housekeeping: Update module github.com/jhump/protoreflect to v1.17.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
github.com/jhump/protoreflect	v1.15.2 -> v1.17.0

---

Release Notes

jhump/protoreflect (github.com/jhump/protoreflect)

v1.17.0

Compare Source

This release deprecates some packages that have newer alternatives in the Protobuf runtime. It also includes some small additions to the grpcreflect and desc/sourceinfo packages. The rest of the changes are bug fixes.

"github.com/jhump/protoreflect/desc"

Changes:

• This package is now deprecated. Though use of this package is still needed in order to use a handful of other packages in this repo, many usages should instead prefer the "google.golang.org/protobuf/reflect/protoreflect" package in the Protobuf runtime. In a v2 of this repo, this package will no longer be present.
• A performance improvement was contributed that speeds up the MessageDescriptor.FindFieldByName method.

"github.com/jhump/protoreflect/desc/protoparse"

Changes and bugfixes:

• This package is now deprecated. Most usages should instead prefer the "github.com/bufbuild/protocompile" package. There are some behavioral differences that we hope to address with additional API and enhancements to protocompile. But the protoparse package here is just a veneer on top of protocompile and we plan to do as little maintenance as possible here. In a v2 of this repo, this package will no longer be present.
• The protocompile dependency has been updated to use a more recent version of that package. This addresses potential panics when calling Parser.ParseButDontLink.

"github.com/jhump/protoreflect/desc/sourceinfo"

Changes and bugfixes:

• A possible panic when calling sourceinfo.GlobalFiles.FindDescriptorByName has been fixed.
• Descriptors returned from the sourceinfo.GlobalFiles registry or from the various Wrap* functions could induce panics in user code if querying for non-existent elements. For example, calling messageDescriptor.Fields().ByNumber(123) could return a typed-nil value on failure, instead of a nil interface. This would result in nil-dereference panics if methods were called on this later. These have been fixed.
• Descriptors returned from the sourceinfo.GlobalFiles registry and from the various Wrap* functions had concrete types defined in this package, not in the Protobuf runtime. But the protoreflect.Descriptor interface has a "do not implement" marker, indicating that concrete types implementing the interface should not be implemented outside of that module. To avoid future issues with the Protobuf runtime, there are no more implementations in this repo. Instead of wrapping other descriptor implementations (via embedding, and then overriding some methods), this package now builds new descriptors, using the protodesc package in the Protobuf runtime module.
• The various Wrap* functions are now deprecated. The name is no longer accurate since they no longer return wrapper values. Also the new implementation, which builds new descriptors, can fail (though unlikely), but the existing signature of these functions did not allow for returning an error. So these functions could possibly panic in the face of malformed input descriptors. Users should use the new AddSourceInfoTo* versions of these functions instead.

Additions:

• Adds AddSourceInfoTo* functions to replace the Wrap* functions. These functions augment the input descriptors by adding source code information to them.

"github.com/jhump/protoreflect/dynamic"

Changes:

• This package is now deprecated. Most usages should instead prefer the "google.golang.org/protobuf/types/dynamicpb" package in the Protobuf runtime. In a v2 of this repo, this package will no longer be present.

"github.com/jhump/protoreflect/grpcreflect"

Additions:

• Adds a new NewClientV1 function to return a client that uses v1 of the server reflection service. This fills the gap in the existing factory functions, NewClientV1Alpha and NewClientAuto.
• Adds a new AllowFallbackResolver method to the *grpcreflect.Client type. This allows the client to be configured with an alternate resolver that can be used as a backup when trying to satisfy dependencies, for cases where the remote server is non-authoritative and unable to provide all of them.

v1.16.0

Compare Source

This release adds support for Protobuf Editions to many of the packages. Note, however, that the desc/protoparse package does not yet work to parse Protobuf Editions source files. This release also includes a handful of bug-fixes.

