Update dependency com.google.protobuf:protobuf-java to v3.25.5 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
com.google.protobuf:protobuf-java (source)	3.13.0 -> 3.25.5

⚠️ README.md must be updated manually

GitHub Vulnerability Alerts

CVE-2021-22569

Summary

A potential Denial of Service issue in protobuf-java was discovered in the parsing procedure for binary data.

Reporter: OSS-Fuzz

Affected versions: All versions of Java Protobufs (including Kotlin and JRuby) prior to the versions listed below. Protobuf "javalite" users (typically Android) are not affected.

Severity

CVE-2021-22569 High - CVSS Score: 7.5, An implementation weakness in how unknown fields are parsed in Java. A small (~800 KB) malicious payload can occupy the parser for several minutes by creating large numbers of short-lived objects that cause frequent, repeated GC pauses.

Proof of Concept

For reproduction details, please refer to the oss-fuzz issue that identifies the specific inputs that exercise this parsing weakness.

Remediation and Mitigation

Please update to the latest available versions of the following packages:

• protobuf-java (3.16.1, 3.18.2, 3.19.2)
• protobuf-kotlin (3.18.2, 3.19.2)
• google-protobuf [JRuby gem only] (3.19.2)

CVE-2022-3171

Summary

A potential Denial of Service issue in protobuf-java core and lite was discovered in the parsing procedure for binary and text format data. Input streams containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses.

Reporter: OSS Fuzz

Affected versions: This issue affects both the Java full and lite Protobuf runtimes, as well as Protobuf for Kotlin and JRuby, which themselves use the Java Protobuf runtime.

Severity

CVE-2022-3171 Medium - CVSS Score: 5.7 (NOTE: there may be a delay in publication)

Remediation and Mitigation

Please update to the latest available versions of the following packages:

protobuf-java (3.21.7, 3.20.3, 3.19.6, 3.16.3)
protobuf-javalite (3.21.7, 3.20.3, 3.19.6, 3.16.3)
protobuf-kotlin (3.21.7, 3.20.3, 3.19.6, 3.16.3)
protobuf-kotlin-lite (3.21.7, 3.20.3, 3.19.6, 3.16.3)
google-protobuf [JRuby gem only] (3.21.7, 3.20.3, 3.19.6)

CVE-2022-3509

A parsing issue similar to CVE-2022-3171, but with textformat in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above.

CVE-2022-3510

A parsing issue similar to CVE-2022-3171, but with Message-Type Extensions in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above.

CVE-2021-22570

Nullptr dereference when a null char is present in a proto symbol. The symbol is parsed incorrectly, leading to an unchecked call into the proto file's name during generation of the resulting error message. Since the symbol is incorrectly parsed, the file is nullptr. We recommend upgrading to version 3.15.0 or greater.

CVE-2024-7254

Summary

When parsing unknown fields in the Protobuf Java Lite and Full library, a maliciously crafted message can cause a StackOverflow error and lead to a program crash.

Reporter: Alexis Challande, Trail of Bits Ecosystem Security Team [email protected]

Affected versions: This issue affects all versions of both the Java full and lite Protobuf runtimes, as well as Protobuf for Kotlin and JRuby, which themselves use the Java Protobuf runtime.

Severity

CVE-2024-7254 High CVSS4.0 Score 8.7 (NOTE: there may be a delay in publication)
This is a potential Denial of Service. Parsing nested groups as unknown fields with DiscardUnknownFieldsParser or Java Protobuf Lite parser, or against Protobuf map fields, creates unbounded recursions that can be abused by an attacker.

Proof of Concept

For reproduction details, please refer to the unit tests (Protobuf Java LiteTest and CodedInputStreamTest) that identify the specific inputs that exercise this parsing weakness.

