Skip to content

Conversation

@cq-bot
Copy link

@cq-bot cq-bot commented Feb 1, 2026

This PR contains the following updates:

Package Type Update Change Pending
com_google_protobuf http_archive major v3.21.5 -> v33.4 v33.5
protobuf bazel_dep major 27.0 -> 33.5

Release Notes

protocolbuffers/protobuf (com_google_protobuf)

v33.4: Protocol Buffers v33.4

Compare Source

Announcements
  • Protobuf News may include additional announcements or pre-announcements for upcoming changes.
Other

v33.3: Protocol Buffers v33.3

Compare Source

Announcements
  • Protobuf News may include additional announcements or pre-announcements for upcoming changes.
Bazel
Compiler
C++
Java
Csharp
Python
UPB (Python/PHP/Ruby C-Extension)
Other

v33.2: Protocol Buffers v33.2

Compare Source

Announcements
  • Protobuf News may include additional announcements or pre-announcements for upcoming changes.
Compiler
C++
Java
Csharp
PHP
PHP C-Extension
Ruby
Ruby C-Extension
UPB (Python/PHP/Ruby C-Extension)

v33.1: Protocol Buffers v33.1

Compare Source

Announcements
  • Protobuf News may include additional announcements or pre-announcements for upcoming changes.
C++
Java

v33.0: Protocol Buffers v33.0

Compare Source

Announcements
  • Protobuf News may include additional announcements or pre-announcements for upcoming changes.
Bazel
Compiler
C++
Java
Restored compatibility of runtime with gencode created with protoc <3.21

With this release, compatibility of the runtime with older gencode down to 3.0.0 is restored, compared to the previous support minimum of gencode created with 3.22+. Note that it is still strongly recommended to regenerate your gencode with a newer protoc and to avoid using gencode which was created with an old protoc.

Generated code from this range is covered by CVE-2022-3171 and is potentially vulnerable to a Denial of Service risk.

JavaProto 4.x previously dropped compatibility with the potentially vulnerable generated code, having the behavior of:

  • The vulnerable generated code was source-incompatible with new runtime (would not compile when built from source)
  • The vulnerable generated code was ABI-incompatible with new runtime (when using a .class file compiled against old runtime, a NoSuchMethodException would be thrown at parse time).

Starting with this release:

  • The vulnerable generated code is now source-compatible (will compile).
  • The first time each potentially vulnerable type is parsed, an error message will be logged noting that potentially vulnerable generated code is in use and the name of the corresponding type.
  • Environment variables may be set to either throw an exception instead (-Dcom.google.protobuf.error_on_unsafe_pre22_gencode) or to entirely silence the logged messages (-Dcom.google.protobuf.use_unsafe_pre22_gencode)

This change was made based on community feedback regarding the difficulty in identifying and quickly remediating stale gencode in their transitive dependencies weighed against a careful evaluation of the realistic risk exposure of DoS (with no risk of other concerns including information leak or RCE).

We strongly recommend that any users who observe the log messages to regenerate the corresponding code with a newer protoc. We recommend that any security-conscious services opt into the error_on_unsafe_pre22_gencode behavior to preclude any risk of a Denial of Service surface area being exposed.

A future 4.x release may flip the default behavior to error by default as a measure to further help the ecosystem avoid the Denial of Service risks, while still maintaining the ability to opt into continuing to use insecure gencode for users who are parsing trusted inputs and where the difficulty of regenerating is high.

Changes
Rust
Python
PHP
UPB (Python/PHP/Ruby C-Extension)
Other

v32.1: Protocol Buffers v32.1

Compare Source

Announcements
  • Protobuf News may include additional announcements or pre-announcements for upcoming changes.
Compiler
C++
Java
Csharp
PHP

v32.0: Protocol Buffers v32.0

Compare Source

Announcements
  • Protobuf News may include additional announcements or pre-announcements for upcoming changes.
Bazel
Compiler
C++
Java
Csharp
Objective-C
  • Enable edition 2024 support in protoc and language generators for cpp, hpb, java, kotlin, objectivec, php, python, pyi, rust. (protocolbuffers/protobuf@26843b3)
Rust
Python
PHP
PHP C-Extension
Ruby
Ruby C-Extension
UPB (Python/PHP/Ruby C-Extension)
Other

v31.1: Protocol Buffers v31.1

Compare Source

Announcements
  • Protobuf News may include additional announcements or pre-announcements for upcoming changes.
Compiler
  • Support allowing late injection of language feature set defaults from FeatureSet extensions while getting feature set extension values. (protocolbuffers/protobuf@3419598)
C++
  • Support allowing late injection of language feature set defaults from FeatureSet extensions while getting feature set extension values. (protocolbuffers/protobuf@3419598)
Java
Python
Other

v31.0: Protocol Buffers v31.0

Compare Source

Announcements
  • Protobuf News may include additional announcements or pre-announcements for upcoming changes.
Bazel
  • Loosen py_proto_library check to be on the import path instead of full directory (i.e. excluding external/module-name prefix). (protocolbuffers/protobuf@a4be867)
Compiler
C++
Java
Kotlin
Csharp
Objective-C
Rust
Python
PHP
PHP C-Extension
Ruby
Ruby C-Extension
UPB (Python/PHP/Ruby C-Extension)

Configuration

📅 Schedule: Branch creation - Between 12:00 AM and 03:59 AM, on day 1 of the month ( * 0-3 1 * * ) (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.


  • If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants