Update Protos

[github-actions]

• Nightly Proto Update

Auto-generated by create-pull-request

[octane-security-app]

Summary by Octane

New Contracts

No new contracts were added.

Updated Contracts

• mls.pb.go: The smart contract enhancements include stricter validation of mutate_id, clearer catch-up and live delivery delineation, and improved message ordering.
• message_api.pb.go: Enhanced catch-up handling, unique mutate_id for streams, distinct live and replay envelopes, and clearer catch-up-to-live transition.

---

🔗 Commit Hash: 9595c2e

[macroscopeapp]

Approvability

Verdict: Needs human review

Auto-generated proto updates adding a new mutateId field and renaming types with xmtpv4 prefix. All modified files are owned by xmtp/backend, and the bot author has no ownership - designated code owners should review these API schema changes.

^{You can customize Macroscope's approvability policy. Learn more.}

[octane-security-app]

Overview

Vulnerabilities found:	4
Severity breakdown:	1 Medium, 1 Low, 2 Informational

Detailed findings

pkg/api/message/subscribe_topics.go

• Contract/ordering mismatch in Subscribe catch-up pagination causes client data loss or sync/import failures. See more

pkg/api/message/subscribe.go

• Missing mutate_id stamping in QueryApi.Subscribe Envelopes frames causes replay/live misclassification and potential bounded-sync data loss. See more
• Spec/implementation mismatch in Subscribe remove semantics under stale originator cache causes mid-wave replay gaps. See more
• Proto contract update without server enforcement/stamping in QueryApi.Subscribe causes replay/live misattribution. See more

---

🔗 Commit Hash: 9595c2e
🛡️ Octane Dashboard: All vulnerabilities