Remediation and Mitigation

We have been working diligently to address this issue and have released a mitigation that is available now. Please update to the latest available versions of the following packages:

• protobuf-java (3.25.5, 4.27.5, 4.28.2)
• protobuf-javalite (3.25.5, 4.27.5, 4.28.2)
• protobuf-kotlin (3.25.5, 4.27.5, 4.28.2)
• protobuf-kotlin-lite (3.25.5, 4.27.5, 4.28.2)
• com-protobuf [JRuby gem only] (3.25.5, 4.27.5, 4.28.2)

---

Release Notes

protocolbuffers/protobuf (com.google.protobuf:protobuf-java)

v3.25.5

Compare Source

v3.25.4

Compare Source

v3.25.3

Compare Source

v3.25.2

Compare Source

v3.25.1

Compare Source

v3.25.0

Compare Source

v3.24.4

Compare Source

v3.24.3

Compare Source

v3.24.2

Compare Source

v3.24.1

Compare Source

v3.24.0

Compare Source

v3.23.4

Compare Source

v3.23.3

Compare Source

v3.23.2

Compare Source

v3.23.1

Compare Source

v3.23.0

Compare Source

v3.22.5

Compare Source

v3.22.4

Compare Source

v3.22.3

Compare Source

v3.22.2

Compare Source

v3.22.1

Compare Source

v3.22.0

Compare Source

v3.21.12

Compare Source

v3.21.11

Compare Source

v3.21.10

Compare Source

v3.21.9

Compare Source

v3.21.8

Compare Source

v3.21.7

Compare Source

v3.21.6

Compare Source

v3.21.5

Compare Source

v3.21.4

Compare Source

v3.21.3

Compare Source

v3.21.2

Compare Source

v3.21.1

Compare Source

v3.21.0

Compare Source

v3.20.3: Protocol Buffers v3.20.3

Compare Source

Java

• Refactoring java full runtime to reuse sub-message builders and prepare to
  migrate parsing logic from parse constructor to builder.
• Move proto wireformat parsing functionality from the private "parsing
  constructor" to the Builder class.
• Change the Lite runtime to prefer merging from the wireformat into mutable
  messages rather than building up a new immutable object before merging. This
  way results in fewer allocations and copy operations.
• Make message-type extensions merge from wire-format instead of building up
  instances and merging afterwards. This has much better performance.
• Fix TextFormat parser to build up recurring (but supposedly not repeated)
  sub-messages directly from text rather than building a new sub-message and
  merging the fully formed message into the existing field.
• This release addresses a Security Advisory for Java users

v3.20.2: Protocol Buffers v3.20.2

Compare Source

C++

• Reduce memory consumption of MessageSet parsing
• This release addresses a Security Advisory for C++ and Python users

v3.20.1: Protocol Buffers v3.20.1

Compare Source

PHP

• Fix building packaged PHP extension (#​9727)
• Fixed composer.json to only advertise compatibility with PHP 7.0+. (#​9819)

Ruby

• Disable the aarch64 build on macOS until it can be fixed. (#​9816)

Other

• Fix versioning issues in 3.20.0

v3.20.0: Protocol Buffers v3.20.0

Compare Source

2022-03-25 version 3.20.0 (C++/Java/Python/PHP/Objective-C/C#/Ruby/JavaScript)

Ruby

• Dropped Ruby 2.3 and 2.4 support for CI and releases. (#​9311)
• Added Ruby 3.1 support for CI and releases (#​9566).
• Message.decode/encode: Add recursion_limit option (#​9218/#​9486)
• Allocate with xrealloc()/xfree() so message allocation is visible to the
  Ruby GC. In certain tests this leads to much lower memory usage due to more
  frequent GC runs (#​9586).
• Fix conversion of singleton classes in Ruby (#​9342)
• Suppress warning for intentional circular require (#​9556)
• JSON will now output shorter strings for double and float fields when possible
  without losing precision.
• Encoding and decoding of binary format will now work properly on big-endian
  systems.
• UTF-8 verification was fixed to properly reject surrogate code points.
• Unknown enums for proto2 protos now properly implement proto2's behavior of
  putting such values in unknown fields.

Java

• Revert "Standardize on Array copyOf" (#​9400)
• Resolve more java field accessor name conflicts (#​8198)
• Don't support map fields in DynamicMessage.Builder.{getFieldBuilder,getRepeatedFieldBuilder}
• Fix parseFrom to only throw InvalidProtocolBufferException
• InvalidProtocolBufferException now allows arbitrary wrapped Exception types.
• Fix bug in FieldSet.Builder.mergeFrom
• Flush CodedOutputStream also flushes underlying OutputStream
• When oneof case is the same and the field type is Message, merge the
  subfield. (previously it was replaced.)’
• Add @​CheckReturnValue to some protobuf types
• Report original exceptions when parsing JSON
• Add more info to @​deprecated javadoc for set/get/has methods
• Fix initialization bug in doc comment line numbers
• Fix comments for message set wire format.

Kotlin

• Add test scope to kotlin-test for protobuf-kotlin-lite (#​9518)
• Add orNull extensions for optional message fields.
• Add orNull extensions to all proto3 message fields.

Python

• Dropped support for Python < 3.7 (#​9480)
• Protoc is now able to generate python stubs (.pyi) with --pyi_out
• Pin multibuild scripts to get manylinux1 wheels back (#​9216)
• Fix type annotations of some Duration and Timestamp methods.
• Repeated field containers are now generic in field types and could be used
  in type annotations.
  *[Breaking change] Protobuf python generated codes are simplified. Descriptors and message
  classes' definitions are now dynamic created in internal/builder.py.
  Insertion Points for messages classes are discarded.
• has_presence is added for FieldDescriptor in python
• Loosen indexing type requirements to allow valid index() implementations
  rather than only PyLongObjects.
• Fix the deepcopy bug caused by not copying message_listener.
• Added python JSON parse recursion limit (default 100)
• Path info is added for python JSON parse errors
• Pure python repeated scalar fields will not able to pickle. Convert to list
  first.
• Timestamp.ToDatetime() now accepts an optional tzinfo parameter. If
  specified, the function returns a timezone-aware datetime in the given time
  zone. If omitted or None, the function returns a timezone-naive UTC datetime
  (as previously).
• Adds client_streaming and server_streaming fields to MethodDescriptor.
• Add "ensure_ascii" parameter to json_format.MessageToJson. This allows smaller
  JSON serializations with UTF-8 or other non-ASCII encodings.
• Added experimental support for directly assigning numpy scalars and array.
• Improve the calculation of public_dependencies in DescriptorPool.
• [Breaking Change] Disallow setting fields to numpy singleton arrays or repeated fields to numpy
  multi-dimensional arrays. Numpy arrays should be indexed or flattened explicitly before assignment.

Compiler

• Migrate IsDefault(const std::string*) and UnsafeSetDefault(const std::string*)
• Implement strong qualified tags for TaggedPtr
• Rework allocations to power-of-two byte sizes.
• Migrate IsDefault(const std::string*) and UnsafeSetDefault(const std::string*)
• Implement strong qualified tags for TaggedPtr
• Make TaggedPtr Set...() calls explicitly spell out the content type.
• Check for parsing error before verifying UTF8.
• Enforce a maximum message nesting limit of 32 in the descriptor builder to
  guard against stack overflows
• Fixed bugs in operators for RepeatedPtrIterator
• Assert a maximum map alignment for allocated values
• Fix proto1 group extension protodb parsing error
• Do not log/report the same descriptor symbol multiple times if it contains
  more than one invalid character.
• Add UnknownFieldSet::SerializeToString and SerializeToCodedStream.
• Remove explicit default pointers and deprecated API from protocol compiler

Arenas

• Change Repeated*Field to reuse memory when using arenas.
• Implements pbarenaz for profiling proto arenas
• Introduce CreateString() and CreateArenaString() for cleaner semantics
• Fix unreferenced parameter for MSVC builds
• Add UnsafeSetAllocated to be used for one-of string fields.
• Make Arena::AllocateAligned() a public function.
• Determine if ArenaDtor related code generation is necessary in one place.
• Implement on demand register ArenaDtor for InlinedStringField

C++

• Enable testing via CTest (#​8737)
• Add option to use external GTest in CMake (#​8736)
• CMake: Set correct sonames for libprotobuf-lite.so and libprotoc.so (#​8635) (#​9529)
• Add cmake option protobuf_INSTALL to not install files (#​7123)
• CMake: Allow custom plugin options e.g. to generate mocks (#​9105)
• CMake: Use linker version scripts (#​9545)
• Manually *struct Cord fields to work better with arenas.
• Manually destruct map fields.
• Generate narrower code
• Fix https://github.com/protocolbuffers/protobuf/issues/9378 by removing
  shadowed cached_size field
• Remove GetPointer() and explicit nullptr defaults.
• Add proto_h flag for speeding up large builds
• Add missing overload for reference wrapped fields.
• Add MergedDescriptorDatabase::FindAllFileNames()
• RepeatedField now defines an iterator type instead of using a pointer.
• Remove obsolete macros GOOGLE_PROTOBUF_HAS_ONEOF and GOOGLE_PROTOBUF_HAS_ARENAS.

PHP

• Fix: add missing reserved classnames (#​9458)
• PHP 8.1 compatibility (#​9370)

C#

• Fix trim warnings (#​9182)
• Fixes NullReferenceException when accessing FieldDescriptor.IsPacked (#​9430)
• Add ToProto() method to all descriptor classes (#​9426)
• Add an option to preserve proto names in JsonFormatter (#​6307)

Objective-C

• Add prefix_to_proto_package_mappings_path option. (#​9498)
• Rename proto_package_to_prefix_mappings_path to package_to_prefix_mappings_path. (#​9552)
• Add a generation option to control use of forward declarations in headers. (#​9568)

v3.19.6: Protocol Buffers v3.19.6

Compare Source

Java

• Refactoring java full runtime to reuse sub-message builders and prepare to
  migrate parsing logic from parse constructor to builder.
• Move proto wireformat parsing functionality from the private "parsing
  constructor" to the Builder class.
• Change the Lite runtime to prefer merging from the wireformat into mutable
  messages rather than building up a new immutable object before merging. This
  way results in fewer allocations and copy operations.
• Make message-type extensions merge from wire-format instead of building up
  instances and merging afterwards. This has much better performance.
• Fix TextFormat parser to build up recurring (but supposedly not repeated)
  sub-messages directly from text rather than building a new sub-message and
  merging the fully formed message into the existing field.
• This release addresses a Security Advisory for Java users

v3.19.5: Protocol Buffers v3.19.5

Compare Source

C++

• Reduce memory consumption of MessageSet parsing
• This release addresses a Security Advisory for C++ and Python users

v3.19.4: Protocol Buffers v3.19.4

Compare Source

Python

• Make libprotobuf symbols local on OSX to fix issue #​9395 (#​9435)

Ruby

• Fixed a data loss bug that could occur when the number of optional fields in a message is an exact multiple of 32. (#​9440).

PHP

• Fixed a data loss bug that could occur when the number of optional fields in a message is an exact multiple of 32. (#​9440).

v3.19.3: Protocol Buffers v3.19.3

Compare Source

Python

• Fix missing Windows wheel for Python 3.10 on PyPI

v3.19.2: Protocol Buffers v3.19.2

Compare Source

Java

• Improve performance characteristics of UnknownFieldSet parsing (#​9371)
• This release addresses a Security Advisory for Java users

v3.19.1: Protocol Buffers v3.19.1

Compare Source

Bazel

• Ensure that release archives contain everything needed for Bazel (#​9131)
• Align dependency handling with Bazel best practices (#​9165)

JavaScript

• Fix ReferenceError: window is not defined when getting the global object (#​9156)

Ruby

• Fix memory leak in MessageClass.encode (#​9150)

v3.19.0: Protocol Buffers v3.19.0

Compare Source

C++

• Make proto2::Message::DiscardUnknownFields() non-virtual
• Separate RepeatedPtrField into its own header file
• For default floating point values of 0, consider all bits significant
• cmake: support MSVC_RUNTIME_LIBRARY property (#​8851)
• Fix shadowing warnings (#​8926)
• Fix for issue #​8484, constant initialization doesn't compile in msvc clang-cl environment (#​8993)
• Fix build on AIX and SunOS (#​8373) (#​9065)
• Add Android stlport and default toolchains to BUILD. (#​8290)