"github.com/jhump/protoreflect/desc"

Additions:

• Adds an Edition method to *desc.FileDescriptor, which returns non-zero for files that use Protobuf Editions (instead of syntax "proto2" or "proto3").

Changes/fixes:

• Fixes an issue in the various Wrap* functions, that could result in a descriptor hierarchy where the same descriptors were incorrectly present multiple times. This could happen if a file in the transitive dependency graph being wrapped had more than one incoming edge (e.g. same file appearing in import statements from two or more other files).

"github.com/jhump/protoreflect/desc/builder"

Additions:

• Adds an Editions field and SetEditions method to *builder.FileBuilder, for creating files that use Protobuf Editions.

"github.com/jhump/protoreflect/desc/protoprint"

Changes/fixes:

• Now correctly prints the contents for files that use Protobuf Editions. Previously, if given a descriptor for a file used Protobuf Editions, it could generate invalid source output.
• Fixed a bug when Printer.CustomSortFunction was set wherein enum values could be printed in incorrect order, resulting in invalid source output. In syntax "proto3" and in open enums in Protobuf Editions, the first value must be the one with a zero numeric value.

"github.com/jhump/protoreflect/grpcreflect"

Additions:

• Adds a new AllowMissingFileDescriptors method to *grpcreflect.Client that allows users to opt-in to a lenient mode that will try to return schemas even when some files are unavailable. This will only be successful in cases where the missing files only provide custom options or are unused imports. This restores some lenience that was inadvertently provided (due to bugs and missing validation checks) when versions of this repo prior to v1.15 were combined with versions of the google.golang.org/grpc module prior to v1.61.

v1.15.6

Compare Source

This is a bugfix release to address recently identified regressions in the desc/protoparse package -- things that worked in v1.14.1 but did not work in v1.15.x.

"github.com/jhump/protoreflect/desc/protoparse"

Changes/fixes:

• The documentation for the Parser.ImportPaths field specifies that the field is not used for calls to the Parser.ParseFilesButDoNotLink method. This is because import paths do not need to be resolved if not linking. But as of v1.15.0, the ImportPaths field was being used for that method, and the difference in behavior could break existing programs. This has been fixed, and the behavior once again matches the spec.
• As of v1.15.0, if a path provided to Parser.ParseFiles were resolved as descriptors (via the Parser.LookupImport or Parser.LookupImportProto functions) instead of as source code (via the Parser.Accessor function or the default action of os.Open), the parse operation would fail with a "no such file" error. This would succeed with v1.14.1, with the descriptor being used as the input for the file instead of the file being parsed from source. So working programs could have been broken by an upgrade to v1.15.x. The package has been changed back to the v1.14.1 behavior.

v1.15.5

Compare Source

This is a bugfix release to address bugs in the desc/builder, desc/protoparse, and grpcreflect packages and a compatibility issue with the most recent version of github.com/bufbuild/protocompile.

"github.com/jhump/protoreflect/desc/builder"

Changes/fixes:

• A regression was introduced in v1.15.0 of this package that could cause it to fail to include some imports in a file for custom options. If the custom option in question was in a known transitive dependency, the builder could fail to add the necessary import. This has been fixed.

"github.com/jhump/protoreflect/desc/protoparse"

Changes/fixes:

• As of v1.15.0, this package uses the github.com/bufbuild/protocompile package under the hood as the parser. But that package is still using major version zero, since it's API has not completely stabilized. A recent release (v0.8.0) included backwards-incompatible changes that caused this repo to no longer compile. This release addresses the compile errors: this repo now uses that latest release of protocompile and correctly compiles against it.
• The use of v0.8.0 of protocompile fixes some issues in the desc/protoparse package that could cause it to incorrectly accept or reject some Protobuf source files. See the release notes for protocompile v0.8.0 for more details.

"github.com/jhump/protoreflect/grpcreflect"

Changes/fixes:

• The grpcreflect.NewClientAuto function (added in v1.14.0) returns a client that automatically falls back to using v1alpha of the reflection protocol if the server does not support v1. However, it relied on the server returning an "unimplemented" error to decide to fall back, but this condition has been observed to sometimes instead manifest as an "unavailable" error (in proxies that fail to write a 404 error before closing the connection). In those cases, the client was not correctly falling back to v1alpha. This release remedies that, so it can fallback to v1alpha when this category of error occurs.

v1.15.4

Compare Source

This is a bugfix release to address bugs in the desc/protoprint package and a compatibility issue with the most recent version of github.com/bufbuild/protocompile.

"github.com/jhump/protoreflect/desc/protoparse"

Changes/fixes:

• As of v1.15.0, this package uses the github.com/bufbuild/protocompile package under the hood as the parser. But that package is still using major version zero, since it's API has not completely stabilized. A recent release (v0.7.0) included backwards-incompatible changes that caused this repo to no longer compile. This release addresses the compile errors: this repo now uses that latest release of protocompile and correctly compiles against it.

"github.com/jhump/protoreflect/desc/protoprint"

Changes/fixes:

• When a string literal included a double-quote character ("), it would get printed incorrectly leading to either an incorrect string literal in some cases or an invalid and uncompilable source file in others. This has been fixed.
• When sorting elements in the file, if the file used proto3 syntax and had an enum with negative numeric values, the result would include the negative values first, before the zero value. This is not allowed in proto3 syntax, which requires that the zero value be the first value, so the result would be an invalid and uncompilable source file. This has been fixed.
• When a source file is parsed into a FileDescriptorProto but never linked, the descriptor may be missing the type field of a FieldDescriptorProto (since it is not known whether a named type refers to a message, group, or enum), and it may have options left in the uninterpreted_options field of the various options messages, which has a peculiar representation for aggregate values. When printing a descriptor that had these characteristics, they were not correctly handled, so the output of the printer would be an invalid and uncompilable source file. Both of these cases have been fixed.

v1.15.3

Compare Source

This is a bugfix release to address a panics in the desc/builder and desc/protoparse packages.

"github.com/jhump/protoreflect/desc/builder"

Changes/fixes:

• When building an enum where some values in an EnumBuilder had numbers explicitly assigned and others did not, a panic could occur. This panic has now been fixed. When there is a mix of explicit value numbers and implicit numbers, the implicit values will be auto-assigned available numbers (starting at zero) while the explicit values will use the configured number.

"github.com/jhump/protoreflect/desc/protoparse"

Changes/fixes:

• When the protoparse package was overhauled in v1.15.0, a bug was inadvertently introduced to the functionality related to the Parser.InferImportPaths flag. If the files being processed imported a file for which an AST was not available (which is actually quite common, since they may import a standard file such as "google/protobuf/empty.proto"), a panic would occur. This panic has been fixed.
• This release includes some other improvements related to the same Parser.InferImportPaths flag which now allow it to better detect file layouts and remedy import mismatches in more scenarios.

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ Artifact update notice

File name: backend/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 8 additional dependencies were updated

Details:

Package	Change
golang.org/x/net	v0.24.0 -> v0.25.0
golang.org/x/sync	v0.6.0 -> v0.8.0
google.golang.org/protobuf	v1.33.0 -> v1.34.2
github.com/bufbuild/protocompile	v0.6.0 -> v0.14.1
golang.org/x/crypto	v0.22.0 -> v0.23.0
golang.org/x/sys	v0.19.0 -> v0.20.0
golang.org/x/term	v0.19.0 -> v0.20.0
golang.org/x/text	v0.14.0 -> v0.15.0

[github-actions]

This PR has been marked as stale after 7 or more days of inactivity. Please have a maintainer add the on hold label if this PR should remain open. If there is no further activity or the on hold label is not added, this PR will be closed in 3 days.

[renovate]

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update (v1.17.0). You will get a PR once a newer version is released. To ignore this dependency forever, add it to the ignoreDeps array of your Renovate config.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.