chore(deps): update dependency bufbuild/buf to v1.72.0

[renovate]

This PR contains the following updates:

Package	Update	Change
bufbuild/buf	minor	v1.71.0 → v1.72.0

---

Release Notes

bufbuild/buf (bufbuild/buf)

v1.72.0

Compare Source

• Fix buf beta registry webhook create and buf beta registry webhook list to emit proto JSON output.
• Fix HTTPS Basic authentication for remote inputs to use BUF_INPUT_HTTPS_USERNAME for the username.
• Fix IMPORT_USED lint rule silently reporting no unused imports when
  google/protobuf/descriptor.proto is in the transitive dependency graph.

---

Configuration

📅 Schedule: (in timezone Asia/Tokyo)

• Branch creation
  • Between 09:00 AM and 06:59 PM, Monday through Friday (* 9-18 * * 1-5)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 49246b5

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

[github-actions]

🤖 Claude Dependency Review

📦 Update Summary

• Library: bufbuild/buf
• Version: v1.71.0 → v1.72.0
• Change Type: Minor

📝 Release Notes

https://github.com/bufbuild/buf/releases/tag/v1.72.0

🔐 Security Assessment

• Risk: 🟢 Low
• Known vulnerabilities: None found. No CVE or GHSA advisories were discovered for either v1.71.0 or v1.72.0 through searches of the GitHub Advisory Database, National Vulnerability Database, and OSV.
• Supply-chain notes: This is a binary tool distributed via GitHub releases and installed through the aqua package manager. The update includes only bug fixes from the established bufbuild organization. No suspicious changes detected in release patterns, maintainership, or distribution method.

✨ Main Changes

This release contains three bug fixes only and no breaking changes or new features:

1. Webhook Command Output Fix: Fixed buf beta registry webhook create and buf beta registry webhook list commands to properly emit proto JSON output instead of their previous format.

2. HTTPS Authentication Fix: Corrected HTTPS Basic authentication for remote inputs to properly use the BUF_INPUT_HTTPS_USERNAME environment variable for username credentials.

3. Lint Rule Bug Fix: Resolved an issue where the IMPORT_USED lint rule was silently failing to report unused imports when google/protobuf/descriptor.proto appeared in the transitive dependency graph.

All changes are maintenance-focused bug fixes with no API changes or behavioral modifications to core functionality.

🔍 Impact Analysis

📁 Usage Locations

bufbuild/buf is used in 2 files for Protocol Buffer code generation:

1. packages/tailor-proto/buf.gen.yaml

   version: v2
   clean: true
   plugins:
     - remote: buf.build/bufbuild/es:v2.6.3
       out: ./src
       include_imports: true
   inputs:
     - git_repo: https://github.com/tailor-inc/proto.git

   • Feature used: buf generate (code generation from protobuf definitions)
   • Impact: None. The bug fixes address beta registry webhooks, HTTPS remote input authentication, and a specific lint rule scenario. This configuration uses a local git repository input with remote plugin generation, which is unaffected by any of the three fixes.

2. packages/tailor-proto/package.json

   "scripts": {
     "gen": "buf generate"
   }

   • Feature used: buf generate command invocation
   • Impact: None. This script executes the core buf generate command which is unchanged. The fixes only affect beta registry features, HTTPS authentication for remote inputs, and edge-case lint scenarios not used in this project.

🔧 Build/CI Integration

The buf generate command is integrated into the build pipeline through:

• Root-level command: pnpm run generate → pnpm -r run generate (package.json:14)
• CI Workflows:
  • .github/workflows/generate.yml:62 - Runs pnpm -r run generate on all platforms (Linux, Windows, macOS)
  • .github/workflows/ci.yml:61 - Runs code generation as part of CI checks
• Installation: Managed via aqua package manager (aqua.yaml:14, .github/actions/install-aqua/action.yml)

Impact: No changes to CI/build behavior. The core buf generate functionality used in these workflows is unaffected by the bug fixes.

🎯 Generated Code

The buf tool generates TypeScript Protocol Buffer definitions in packages/tailor-proto/src/:

• Generated files include *_pb.js and *_pb.d.ts for Protocol Buffer messages and services
• Example: packages/tailor-proto/src/tailor/v1/service_pb.d.ts
• Used by @​bufbuild/protobuf (v2.12.1) and @​connectrpc/connect (v2.1.2) dependencies

Impact: No impact. Generated code structure and output remain unchanged. The fixes address unrelated features (registry webhooks, authentication, lint rules).

🚫 Unused Features

The three bug fixes address features not used in this repository:

1. Registry webhooks (buf beta registry webhook create/list): No usage found. This project does not interact with buf registry webhooks.
2. Remote HTTPS inputs with BUF_INPUT_HTTPS_USERNAME: The buf.gen.yaml uses a git repository input (git_repo: https://github.com/tailor-inc/proto.git), not remote buf inputs requiring HTTPS basic authentication.
3. IMPORT_USED lint rule: No buf lint configuration found in the repository. The project does not use buf's linting features.

✅ Recommended Actions

None. This is a low-risk maintenance update with no impact on current usage:

• ✅ All three bug fixes address features not used in this codebase
• ✅ Core buf generate functionality (the only feature used) is unchanged
• ✅ No breaking changes, API modifications, or behavioral changes
• ✅ No security vulnerabilities in old or new versions
• ✅ Safe to merge without code changes

The update can be merged as-is. No testing, configuration changes, or code modifications are required.

---