Java

• For default floating point values of 0, consider all bits significant
• Annotate //java/com/google/protobuf/util/... with nullness annotations
• Use ArrayList copy constructor (#​7853)

Kotlin

• Switch Kotlin proto DSLs to be implemented with inline value classes
• Fixing inlining and deprecation for repeated string fields (#​9120)

Python

• Proto2 DecodeError now includes message name in error message
• Make MessageToDict convert map keys to strings (#​8122)
• Add python-requires in setup.py (#​8989)
• Add python 3.10 (#​9034)

JavaScript

• Skip exports if not available by CommonJS (#​8856)
• JS: Comply with CSP no-unsafe-eval. (#​8864)

PHP

• Added "object" as a reserved name for PHP (#​8962)

Ruby

• Override Map.clone to use Map's dup method (#​7938)
• Ruby: build extensions for arm64-darwin (#​8232)
• Add class method Timestamp.from_time to ruby well known types (#​8562)
• Adopt pure ruby DSL implementation for JRuby (#​9047)
• Add size to Map class (#​8068)
• Fix for descriptor_pb.rb: google/protobuf should be required first (#​9121)

C#

• Correctly set ExtensionRegistry when parsing with MessageParser, but using an already existing CodedInputStream (#​7246)
• [C#] Make FieldDescriptor propertyName public (#​7642)

v3.18.3: Protocol Buffers v3.18.3

Compare Source

C++

• Reduce memory consumption of MessageSet parsing
• This release addresses a Security Advisory for C++ and Python users

v3.18.2: Protocol Buffers v3.18.2

Compare Source

Java

• Improve performance characteristics of UnknownFieldSet parsing (#​9371)

v3.18.1: Protocol Buffers v3.18.1

Compare Source

Python

• Update setup.py to reflect that we now require at least Python 3.5 (#​8989)
• Performance fix for DynamicMessage: force GetRaw() to be inlined (#​9023)

Ruby

• Update ruby_generator.cc to allow proto2 imports in proto3 (#​9003)

v3.18.0: Protocol Buffers v3.18.0

Compare Source

C++

• Fix warnings raised by clang 11 (#​8664)
• Make StringPiece constructible from std::string_view (#​8707)
• Add missing capability attributes for LLVM 12 (#​8714)
• Stop using std::iterator (deprecated in C++17). (#​8741)
• Move field_access_listener from libprotobuf-lite to libprotobuf (#​8775)
• Fix #​7047 Safely handle setlocale (#​8735)
• Remove deprecated version of SetTotalBytesLimit() (#​8794)
• Support arena allocation of google::protobuf::AnyMetadata (#​8758)
• Fix undefined symbol error around SharedCtor() (#​8827)
• Fix default value of enum(int) in json_util with proto2 (#​8835)
• Better Smaller ByteSizeLong
• Introduce event filters for inject_field_listener_events
• Reduce memory usage of DescriptorPool
• For lazy fields copy serialized form when allowed.
• Re-introduce the InlinedStringField class
• v2 access listener
• Reduce padding in the proto's ExtensionRegistry map.
• GetExtension performance optimizations
• Make tracker a static variable rather than call static functions
• Support extensions in field access listener
• Annotate MergeFrom for field access listener
• Fix incomplete types for field access listener
• Add map_entry/new_map_entry to SpecificField in MessageDifferencer. They
  record the map items which are different in MessageDifferencer's reporter.
• Reduce binary size due to fieldless proto messages
• TextFormat: ParseInfoTree supports getting field end location in addition to
  start.
• Fix repeated enum extension size in field listener
• Enable Any Text Expansion for Descriptors::DebugString()
• Switch from int{8,16,32,64} to int{8,16,32,64}_t

Java

• Fix errorprone conflict (#​8723)
• Removing deprecated TimeUtil class. (#​8749)
• Optimized FieldDescriptor.valueOf() to avoid array copying.
• Removing deprecated TimeUtil class.
• Add Durations.parseUnchecked(String) and Timestamps.parseUnchecked(String)
• FieldMaskUtil: Add convenience method to mask the fields out of a given proto.

