From e5482cdd539060ee26f22c38d2c968e2479cd3bd Mon Sep 17 00:00:00 2001
From: Stefan VanBuren <svanburen@buf.build>
Date: Tue, 20 Jan 2026 16:19:15 -0500
Subject: [PATCH 1/2] Add `buf.lock` support

Ref: https://buf.build/docs/configuration/v2/buf-lock
---
 src/api/json/catalog.json          |  6 ++++
 src/schemas/json/buf.lock.json     | 51 ++++++++++++++++++++++++++++++
 src/test/buf.lock/buf.lock.v1.yaml |  3 ++
 src/test/buf.lock/buf.lock.v2.yaml | 10 ++++++
 4 files changed, 70 insertions(+)
 create mode 100644 src/schemas/json/buf.lock.json
 create mode 100644 src/test/buf.lock/buf.lock.v1.yaml
 create mode 100644 src/test/buf.lock/buf.lock.v2.yaml

diff --git a/src/api/json/catalog.json b/src/api/json/catalog.json
index 938073a44a6..1b00bc5ae10 100644
--- a/src/api/json/catalog.json
+++ b/src/api/json/catalog.json
@@ -636,6 +636,12 @@
       "fileMatch": ["buf.gen.yaml"],
       "url": "https://www.schemastore.org/buf.gen.json"
     },
+    {
+      "name": "buf.lock",
+      "description": "buf.lock is a dependency lock file generated by buf via 'buf dep update'. It represents a single, reproducible build of the workspace's external dependencies and should never be hand-edited.",
+      "fileMatch": ["buf.lock"],
+      "url": "https://www.schemastore.org/buf.lock.json"
+    },
     {
       "name": "buf.plugin.yaml",
       "description": "A `buf.plugin.yaml` file captures metadata about the plugin. It includes mandatory and optional fields that are displayed on the individual plugin page and the BSR plugin. Documentation: https://buf.build/plugins",
diff --git a/src/schemas/json/buf.lock.json b/src/schemas/json/buf.lock.json
new file mode 100644
index 00000000000..2ad283cc63c
--- /dev/null
+++ b/src/schemas/json/buf.lock.json
@@ -0,0 +1,51 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "https://json.schemastore.org/buf.lock.json",
+  "$comment": "https://buf.build/docs/configuration/v2/buf-lock",
+  "title": "buf.lock",
+  "description": "buf.lock is a dependency lock file generated by buf via 'buf dep update'. It represents a single, reproducible build of the workspace's external dependencies and should never be hand-edited.",
+  "type": "object",
+  "readOnly": true,
+  "required": ["version"],
+  "properties": {
+    "version": {
+      "description": "Buf configuration version.",
+      "type": "string",
+      "enum": ["v2", "v1", "v1beta1"]
+    },
+    "deps": {
+      "description": "Module pins, each uniquely representing a specific snapshot of a module, protected with a cryptographic digest.",
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": ["name", "commit", "digest"],
+        "additionalProperties": false,
+        "properties": {
+          "name": {
+            "description": "Module name.",
+            "type": "string",
+            "pattern": "^[a-z0-9.-]+/[a-z0-9-]+/[a-z0-9-]+$",
+            "examples": [
+              "buf.build/googleapis/googleapis",
+              "buf.build/grpc/grpc"
+            ]
+          },
+          "commit": {
+            "description": "Commit that uniquely identifies this snapshot of the module.",
+            "type": "string",
+            "pattern": "^[a-f0-9]{32}$",
+            "examples": ["7a6bc1e3207144b38e9066861e1de0ff"]
+          },
+          "digest": {
+            "description": "Digest of the module contents.",
+            "type": "string",
+            "pattern": "^b[0-9]+:[a-f0-9]+$",
+            "examples": [
+              "b5:6d05bde5ed4cd22531d7ca6467feb828d2dc45cc9de12ce3345fbddd64ddb1bf0db756558c32ca49e6bc7de4426ada8960d5590e8446854b81f5f36f0916dc48"
+            ]
+          }
+        }
+      }
+    }
+  }
+}
diff --git a/src/test/buf.lock/buf.lock.v1.yaml b/src/test/buf.lock/buf.lock.v1.yaml
new file mode 100644
index 00000000000..56ce0db902d
--- /dev/null
+++ b/src/test/buf.lock/buf.lock.v1.yaml
@@ -0,0 +1,3 @@
+# yaml-language-server: $schema=../../schemas/json/buf.lock.json
+# Generated by buf. DO NOT EDIT.
+version: v1
diff --git a/src/test/buf.lock/buf.lock.v2.yaml b/src/test/buf.lock/buf.lock.v2.yaml
new file mode 100644
index 00000000000..05e0ef9b335
--- /dev/null
+++ b/src/test/buf.lock/buf.lock.v2.yaml
@@ -0,0 +1,10 @@
+# yaml-language-server: $schema=../../schemas/json/buf.lock.json
+# Generated by buf. DO NOT EDIT.
+version: v2
+deps:
+  - name: buf.build/bufbuild/bufplugin
+    commit: e35f9b6674434a41aea0359ee056d083
+    digest: b5:0d2579c1953b5b20bfa5c9d183f17af030bd3e594e2de5ba11d12a12091e64257cb2d82ca0f2234a01085b26d7b9905a472723e40db94b6c925b1360d1a7b44a
+  - name: buf.build/bufbuild/protovalidate
+    commit: 6c6e0d3c608e4549802254a2eee81bc8
+    digest: b5:a7ca081f38656fc0f5aaa685cc111d3342876723851b47ca6b80cbb810cbb2380f8c444115c495ada58fa1f85eff44e68dc54a445761c195acdb5e8d9af675b6

From 29c8d9f6a4e7ef81d2cbd5c0d6e1235ebac901f5 Mon Sep 17 00:00:00 2001
From: Stefan VanBuren <svanburen@buf.build>
Date: Tue, 20 Jan 2026 16:22:50 -0500
Subject: [PATCH 2/2] Fix lint

---
 src/api/json/catalog.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/api/json/catalog.json b/src/api/json/catalog.json
index 1b00bc5ae10..98c3b8d345c 100644
--- a/src/api/json/catalog.json
+++ b/src/api/json/catalog.json
@@ -638,7 +638,7 @@
     },
     {
       "name": "buf.lock",
-      "description": "buf.lock is a dependency lock file generated by buf via 'buf dep update'. It represents a single, reproducible build of the workspace's external dependencies and should never be hand-edited.",
+      "description": "buf.lock is a dependency lock file generated by buf via 'buf dep update'. It represents a single, reproducible build of the workspace's external dependencies and should never be hand-edited",
       "fileMatch": ["buf.lock"],
       "url": "https://www.schemastore.org/buf.lock.json"
     },