[dependabot]

Bumps the gomod group with 1 update: github.com/bufbuild/buf.

Updates github.com/bufbuild/buf from 1.73.0 to 1.74.0

Release notes

Sourced from github.com/bufbuild/buf's releases.

v1.74.0

• Improve the performance of the PROTOVALIDATE lint rule, which is now up to 3x faster and allocates less memory on modules using cel rules or example values.
• Send the module name of each file to check plugins, which is available as FileDescriptor.ModuleName() in bufplugin-go v0.11.0 and later.
• Update buf curl to automatically use HTTP/2 prior knowledge for http URLs when server reflection, the gRPC protocol, or a bidirectional streaming method is used, since all of these require HTTP/2. The --http2-prior-knowledge flag is no longer required in these cases.
• Add --stdin-filepath flag to buf format, which reads a single .proto file from stdin and writes the formatted result to stdout. The path is not read from disk, and is only used to report parse errors and diffs.
• Fix buf convert panic when converting images that contain files without a syntax declaration or with unused imports.
• Fix buf generate with strategy: directory and include_imports: true adding imports to the CodeGeneratorRequest of the directory that imports them. Imports are now split by directory into their own requests, the same as non-imports.
• Fix configuration files silently accepting unquoted values that start with !, such as ignore: [!foo/bar.proto]. Previously they parsed as empty strings, now they rejected with an error.
• Fix lint comment ignores on proto2 group fields being ignored.
• Update the LSP to support named generation templates such as buf.go.gen.yaml and buf.gen.go.yaml.
• Improve the buf curl error message for methods that accept a single request message.
• Add --config flag to buf lsp serve to use a buf.yaml file or data in place of discovering buf.yaml files. Workspaces are resolved from the editor's root folder.
• Deduplicate remote input fetches within a single command invocation, so that multiple inputs in a buf.gen.yaml that resolve to the same archive, git repository, or image are fetched once instead of once per input.
• Fix intermittent concurrent map write crash when compiling Editions files.
• Fix Edition 2024 handling of enum value features, STRICT default symbol visibility, and source locations of export/local types.

Changelog

Sourced from github.com/bufbuild/buf's changelog.

[v1.74.0] - 2026-10-14

• Improve the performance of the PROTOVALIDATE lint rule, which is now up to 3x faster and allocates less memory on modules using cel rules or example values.
• Send the module name of each file to check plugins, which is available as FileDescriptor.ModuleName() in bufplugin-go v0.11.0 and later.
• Update buf curl to automatically use HTTP/2 prior knowledge for http URLs when server reflection, the gRPC protocol, or a bidirectional streaming method is used, since all of these require HTTP/2. The --http2-prior-knowledge flag is no longer required in these cases.
• Add --stdin-filepath flag to buf format, which reads a single .proto file from stdin and writes the formatted result to stdout. The path is not read from disk, and is only used to report parse errors and diffs.
• Fix buf convert panic when converting images that contain files without a syntax declaration or with unused imports.
• Fix buf generate with strategy: directory and include_imports: true adding imports to the CodeGeneratorRequest of the directory that imports them. Imports are now split by directory into their own requests, the same as non-imports.
• Fix configuration files silently accepting unquoted values that start with !, such as ignore: [!foo/bar.proto]. Previously they parsed as empty strings, now they rejected with an error.
• Fix lint comment ignores on proto2 group fields being ignored.
• Update the LSP to support named generation templates such as buf.go.gen.yaml and buf.gen.go.yaml.
• Improve the buf curl error message for methods that accept a single request message.
• Add --config flag to buf lsp serve to use a buf.yaml file or data in place of discovering buf.yaml files. Workspaces are resolved from the editor's root folder.
• Deduplicate remote input fetches within a single command invocation, so that multiple inputs in a buf.gen.yaml that resolve to the same archive, git repository, or image are fetched once instead of once per input.
• Fix intermittent concurrent map write crash when compiling Editions files.
• Fix Edition 2024 handling of enum value features, STRICT default symbol visibility, and source locations of export/local types.

Commits

• 36fdbc5 Release v1.74.0 (#4735)
• 164368c Bump connect-go v2.0.1 (#4734)
• 46a51f4 Add --config flag to buf lsp server command (#4700)
• c17d631 Bump esbuild from 0.17.5 to 0.28.1 in /packaging/npm/buf (#4730)
• 7383c7b Fix LSP out-of-bounds edits for files without a trailing newline (#4693)
• 2d84f23 Fix buf convert panic without syntax or unused imports (#4732)
• 13aec14 Bump protocompile (#4733)
• 91f127d Add NPM package publishing flow (#4695)
• 080adbf Make upgrade (#4729)
• f2fa8c4 Upgrade makego (#4728)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

The latest Buf updates on your PR. Results from workflow Buf CI / buf (pull_request).

Build	Format	Lint	Breaking	Updated (UTC)
✅ passed	✅ passed	✅ passed	✅ passed	Oct 19, 2026, 3:24 PM