JavaScript

• Optimize binary parsing of repeated float64
• Fix for optimization when reading doubles from binary wire format
• Replace toArray implementation with toJSON.

PHP

• Migrate PHP & Ruby to ABSL wyhash (#​8854)
• Added support for PHP 8.1 (currently in RC1) to the C extension (#​8964)
• Fixed PHP SEGV when constructing messages from a destructor. (#​8969)

Ruby

• Move DSL implementation from C to pure Ruby (#​8850)
• Fixed a memory bug with RepeatedField#+. (#​8970)

Python

• Drops support for 2.7 and 3.5.

Other

• [csharp] ByteString.CreateCodedInput should use ArraySegment offset and count (#​8740)
• [ObjC] Add support for using the proto package to prefix symbols. (#​8760)
• field_presence.md: fix Go example (#​8788)

v3.17.3: Protocol Buffers v3.17.3

Compare Source

Python

• Note: This is the last release to support Python 2.7. Future releases will require Python >= 3.5.

C++

• Introduce FieldAccessListener.
• Stop emitting boilerplate {Copy/Merge}From in each ProtoBuf class
• Fixed some uninitialized variable warnings in generated_message_reflection.cc.

Kotlin

• Fix duplicate proto files error (#​8699)

Java

• Fixed parser to check that we are at a proper limit when a sub-message has
  finished parsing.

General

• Support M1 (#​8557)

v3.17.2: Protocol Buffers v3.17.2

Compare Source

Kotlin

• Fix duplicate class error (#​8653)

PHP

• Fixed SEGV in sub-message getters for well-known types when message is unset
  (#​8670)

v3.17.1: Protocol Buffers v3.17.1

Compare Source

PHP

• Fixed PHP memory leaks and arginfo errors. (#​8614)
• Fixed JSON parser to allow multiple values from the same oneof as long as all but one are null.

Ruby

• Fixed memory bug: properly root repeated/map field when assigning. (#​8639)
• Fixed JSON parser to allow multiple values from the same oneof as long as all but one are null.

v3.17.0: Protocol Buffers v3.17.0

Compare Source

Protocol Compiler

• Fix the generated source information for reserved values in Enums.

C++

• Fix -Wunused-parameter in map<string, int> fields (fixes #​8494) (#​8500)
• Use byteswap.h when building against musl libc (#​8503)
• Fix -Wundefined-inline error when using SharedCtor() or SharedDtor() (#​8532)
• Fix bug where Descriptor::DebugString() printed proto3 synthetic oneofs.
• Provide stable versions of SortAndUnique().
• Make sure to cache proto3 optional message fields when they are cleared.
• Expose UnsafeArena methods to Reflection.
• Use std::string::empty() rather than std::string::size() > 0.

Kotlin

• Introduce support for Kotlin protos (#​8272)
• Restrict extension setter and getter operators to non-nullable T.

Java

• updating GSON and Guava to more recent versions (#​8524)
• Reduce the time spent evaluating isExtensionNumber by storing the extension
  ranges in a TreeMap for faster queries. This is particularly relevant for
  protos which define a large number of extension ranges, for example when
  each tag is defined as an extension.
• Fix java bytecode estimation logic for optional fields.
• Optimize Descriptor.isExtensionNumber.

Python

• Add MethodDescriptor.CopyToProto() (#​8327)
• Remove unused python_protobuf.{cc,h} (#​8513)
• Start publishing python aarch64 manylinux wheels normally (#​8530)
• Fix constness issue detected by MSVC standard conforming mode (#​8568)
• Make JSON parsing match C++ and Java when multiple fields from the same
  oneof are present and all but one is null.

Ruby

• Add support for proto3 json_name in compiler and field definitions (#​8356)
• Fixed memory leak of Ruby arena objects. (#​8461)
• Fix source gem compilation (#​8471)
• Fix various exceptions in Ruby on 64-bit Windows (#​8563)
• Fix crash when calculating Message hash values on 64-bit Windows (#​8565)

Conformance Tests

• Added a conformance test for the case of multiple fields from the same
  oneof.

Other

• Use a newer version of rules_proto, with the new rule proto_descriptor_set (#​8469)

v3.16.3: Protobuf Release v3.16.3

Compare Source

Java

• Refactoring java full runtime to reuse sub-message builders and prepare to
  migrate parsing logic from parse constructor to builder.
• Move proto wireformat parsing functionality from the private "parsing
  constructor" to the Builder class.
• Change the Lite runtime to prefer merging from the wireformat into mutable
  messages rather than building up a new immutable object before merging. This
  way results in fewer allocations and copy operations.
• Make message-type extensions merge from wire-format instead of building up
  instances and merging afterwards. This has much better performance.
• Fix TextFormat parser to build up recurring (but supposedly not repeated)
  sub-messages directly from text rather than building a new sub-message and
  merging the fully formed message into the existing field.
• This release addresses a Security Advisory for Java users

v3.16.1: Protocol Buffers v3.16.1

Compare Source

Java

• Improve performance characteristics of UnknownFieldSet parsing (#​9371)

v3.16.0: Protocol Buffers v3.16.0

Compare Source

C++

• Fix compiler warnings issue found in conformance_test_runner #​8189 (#​8190)
• Fix MinGW-w64 build issues. (#​8286)
• [Protoc] C++ Resolved an issue where NO_DESTROY and CONSTINIT are in incorrect order (#​8296)
• Fix PROTOBUF_CONSTINIT macro redefinition (#​8323)
• Delete StringPiecePod (#​8353)
• Fix gcc error: comparison of unsigned expression in '>= 0' is always … (#​8309)
• Fix cmake install on iOS (#​8301)
• Create a CMake option to control whether or not RTTI is enabled (#​8347)
• Fix endian.h location on FreeBSD (#​8351)
• Refactor util::Status (#​8354)
• Make util::Status more similar to absl::Status (#​8405)
• Fix -Wsuggest-destructor-override for generated C++ proto classes. (#​8408)
• Refactor StatusOr and StringPiece (#​8406)
• Refactor uint128 (#​8416)
• The ::pb namespace is no longer exposed due to conflicts.
• Allow MessageDifferencer::TreatAsSet() (and friends) to override previous
  calls instead of crashing.
• Reduce the size of generated proto headers for protos with string or
  bytes fields.
• Move arena() operation on uncommon path to out-of-line routine
• For iterator-pair function parameter types, take both iterators by value.
• Code-space savings and perhaps some modest performance improvements in
  RepeatedPtrField.
• Eliminate nullptr check from every tag parse.
• Remove unused _$name$cached_byte_size fields.
• Serialize extension ranges together when not broken by a proto field in the
  middle.
• Do out-of-line allocation and deallocation of string object in ArenaString.
• Streamline ParseContext::ParseMessage to avoid code bloat and improve
  performance.
• New member functions RepeatedField::Assign, RepeatedPtrField::{Add, Assign}.
• Fix undefined behavior warning due to innocuous uninitialization of value
  on an error path.
• Avoid expensive inlined code space for encoding message length for messages

  = 128 bytes and instead do a procedure call to a shared out-of-line routine.

• util::DefaultFieldComparator will be final in a future version of protobuf.
  Subclasses should inherit from SimpleFieldComparator instead.

C#

• Add .NET 5 target and improve WriteString performance with SIMD (#​8147)

Java

• deps: update JUnit and Truth (#​8319)
• Detect invalid overflow of byteLimit and return InvalidProtocolBufferException as documented.
• Exceptions thrown while reading from an InputStream in parseFrom are now
  included as causes.
• Support potentially more efficient proto parsing from RopeByteStrings.
• Clarify runtime of ByteString.Output.toStringBuffer().
• Added UnsafeByteOperations to protobuf-lite (#​8426)

JavaScript

• Make Any.pack() chainable.

Python

• Fix some constness / char literal issues being found by MSVC standard conforming mode (#​8344)
• Switch on "new" buffer API (#​8339)
• Enable crosscompiling aarch64 python wheels under dockcross manylinux docker image (#​8280)
• Fixed a bug in text format where a trailing colon was printed for repeated field.
• When TextFormat encounters a duplicate message map key, replace the current
  one instead of merging.

Objective-C

• Move the class map to a CFDictionary. (#​8328)

PHP

• read_property() handler is not supposed to return NULL (#​8362)
• Changed parameter type from long to integer (#​7613)
• fix: README supported PHP version for C extension (#​8236)

Ruby

• Fixed quadratic memory usage when appending to arrays. (#​8364)
• Fixed memory leak of Ruby arena objects. (#​8461)
• Add support for proto3 json_name in compiler and field definitions. (#​8356)

Other

• Some doc on AOT compilation and protobuf (#​8294)
• [CMake] Ability to pass options to protoc executable from cmake (#​8374)
• Add --fatal_warnings flag to treat warnings as errors (#​8131)
• [bazel] Remove deprecated way to depend on googletest (#​8396)
• add error returns missing from protoc to prevent it from exiting with… (#​8409)

v3.15.8: Protocol Buffers v3.15.8

Compare Source

Ruby

• Fixed memory leak of Ruby arena objects (#​8461)

v3.15.7: Protocol Buffers v3.15.7

Compare Source

C++

• Remove the ::pb namespace (alias) (#​8423)

Ruby

• Fix unbounded memory growth for Ruby <2.7 (#​8429)
• Fixed message equality in cases where the message type is different (#​8434)

v3.15.6: Protocol Buffers v3.15.6

Compare Source

Ruby

• Fixed bug in string comparison logic (#​8386)

v3.15.5: Protocol Buffers v3.15.5

Compare Source

Ruby

• Fixed quadratic memory use in array append (#​8379)

PHP

• Fixed quadratic memory use in array append (#​8379)

C++

• Do not disable RTTI by default in the CMake build (#​8377)

v3.15.4: Protocol Buffers v3.15.4

Compare Source

Ruby

• Fixed SEGV when users pass nil messages (#​8363)
• Fixed quadratic memory usage when appending to arrays (#​8364)

C++

• Create a CMake option to control whether or not RTTI is enabled (#​8361)

PHP

• read_property() handler is not supposed to return NULL (#​8362)

v3.15.3: Protocol Buffers v3.15.3

Compare Source

Ruby

• Ruby <2.7 now uses WeakMap too, which prevents memory leaks. (#​8341)

v3.15.2: Protocol Buffers v3.15.2

Compare Source

Ruby

• Fix for FieldDescriptor.get(msg) (#​8330)

C++

• Fix PROTOBUF_CONSTINIT macro redefinition (#​8323)

v3.15.1: Protocol Buffers v3.15.1

Compare Source

Ruby

• Bugfix for Message.[] for repeated or map fields (#​8313)
• Fix for truncating behavior when converting Float to Duration (#​8320)

C++

• Small fixes for MinGW and for C++20 with GCC (#​8318)

v3.15.0: Protocol Buffers v3.15.0

Compare Source

Protocol Compiler

• Optional fields for proto3 are enabled by default, and no longer require
  the --experimental_allow_proto3_optional flag.

C++

• MessageDifferencer: fixed bug when using custom ignore with multiple
  unknown fields
• Use init_seg in MSVC to push initialization to an earlier phase.
• Runtime no longer triggers -Wsign-compare warnings.
• Fixed -Wtautological-constant-out-of-range-compare warning.
• DynamicCastToGenerated works for nullptr input for even if RTTI is disabled
• Arena is refactored and optimized.
• Clarified/specified that the exact value of Arena::SpaceAllocated() is an
  implement

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.