Skip to content

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Feb 2, 2026

Bumps tonic-prost-build from 0.14.2 to 0.14.3.

Release notes

Sourced from tonic-prost-build's releases.

v0.14.3

Features

  • Expose tcp_keepalive_interval and tcp_keepalive_retries options on Server (#2472)
  • Allow configuration of max_local_error_reset_streams on Server (#2437)
  • Put source error into the Display impl of Status (#2417)
  • Server::default() now sets TCP_NODELAY to true (#2413)

Bug Fixes

  • Respect max_message_size when decompressing a message (#2484)
  • Depend on http at least 1.1.0 (#2426)

Documentation

  • Fix documentation links for timeout configuration (#2483)
  • Fix documentation typos and grammar issues in status.rs and codec/mod.rs (#2468)
  • Fix labels in Display for Status (#2414)
  • Fix features docs in tonic-build and tonic-prost-build (#2434)
  • Remove redundant word in tonic-build and tonic-prost-build README (#2425)
Commits
  • ed4bafc Prepare v0.14.3 release (#2489)
  • 71ec583 Remove metadata from tonic::Status Display impl. (#2481)
  • 164c548 chore(ci): Update to cargo-check-external-types 0.4.0 (#2470)
  • c1e6206 fix(tonic): respect max_message_size when decompressing a message (#2484)
  • a58c291 feat(xds): initial structures for tonic-xds (#2482)
  • 2e68a2c chore(doc): Fix documentation links for timeout configuration (#2483)
  • 7e98e1f Separate channel creation and state probe, and error handling thereof. (#2465)
  • 54fab77 feat(xds): implement tonic-based transport and prost-based codec (#2475)
  • d61bc56 chore(ci): increase server start up wait time in interop test (#2473)
  • d112d09 feat(xds): add public APIs for xds-client (#2464)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot dependabot bot added dependencies Pull requests that update a dependency file rust Pull requests that update Rust code labels Feb 2, 2026
@dependabot dependabot bot requested a review from a team as a code owner February 2, 2026 07:02
@dependabot dependabot bot added dependencies Pull requests that update a dependency file rust Pull requests that update Rust code labels Feb 2, 2026
Copy link
Contributor

@mythi mythi left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@fitzthum
Copy link
Member

fitzthum commented Feb 2, 2026

@dependabot rebase

Bumps [tonic-prost-build](https://github.com/hyperium/tonic) from 0.14.2 to 0.14.3.
- [Release notes](https://github.com/hyperium/tonic/releases)
- [Changelog](https://github.com/hyperium/tonic/blob/master/CHANGELOG.md)
- [Commits](hyperium/tonic@v0.14.2...v0.14.3)

---
updated-dependencies:
- dependency-name: tonic-prost-build
  dependency-version: 0.14.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot force-pushed the dependabot/cargo/tonic-prost-build-0.14.3 branch from f23171c to b9de48a Compare February 2, 2026 14:17
dependencies = [
"libc",
"windows-sys 0.59.0",
"windows-sys 0.52.0",
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We are doing a lot of downgrading here for some reason

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes. I am tired to manually fix all the downgradings. I am wondering whether it's ok to accept the downgrading?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not totally sure. In theory dependabot will upgrade these deps again. There is some risk in terms of CVEs to downgrading dependencies.

I'm not really sure why this is happening.

cc: @mythi @mkulke

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

From what I've seen, it's been windows-sys only that goes up and down but I also have no idea why it happens. I check dependabot Github issues every now and then to see if someone had noticed the same but no hits so far.

I'm not overly concerned about windows-sys since it's a windows only target AFAICS. Maybe resolver 3 improves this if we move to edition = 2024.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hmm if it's just that crate, that may be acceptable.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file rust Pull requests that update Rust code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants