Update Protos

[github-actions]

• Nightly Proto Update

Auto-generated by create-pull-request

Note

Add generated protobuf and Swagger files for component permissions

Adds two generated files for the mls/message_contents/component_permissions.proto schema: a Go protobuf file (component_permissions.pb.go) defining the ComponentType enum and ComponentPermissions/ComponentMetadata messages, and a Swagger 2.0 spec (component_permissions.swagger.json) with shared definitions but no paths.

^{Macroscope summarized 5e57346.}

[octane-security-app]

Summary by Octane

New Contracts

• component_permissions.pb.go: The smart contract defines component-level metadata and permissions for app data, including policies for insertion, updating, and deletion.

Updated Contracts

No contracts were updated.

---

🔗 Commit Hash: 5e57346

[macroscopeapp]

Approvability

Verdict: Needs human review

Automated proto update adding new generated protobuf definitions for component permissions. Changes are purely additive with no runtime impact, but the bot author does not own these files (owned by @xmtp/backend), so a designated owner should approve.

^{You can customize Macroscope's approvability policy. Learn more.}

[octane-security-app]

Overview

Vulnerabilities found:	3
Severity breakdown:	2 Medium, 1 Low

Warnings found:	1

Detailed findings

pkg/api/message/service.go

• Global LIMIT after originator-ordered pagination in multi-originator queries causes starvation and delayed live mode. See more

pkg/api/metadata/cursor_updater.go

• Non-resilient read-replica-backed cursor updater in metadata service causes false DependsOn rejections and publish liveness loss. See more

pkg/api/payer/client_manager.go

• Stale gRPC connection cache in Gateway/Payer client manager causes publish liveness degradation and potential message blackholing. See more

Warnings

pkg/proto/mls/message_contents/component_permissions.pb.go

• Ambiguous DeletePolicy semantics in MLS ComponentPermissions proto causes unauthorized whole-component deletion. See more

---

🔗 Commit Hash: 5e57346
🛡️ Octane Dashboard: All vulnerabilities