Skip to content

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Apr 9, 2024

This PR contains the following updates:

Package Type Update Change
com_github_bazelbuild_buildtools http_archive major v6.4.0 -> v8.2.1
com_google_protobuf http_archive major v3.14.0 -> v33.0

Release Notes

bazelbuild/buildtools (com_github_bazelbuild_buildtools)

v8.2.1: Release 8.2.1 (2025-06-10)

Compare Source

What's Changed

New Contributors

Full Changelog: bazelbuild/buildtools@v8.2.0...v8.2.1

v8.2.0: Release 8.2.0 (2025-04-30)

Compare Source

What's Changed

New Contributors

Full Changelog: bazelbuild/buildtools@v8.0.3...v8.2.0

v8.0.3: Release 8.0.3 (2025-02-05)

Compare Source

What's Changed

Full Changelog: bazelbuild/buildtools@v8.0.2...v8.0.3

v8.0.2: Release 8.0.2 (2025-01-30)

Compare Source

What's Changed

New Contributors

Full Changelog: bazelbuild/buildtools@v8.0.1...v8.0.2

v8.0.1: Release 8.0.1 (2025-01-15)

Compare Source

What's Changed

New Contributors

Full Changelog: bazelbuild/buildtools@v8.0.0...v8.0.1

v8.0.0: Release 8.0.0 (2025-01-09)

Compare Source

What's Changed

Full Changelog: bazelbuild/buildtools@v7.3.1...v8.0.0

v7.3.1: Release 7.3.1 (2024-08-27)

Compare Source

What's Changed

New Contributors

Full Changelog: bazelbuild/buildtools@v7.1.2...v7.3.1

v7.1.2: Release 7.1.2 (2024-05-23)

Compare Source

What's Changed

Full Changelog: bazelbuild/buildtools@v7.1.1...v7.1.2

v7.1.1: Release 7.1.1 (2024-04-17)

Compare Source

What's Changed

New Contributors

Full Changelog: bazelbuild/buildtools@v7.1.0...v7.1.1

v7.1.0: Release 7.1.0 (2024-03-26)

Compare Source

  • Load statements are forced to be on the top of a file (except WORKSPACE files) and be sorted and compressed. Former warnings load-on-top, out-of-order-load and same-origin-load are now removed.
    • distribs are no longer being moved into the package declaration
    • Minor bug fixes
protocolbuffers/protobuf (com_google_protobuf)

v33.0: Protocol Buffers v33.0

Compare Source

Announcements

  • Protobuf News may include additional announcements or pre-announcements for upcoming changes.

Bazel

Compiler

  • Disable symbol visibility enforcement by default in C++ runtime (ae308fc)
  • Ship all option dependencies to plugins along with regular ones. (abeb130)

C++

  • Avoid calling deprecated arena-enabled constructors in arena.h. (813a7ef)
  • Add a macro to make RepeatedField(Arena*) constructor private in a future release. (768db14)
  • Add a macro to make Map(Arena*) constructor private in a future release. (543a17f)
  • Optimize ReadPackedVarint (3d94d83)
  • Add a macro to make RepeatedPtrField(Arena*) constructor private in a future release (6422b9d)
  • Add IsEmpty() function to reflection. (b64e490)
  • Refactor RuntimeAssertInBounds to remove repeated logic and make Get/Mutable easier to read. (2f270c4)
  • Disable symbol visibility enforcement by default in C++ runtime (ae308fc)
  • Fix a bug in the main C++ JSON parser/serializer camelcasing of certain non-style-compliant names incorrectly, in a way that would prevent it from interoperating with any other implementation on those fields. (e25e267)
  • Fail early for messages with more than 65k fields. (90824aa)
  • Add option to C++ JSON Parser/Serializer to allow customers to affirmatively disable legacy bug-compatibilty behaviors. (6ea1640)
  • Fix mishandling on JSON serialization of Timestamp with invalid negative and too-large nanos value. (a959f27)
  • Preserve features in type resolver (c7030f4)
  • Add a DCHECK that ArenaStringPtr::Set(char*, Arena*) is not called with (95b1763)

Java

Restored compatibility of runtime with gencode created with protoc <3.21

With this release, compatibility of the runtime with older gencode down to 3.0.0 is restored, compared to the previous support minimum of gencode created with 3.22+. Note that it is still strongly recommended to regenerate your gencode with a newer protoc and to avoid using gencode which was created with an old protoc.

