes on repeated pushes and PR updates.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…ellation

Add concurrency groups to cancel in-progress CI runs
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
@renovate renovate Bot force-pushed the renovate/protobufjs-8.x branch from 010923e to 9f0889f Compare May 21, 2026 20:41
renovate Bot and others added 18 commits May 22, 2026 04:45
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
TypeScript 5.5+ enforces that module must be 'Node16' when moduleResolution
is 'Node16'. This was causing the release build to fail with TS5110.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
- Use exact versioned JAR filename instead of glob (vanniktech produces
  -sources.jar and -javadoc.jar that matched the wildcard)
- Use ./gradlew instead of bare gradle to ensure wrapper version is used
- Set cancel-in-progress: false (don't cancel mid-publish)
- Remove unused id-token/attestations permissions

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Stage signed artifacts to local Maven, attest with actions/attest-build-provenance,
then publish to Maven Central. Matches the pattern used by mqttastic-client-kmp.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Update Microsoft.NET.Test.Sdk to 18.6.0
@renovate

renovate Bot commented May 27, 2026

Copy link
Copy Markdown
Contributor Author

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update. You will not get PRs for any future 8.x releases. But if you manually upgrade to 8.x then Renovate will re-enable minor and patch updates automatically.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.

@renovate renovate Bot deleted the renovate/protobufjs-8.x branch May 27, 2026 15:46
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants