Batch dependency updates

.bazelrc

@@ -33,6 +33,9 @@ build:llvm --extra_toolchains=@llvm//toolchain:all
 build:llvm --per_file_copt=external/boost.context@-std=c++17
 
 # AddressSanitizer: bazel test //... --config=asan
+# The feature tells the toolchain asan is on: apple_support 2.x otherwise adds
+# -D_FORTIFY_SOURCE=1, which clashes with ASan's built-in 0 under -Werror.
+build:asan --features=asan
 build:asan --strip=never
 build:asan --copt=-fsanitize=address
 build:asan --copt=-fno-omit-frame-pointer

.github/workflows/canary.yml

@@ -25,7 +25,7 @@ permissions:
 jobs:
   boringssl-latest:
     name: bazel vs latest BCR boringssl
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     steps:
       - uses: actions/checkout@v7
       - uses: bazel-contrib/setup-bazel@0.19.0

.github/workflows/ci.yml

@@ -96,7 +96,7 @@ jobs:
 
   noexcept:
     name: bazel (-fno-exceptions runtime)
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     steps:
       - uses: actions/checkout@v7
       - uses: bazel-contrib/setup-bazel@0.19.0
@@ -127,7 +127,7 @@ jobs:
 
   fuzz:
     name: fuzz (libFuzzer smoke)
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     steps:
       - uses: actions/checkout@v7
       - uses: bazel-contrib/setup-bazel@0.19.0
@@ -207,7 +207,7 @@ jobs:
   #   bazelisk mod deps --lockfile_mode=update   (root and examples/bazel-consumer)
   lockfiles:
     name: lockfiles (resolution freshness)
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     steps:
       - uses: actions/checkout@v7
       - uses: bazel-contrib/setup-bazel@0.19.0
@@ -223,7 +223,7 @@ jobs:
 
   codegen:
     name: codegen (gradle)
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     steps:
       - uses: actions/checkout@v7
       - uses: actions/setup-java@v6
@@ -251,7 +251,7 @@ jobs:
   # baseline has soaked (same posture as benchmarks below).
   coverage:
     name: coverage (runtime, lcov)
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     steps:
       - uses: actions/checkout@v7
       - uses: bazel-contrib/setup-bazel@0.19.0
@@ -270,11 +270,13 @@ jobs:
           REPORT="$(bazelisk info output_path)/_coverage/_coverage_report.dat"
           # The multithreaded runtime tests can tear gcov's non-atomic
           # profile counters, leaving spurious negative hit counts that
-          # lcov 2.x treats as fatal (1.x only warned). Downgrade to a
-          # warning — this job is measurement-only, with no threshold gate.
-          lcov --ignore-errors negative --summary "$REPORT"
-          lcov --ignore-errors negative --list "$REPORT"
-          genhtml --ignore-errors negative --output-directory coverage-html "$REPORT"
+          # lcov 2.x treats as fatal (1.x only warned); newer lcov also flags
+          # the resulting "unhit function with hit lines" as inconsistent.
+          # Downgrade both to warnings — this job is measurement-only, with
+          # no threshold gate.
+          lcov --ignore-errors negative,inconsistent --summary "$REPORT"
+          lcov --ignore-errors negative,inconsistent --list "$REPORT"
+          genhtml --ignore-errors negative,inconsistent --output-directory coverage-html "$REPORT"
           cp "$REPORT" coverage-html/coverage.lcov
       - uses: actions/upload-artifact@v7
         with:
@@ -284,7 +286,7 @@ jobs:
   # Informational (PLAN Phase 7): publish numbers, no pass/fail threshold yet.
   benchmarks:
     name: benchmarks (informational)
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     continue-on-error: true
     steps:
       - uses: actions/checkout@v7
@@ -302,6 +304,9 @@ jobs:
 
   lint:
     name: lint
+    # Held on 24.04: 26.04's clang-tidy (21+) enables checks that flag ~180
+    # sites (modernize-use-scoped-lock, -use-designated-initializers, ...).
+    # Move with that cleanup, not with a runner bump.
     runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@v7

.github/workflows/release.yml

@@ -14,7 +14,7 @@ permissions:
 jobs:
   release:
     name: publish GitHub Release
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     steps:
       - uses: actions/checkout@v7
         with:

MODULE.bazel

@@ -9,7 +9,7 @@ module(
 )
 
 bazel_dep(name = "platforms", version = "1.1.0")
-bazel_dep(name = "rules_cc", version = "0.2.22")
+bazel_dep(name = "rules_cc", version = "0.2.25")
 bazel_dep(name = "googletest", version = "1.18.0.bcr.1")
 bazel_dep(name = "google_benchmark", version = "1.9.5")
 bazel_dep(name = "boost.asio", version = "1.90.0.bcr.1")
@@ -38,7 +38,7 @@ bazel_dep(name = "rules_testing", version = "0.9.0", dev_dependency = True)
 # zero-sysroot, so the cell compiles against Bazel-supplied glibc/kernel
 # headers and libc++ instead of the runner's /usr/include, and the LLVM
 # version rides the module rather than a pinned release tarball.
-bazel_dep(name = "llvm", version = "0.8.19", dev_dependency = True)
+bazel_dep(name = "llvm", version = "0.8.24", dev_dependency = True)
 
 # The code generator runs inside the build graph as a hermetic Java action
 # (bazel/defs.bzl); rules_jvm_external pins its Smithy dependencies.
@@ -54,10 +54,10 @@ maven.install(
     artifacts = [
         # alloy#simpleRestJson — the vendor-neutral REST/JSON protocol trait.
         "com.disneystreaming.alloy:alloy-core:0.3.40",
-        "software.amazon.smithy:smithy-build:1.73.0",
-        "software.amazon.smithy:smithy-codegen-core:1.73.0",
-        "software.amazon.smithy:smithy-protocol-test-traits:1.73.0",
-        "software.amazon.smithy:smithy-protocol-traits:1.73.0",
+        "software.amazon.smithy:smithy-build:1.74.0",
+        "software.amazon.smithy:smithy-codegen-core:1.74.0",
+        "software.amazon.smithy:smithy-protocol-test-traits:1.74.0",
+        "software.amazon.smithy:smithy-protocol-traits:1.74.0",
     ],
     lock_file = "//:maven_install.json",
     repositories = ["https://repo1.maven.org/maven2"],

codegen/build.gradle.kts

@@ -1,7 +1,7 @@
 plugins {
     // 7.2.x is the first Spotless line that documents Gradle 9 support;
     // pinned alongside CI's gradle-version bump.
-    id("com.diffplug.spotless") version "8.10.2" apply false
+    id("com.diffplug.spotless") version "8.10.3" apply false
 }
 
 subprojects {

codegen/smithy-cpp-codegen/build.gradle.kts

@@ -219,19 +219,19 @@ tasks.withType<Test>().configureEach {
 }
 
 dependencies {
-    api("software.amazon.smithy:smithy-codegen-core:1.73.0")
-    api("software.amazon.smithy:smithy-build:1.73.0")
+    api("software.amazon.smithy:smithy-codegen-core:1.74.0")
+    api("software.amazon.smithy:smithy-build:1.74.0")
     // Trait definitions used by the fixture models.
     // alloy#simpleRestJson — the vendor-neutral REST/JSON protocol (smithy4s).
     // alloy is built against Smithy 1.58, which the whole build now pins to.
     implementation("com.disneystreaming.alloy:alloy-core:0.3.40")
-    implementation("software.amazon.smithy:smithy-protocol-traits:1.73.0")
+    implementation("software.amazon.smithy:smithy-protocol-traits:1.74.0")
     // smithy.test#http{Request,Response}Tests trait definitions.
-    implementation("software.amazon.smithy:smithy-protocol-test-traits:1.73.0")
+    implementation("software.amazon.smithy:smithy-protocol-test-traits:1.74.0")
     // The official conformance suite models (generateProtocolTests classpath only).
     // alloy's simpleRestJson conformance suite.
     protocolTestModels("com.disneystreaming.alloy:alloy-protocol-tests:0.3.40")
-    protocolTestModels("software.amazon.smithy:smithy-protocol-tests:1.73.0")
+    protocolTestModels("software.amazon.smithy:smithy-protocol-tests:1.74.0")
 
     testImplementation(platform("org.junit:junit-bom:6.1.3"))
     testImplementation("org.junit.jupiter:junit-jupiter")

docs/quickstart.md

@@ -59,7 +59,7 @@ git_override(
 )
 
 bazel_dep(name = "googletest", version = "1.18.0.bcr.1")
-bazel_dep(name = "rules_cc", version = "0.2.22")
+bazel_dep(name = "rules_cc", version = "0.2.25")
 bazel_dep(name = "rules_shell", version = "0.8.0")  # only for shell-driven tests (sh_test)
 ```
 

examples/bazel-consumer/MODULE.bazel

@@ -15,5 +15,5 @@ local_path_override(
 )
 
 bazel_dep(name = "googletest", version = "1.18.0.bcr.1")
-bazel_dep(name = "rules_cc", version = "0.2.22")
+bazel_dep(name = "rules_cc", version = "0.2.25")
 bazel_dep(name = "rules_shell", version = "0.8.0")