Generated code from this range is covered by CVE-2022-3171 and is potentially vulnerable to a Denial of Service risk.

JavaProto 4.x previously dropped compatibility with the potentially vulnerable generated code, having the behavior of:

  • The vulnerable generated code was source-incompatible with new runtime (would not compile when built from source)
  • The vulnerable generated code was ABI-incompatible with new runtime (when using a .class file compiled against old runtime, a NoSuchMethodException would be thrown at parse time).

Starting with this release:

  • The vulnerable generated code is now source-compatible (will compile).
  • The first time each potentially vulnerable type is parsed, an error message will be logged noting that potentially vulnerable generated code is in use and the name of the corresponding type.
  • Environment variables may be set to either throw an exception instead (-Dcom.google.protobuf.error_on_unsafe_pre22_gencode) or to entirely silence the logged messages (-Dcom.google.protobuf.use_unsafe_pre22_gencode)

This change was made based on community feedback regarding the difficulty in identifying and quickly remediating stale gencode in their transitive dependencies weighed against a careful evaluation of the realistic risk exposure of DoS (with no risk of other concerns including information leak or RCE).

We strongly recommend that any users who observe the log messages to regenerate the corresponding code with a newer protoc. We recommend that any security-conscious services opt into the error_on_unsafe_pre22_gencode behavior to preclude any risk of a Denial of Service surface area being exposed.

A future 4.x release may flip the default behavior to error by default as a measure to further help the ecosystem avoid the Denial of Service risks, while still maintaining the ability to opt into continuing to use insecure gencode for users who are parsing trusted inputs and where the difficulty of regenerating is high.

Changes

  • Switch the pre22 warning to use CopyOnWriteArraySet. (#​23969) (e55224c)
  • Expose helpers for checking if messages and enums are nested. (8de4002)
  • Fix a bug calculating the file name in the absense of directories. (c4ff7a6)
  • Clarify the public APIs of GeneratorNames helpers. (537ac35)
  • Expose helpers to predict generated class names in java. (eba6df2)
  • Deprecate ClassName methods in favor of new QualifiedClassName ones. (ca4fb2f)
  • Restore the 3-argument internalBuildGeneratedFileFrom. (4376591)
  • Fix large java enums not being honored on lite runtime. (a995803)
  • Slightly relax Java Poison Pill on prerelease versions (-rc1, -dev, etc). (7b0bee3)
  • Avoid boxing/unboxing varint, fixed32, and fixed64 fields in UnknownFieldSet.Field (810272f)
  • Readd new*List() methods on GeneratedMessageV3. (badaf41)
  • Add Values.of(Map<String, Value> values). (c518f25)
  • Fix handling of optional dependencies in java generator. (8d51e34)
  • Restore ABI compatibility for extension methods which was previously (knowingly) broken with 4.x: 94a2a44 (ea33ae8)
  • Restore Protobuf Java extension modifiers in gencode that were previously removed in 7bff169 (f2257f5)
  • Ship all option dependencies to plugins along with regular ones. (abeb130)
  • Optimize redaction state calculation (e05db5c)
  • Add isPlaceholder() accessors to file, message, and enum descriptors (f978ec2)
  • Improve Java gencode static initialization to avoid unnecessary temporaries again (745e15b)
  • Improve Java gencode static initialization to avoid unnecessary temporaries (b68b673)
  • Remove protobuf-util usages of guava except annotations. (5768acd)
  • Restore compatibility of runtime with pre-3.22.x gencode impacted by CVE-2022-3171 (7c51e5b)
  • Expose an iterator for GeneratedMessage.ExtendableMessage.extensions (b25d39e)

Rust

  • Change Rust prelude to bring in traits as _ (c3f7e8d)
  • Make message Muts Send (8bff944)
  • See also UPB changes below, which may affect Rust.

Python

  • Publish s390x wheels for Python/upb. (56b2b89)
  • Fix a crash that happens during shutdown due to looking up modules in the cache (d57d270)
  • Add construction support for repeated Timestamp/Duration/Struct/ListValue. (5f6c013)
  • Fix handling of repeated extension fields in PyProto JSON (07ef676)
  • Fixed a parser bug where closed enums are parsed incorrectly for non-repeated extensions. (c36f728)
  • Fixed mypy errors by setting __slots__ to empty in .pyi files. (38ca2d3)
  • Raise warnings for float_precision from python json_format. (4659cd7)
  • Raise warnings when assign bool to int/enum field in Python Proto. This will turn into error in 34.0 release. (4ee55d7)

PHP

UPB (Python/PHP/Ruby C-Extension)

  • Fixed a parser bug where closed enums are parsed incorrectly for non-repeated extensions. (c36f728)

Other

  • Update token for BCR release to reuse existing BOT_ACCESS_TOKEN used for staleness_refresh.yml and update_php_repo.yml (#​23925) (dcace2f)
  • Use the 'better' JSON parser on the conformance suite harness. (4b4e405)
  • Add JSON conformance test that a single value provided for a repeated field should parse fail. (9806994)
  • Add conformance test cases for malformed nanos fields on Durations and Timestamps. (a6bdd0a)

v32.1: Protocol Buffers v32.1

Compare Source

Announcements

  • Protobuf News may include additional announcements or pre-announcements for upcoming changes.

Compiler

  • Ship all option dependencies to plugins along with regular ones. (34d6c85)
  • Unify plugin and built-in generators to use request/response interface (b98f6ee)
  • Disable symbol visibility enforcement by default in C++ runtime (aad0daa)

C++

  • Disable symbol visibility enforcement by default in C++ runtime (aad0daa)

Java

  • Fix handling of optional dependencies in java generator. (892e0d5)
  • Restore Protobuf Java extension modifiers in gencode that were previously removed in 7bff169 (4a18be6)
  • Restore ABI compatibility for extension methods which was previously (knowingly) broken with 4.x: 94a2a44 (501f4a5)
  • Cherrypick test improvements (d365736)
  • Fix handling of optional dependencies in java generator. (9325480)
  • Ship all option dependencies to plugins along with regular ones. (34d6c85)
  • Unify plugin and built-in generators to use request/response interface (b98f6ee)

Csharp

PHP

  • Fix: remove provide from composer.json (bc5f303)

v32.0: Protocol Buffers v32.0

Compare Source

Announcements

  • Protobuf News may include additional announcements or pre-announcements for upcoming changes.

Bazel

  • Migrates some Java test protos using java_features.proto to edition 2024 (6f4a990)
  • Add generated message reflection unittest for import option and option_deps test proto in edition 2024. (c51df73)
  • Replace the usage of cc_info.debug_context with _debug_context (776c5f2)
  • Generate .pyi files in py_proto_library (#​10366) (#​21567) (e3e56c7)
  • Introduce denylisted_protos as a preferred replacement for blacklisted_protos attribute. (795ab9d)
  • Use native.proto_library for Bazel 7 and explicitly error for Bazel 6 which is incompatible and out of support. (da0077e)
  • Require ProtoInfo provider instead of proto_library rule for bazel cc_proto_library deps. (639f1c9)

Compiler

  • Strip extensions from option imports that are known in CollectExtensions due to polluted pool from protoc parse when used with protoc full + java built in generator. (ef3f9ca)
  • Deprecate google.protobuf.Method.syntax and google.protobuf.Method.edition (9ec241e)
  • Enable edition 2024 support in protoc and language generators for cpp, hpb, java, kotlin, objectivec, php, python, pyi, rust. (26843b3)
  • Ban import weak and weak field option in edition 2024 in protoc (parser and c++ runtime). (a2a0511)

C++

  • Strip extensions from option imports that are known in CollectExtensions due to polluted pool from protoc parse when used with protoc full + java built in generator. (ef3f9ca)
  • Manually migrate top-level protobuf unittest protos from edition 2023 to edition 2024. (7359f75)
  • Add generated message reflection unittest for import option and option_deps test proto in edition 2024. (c51df73)
  • Remove the flag requirement for Bazel+MSVC users. (c6ba697)
  • Enable edition 2024 support in protoc and language generators for cpp, hpb, java, kotlin, objectivec, php, python, pyi, rust. (26843b3)
  • Cast GetCachedTID() to unsigned to prevent left-shifting a negative number. (3e935cf)
  • Update comment at the top of message.h and message_lite.h to document that it should only be extended by gencode and not user code. (6a6ba52)
  • Treat warnings encountered in chromium builds as errors. (21c3c53)
  • Ban import weak and weak field option in edition 2024 in protoc (parser and c++ runtime). (a2a0511)

Java

  • Strip extensions from option imports that are known in CollectExtensions due to polluted pool from protoc parse when used with protoc full + java built in generator. (ef3f9ca)
  • Remove CollectExtensions check banning unknown custom options since unknown custom options are now expected when using import option and option_deps which exclude the options from the "builder" pool (aka "import" pool). (694eedd)
  • Manually migrate top-level protobuf unittest protos from edition 2023 to edition 2024. (7359f75)
  • Migrates some Java test protos using java_features.proto to edition 2024 (6f4a990)
  • Restore compatibility of runtime with pre-3.22.x gencode impacted by CVE-2022-3171 (adf556f)
  • Update our compiled_edition_default's maximum_edition to 2024 (#​22870) (6216ae4)
  • Restore the long-deprecated static functions on TextFormat. (5777d3b)
  • Add Kotlin class name helpers to names.h (527b2ab)
  • Enable edition 2024 support in protoc and language generators for cpp, hpb, java, kotlin, objectivec, php, python, pyi, rust. (26843b3)
  • Update Java gencode base class documentation to clarify that it is not supported to extend them. (c3177fb)
  • Add a FieldMaskUtil#trim overload that accepts TrimOptions and allows retaining unset primitive field state. (84c5b63)

Csharp

  • Update staleness (0014173)
  • Manually migrate top-level protobuf unittest protos from edition 2023 to edition 2024. (7359f75)
  • Update our compiled_edition_default's maximum_edition to 2024 (#​22870) (6216ae4)
  • Enable edition 2024 support in protoc and language generators for cpp, hpb, java, kotlin, objectivec, php, python, pyi, rust. (26843b3)
  • Include also ARM build of protoc in nuget package (#​21568) (c2b4040)
  • Improve C# handling of Any JSON serialization/deserialization (dc4e429)

Objective-C

  • Enable edition 2024 support in protoc and language generators for cpp, hpb, java, kotlin, objectivec, php, python, pyi, rust. (26843b3)

Rust

  • Rust: remove DEP_UPB_VERSION check in codegen crate (#​22764) (6f6012a)
  • Enable edition 2024 support in protoc and language generators for cpp, hpb, java, kotlin, objectivec, php, python, pyi, rust. (26843b3)
  • Update Rust generator to output minidescriptors instead of C minitables (1b4b5fc)
  • Add [clear_and_]parse_dont_enforce_required() to Rust protobuf. (e2fd7a0)
  • Add #[non_exhaustive] on the oneof-case enum (aba2075)
  • Impl Clone for RepeatedIter (aca1ed5)
  • See also UPB changes below, which may affect Rust.

Python

  • Strip extensions from option imports that are known in CollectExtensions due to polluted pool from protoc parse when used with protoc full + java built in generator. (ef3f9ca)
  • Manually migrate top-level protobuf unittest protos from edition 2023 to edition 2024. (7359f75)
  • Raise warnings for float_precision from python json_format. (#​23042) (1a7e012)
  • Raise warnings when assign bool to int/enum (#​23030) (0b25f7b)
  • Update python edition default maximum edition to 2024 (#​22889) (72abf95)
  • Make protobuf codebase compatible with --incompatible_config_setting_private_default_visibility (#​22745) (5e2838e)
  • Add Python deprecation warnings for Descriptor Label. (64a76e6)
  • Updating setuptools to patch CVE-2025-47273 (#​22094) (508aba1)
  • Enable edition 2024 support in protoc and language generators for cpp, hpb, java, kotlin, objectivec, php, python, pyi, rust. (26843b3)
  • Extend gencode compatibility support back to 3.20.0 (1af7fd4)
  • Change proto_api work with custom pool for upb and pure python. (49d9e2d)
  • Python pyi print "import datetime" for Duration/Timestamp field (f59b84a)
  • Add reference leak check to Python well_known_types_test. Fix two refleak bugs. (e5f9ab4)
  • Add reference leak check to Python timestamp_test and duration_test. Fix a refleak bug when assign datetime/duration to Timestamp/Duration (e004c8b)
  • Add recursion depth limits to pure python (17838be)
  • Remove calls to Label within Protobuf Python. (f69180a)
  • Change Python .pyi stubs to generated _Optional[] for bool fields same with (6972464)
  • Remove internal/api_implementation.Version() (cbad456)
  • Fix python proto_api to work with messages that required fields are not set. (f63ed55)
  • Fix python upb crashes on map/repeated reference stub destructor (4274909)
  • Mark Py JSON float_precision deprecated. (727a8ed)

PHP

  • Enable edition 2024 support in protoc and language generators for cpp, hpb, java, kotlin, objectivec, php, python, pyi, rust. (26843b3)
  • Fix(php): use count instead of ->count() to avoid bug in c-extension (9fbce62)
  • [php][compiler][ext] - Add missing has* methods and other well known types (#​20636) (01a7429)
  • Fix PHP 8.4 deprecation in GPBDecodeException (#​21232) (676666e)
PHP C-Extension
  • Update our compiled_edition_default's maximum_edition to 2024 (#​22870) (6216ae4)
  • Change 'getLabel is deprecated' to E_USER_DEPRECATED (158d8ac)
  • [php][compiler][ext] - Add missing has* methods and other well known types (#​20636) (01a7429)
  • See also UPB changes below, which may affect PHP C-Extension.

Ruby

  • Make protobuf codebase compatible with --incompatible_config_setting_private_default_visibility (#​22745) (5e2838e)
  • Enable edition 2024 support in protoc and language generators for cpp, hpb, java, kotlin, objectivec, php, python, pyi, rust. (26843b3)
  • Fix silent failure of rb_test rules to run test (#​21733) (4f74764)
Ruby C-Extension
  • Update our compiled_edition_default's maximum_edition to 2024 (#​22870) (6216ae4)
  • Removed wrap_memcpy.c compatibility shim for pre-2.14 glibc (4ba9733)
  • See also UPB changes below, which may affect Ruby C-Extension.

UPB (Python/PHP/Ruby C-Extension)

  • Update our compiled_edition_default's maximum_edition to 2024 (#​22870) (6216ae4)
  • Make protobuf codebase compatible with --incompatible_config_setting_private_default_visibility (#​22745) (5e2838e)
  • Add upb_Message_SetExtensionMessage as a helper for setting a extension field that is a message. This is the extension equivalent of upb_Message_SetBaseFieldMessage. (f15d28a)

Other


Configuration

📅 Schedule: Branch creation - "before 8am every weekday" in timezone America/Los_Angeles, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot requested a review from a team as a code owner April 9, 2024 13:12
@renovate renovate bot force-pushed the renovate/major-bazel-modules branch from 9e8ce8c to d2638ff Compare April 17, 2024 17:42
@renovate renovate bot force-pushed the renovate/major-bazel-modules branch 2 times, most recently from 1a1cb0a to b856327 Compare May 23, 2024 17:09
@renovate renovate bot force-pushed the renovate/major-bazel-modules branch from b856327 to 3c1a1c2 Compare June 5, 2024 19:46
@renovate renovate bot force-pushed the renovate/major-bazel-modules branch from 3c1a1c2 to 72860d2 Compare June 25, 2024 21:14
@renovate renovate bot force-pushed the renovate/major-bazel-modules branch from 72860d2 to 4cf524d Compare July 31, 2024 15:49
@renovate renovate bot force-pushed the renovate/major-bazel-modules branch 3 times, most recently from b704531 to 3c2cb8f Compare August 28, 2024 18:39
@renovate renovate bot force-pushed the renovate/major-bazel-modules branch from 3c2cb8f to 6c2a8da Compare September 11, 2024 15:55
@renovate renovate bot force-pushed the renovate/major-bazel-modules branch from 6c2a8da to 2942963 Compare September 18, 2024 22:50
@renovate renovate bot force-pushed the renovate/major-bazel-modules branch from 2942963 to 75d0b39 Compare October 23, 2024 00:35
@renovate renovate bot force-pushed the renovate/major-bazel-modules branch 2 times, most recently from 5b18e32 to 7d36814 Compare December 4, 2024 00:59
@renovate renovate bot force-pushed the renovate/major-bazel-modules branch from 7d36814 to f40a5c1 Compare December 18, 2024 15:43
@renovate renovate bot force-pushed the renovate/major-bazel-modules branch 3 times, most recently from abbe513 to 0e94cc5 Compare January 15, 2025 18:41
@renovate renovate bot force-pushed the renovate/major-bazel-modules branch 2 times, most recently from 40f5dd5 to 6072b6f Compare February 5, 2025 14:56
@renovate renovate bot force-pushed the renovate/major-bazel-modules branch from 6072b6f to 57f7b3b Compare March 5, 2025 01:22
@renovate renovate bot force-pushed the renovate/major-bazel-modules branch from 57f7b3b to 61df424 Compare March 14, 2025 00:38
@renovate renovate bot force-pushed the renovate/major-bazel-modules branch from 61df424 to edef35d Compare March 26, 2025 18:30
@renovate renovate bot force-pushed the renovate/major-bazel-modules branch from edef35d to f646017 Compare April 30, 2025 14:54
@renovate renovate bot force-pushed the renovate/major-bazel-modules branch from f646017 to 6cfeb88 Compare May 14, 2025 18:25
@renovate renovate bot force-pushed the renovate/major-bazel-modules branch from 6cfeb88 to de02974 Compare May 28, 2025 23:30
@renovate renovate bot force-pushed the renovate/major-bazel-modules branch from de02974 to 7b23f90 Compare June 10, 2025 15:29
@renovate renovate bot force-pushed the renovate/major-bazel-modules branch from 7b23f90 to 3d27ccf Compare August 3, 2025 14:38
@renovate renovate bot force-pushed the renovate/major-bazel-modules branch from 3d27ccf to 8195707 Compare August 14, 2025 22:46
@renovate renovate bot force-pushed the renovate/major-bazel-modules branch from 8195707 to 60296c9 Compare September 13, 2025 18:04
@renovate renovate bot force-pushed the renovate/major-bazel-modules branch from 60296c9 to 5ea8578 Compare October 15, 2025 22:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants