This PR contains the following updates:

Release Notes

v36.0: Protocol Buffers v36.0

Announcements

• Protobuf News may include additional announcements or pre-announcements for upcoming changes.
• Migration Guide may include additional guidance for breaking changes.

Bazel

• Add Bazel9 test (90ad7e9)
• Bazel 9 tests for csharp, hpb, objc, php, python, rust and upb (f9e028f)

Compiler

• Make default_symbol_visibility STRICT in edition 2026 (fcd68c5)
• Add deprecation warnings for (py|cc|java)_generic_service. (517be42)
• Disallow reserving field number INT_MAX. (933c522)
• Add bazel targets for standalone plugin binaries (#​23919) (81880fa)
• Feat: --<lang>_prefix cli option (#​24824) (92dd27c)
• Enforce proto limits in the descriptor by default for EDITION_2026. (d8520d9)
• Fix: Apply path traversal guard to WriteAllToZip() matching WriteAllToDisk() (#​27171) (28bef98)
• Add an enforce_proto_limits feature which will be implemented in Edition 2026. (5ddd524)

C++

• Disable option sub-location mapping in open-source builds. (1d8a656)
• Add json_options.proto and json_enumvalue_options.proto and/or gencode derived from them to release artifacts (15e9334)
• Add deprecation warning for Reflection::GetEnum() and Reflection::GetRepeatedEnum(). (0bca288)
• Migrate top-level protobuf unittest protos from Edition 2024 to Edition 2026. (271ca53)
• Util: validate Duration/Timestamp in TimeUtil::FromString against spec limits (#​27443) (e337495)
• Make default_symbol_visibility STRICT in edition 2026 (fcd68c5)
• Use the direct map reflection API when converting message to JSON, if the repeated field reflection is not valid. (e75aac3)
• Add bazel targets for standalone plugin binaries (#​23919) (81880fa)
• Fix(cpp): stop TextFormat iteration if output stream fails (#​26237) (2718dd5)
• Enforce proto limits in the descriptor by default for EDITION_2026. (d8520d9)
• Add an enforce_proto_limits feature which will be implemented in Edition 2026. (5ddd524)
• Workaround for attribute handling bug in gcc < 13 (ba10a4e)
• Fix confusing error message for map value type name conflicts (7864b85)
• C++Proto JSON: Align behavior on the type.proto path with the descriptor.proto path (0bc1f14)

Java

With this release JavaProto no longer uses sun.misc.Unsafe as long as you are utilizing the standard generated code. You should no longer see warnings printed about sun.misc.Unsafe. If you see any issues, please let us know on #​20760

Note that the runtime itself still contains references to sun.misc.Unsafe in paths which are exclusively to support Lite generated code. Lite is emitted by a separate code generator which creates generated code optimized for mobile clientside contexts, especially alongside R8 optimizations. Android does not have a timeline to removing sun.misc.Unsafe, and we have found the performance regression too significant to consider removing these paths at this time. It is still TBD for how we can best navigate this mobile vs JVM split on this topic.

• Add json_options.proto and json_enumvalue_options.proto and/or gencode derived from them to release artifacts (15e9334)
• Json/java: add json_name enumval support (bff6ed1)
• Make Timestamps.parse() attempt non-lenient parsing first and warning if this fails. (d5e039a)
• Add a warning for potential OneofDescriptor collisions prior to Q1 2027 breaking changes. (ab69831)
• Make default_symbol_visibility STRICT in edition 2026 (fcd68c5)
• Reject negative size in mergeDelimitedFrom (#​28097) (c56cd5b)
• Add deprecation warnings for (py|cc|java)_generic_service. (517be42)
• Update Java protobuf generator to use Objects.requireNonNull (31ef11c)
• Use natural String comparison instead of UTF-8 ByteString comparison for sorting map keys in JsonFormat. (ae1faee)
• Add option to enable strict JSON parsing in Protobuf Java JsonFormat. (40825a1)
• Add bazel targets for standalone plugin binaries (#​23919) (81880fa)
• Remove experimental FieldOrder enum. (ec52338)
• Optimize GeneratedMessage.ExtendableBuilder to avoid temporary allocations when merging empty extendable messages. (a37dbd6)
• Stop using sun.misc.Unsafe in isValidUtf8 paths. (421d745)
• Use String#encodedLength on JDK versions that support it (efca121)
• Add an enforce_proto_limits feature which will be implemented in Edition 2026. (5ddd524)
• Java: limit numeric string length before BigDecimal parsing (#​26908) (25e7005)
• Validate java package and class against injection risks. (f8514d8)

Csharp

• Cache custom JSON enum names in JsonParser using Lazy. (156d42d)
• Csharp: add support for custom json strings for enum values (f11aac4)
• Validate language-specific namespace options in code generators (#​28667) (34e959b)
• Make default_symbol_visibility STRICT in edition 2026 (fcd68c5)
• Advertise that C# supports Edition 2026, and move C# Nullable Reference Type support into that edition. (a1f718c)
• First implementation of C# nullable reference types enablement using the current (unreleased) edition. (7a732d1)
• Add bazel targets for standalone plugin binaries (#​23919) (81880fa)
• Csharp: propagate recursion depth into JsonReplayTokenizer to honor Any nesting limit (#​26835) (cee45bf)
• Fix csharp string interpolation in Timestamp.ToDateTime() exception message (#​26341) (a298282)

Objective-C

• [ObjC] Carry recursion depth across MessageSet item parsing (#​27571) (f89baed)
• Add bazel targets for standalone plugin binaries (#​23919) (81880fa)
• [ObjC] Add DEBUG-only validations to extension values in GPBMessage, along with tests. (290a537)

Rust

• Re-export to google-protobuf crate in 0.x.y for 36.0 and above (96e772f)
• Remove -release suffix from Rust Crates.io release if minor version >= 36 (e7b3391)
• Add bazel targets for standalone plugin binaries (#​23919) (81880fa)
• RustProto: Add the ability to iterate over the muts of a repeated message-typed field. (70590a5)
• See also UPB changes below, which may affect Rust.

Python

• Add json_options.proto and json_enumvalue_options.proto and/or gencode derived from them to release artifacts (15e9334)
• Emit future warning when mutating GetOptions() in OSS (2255541)
• Emit deprecation warning when comparing descriptor containers with unrecognized types in OSS (5865e6b)
• Migrate top-level protobuf unittest protos from Edition 2024 to Edition 2026. (271ca53)
• Configure extra compile args in setup.py (#​28264) (3aa022a)
• Python: fix heap-use-after-free in MapIterator after map.clear() (#​27257) (9e9dbae)
• Add PyDescriptorPool_FromSharedPool(std::shared_ptr) API (abdf212)
• Fix memory leak in PyUpb_Descriptor_GetExtensionRanges (3d31b0f)
• Warn on out-of-range pop index in upb repeated fields. (a70d121)
• Support assigning repeated scalar fields using Python Buffer API. (ea40f1d)
• Fix Pure Python map<string, ...> key handling for bytes lookups. (156a0b8)
• Change Python DescriptorDatabase FindFileContainingSymbol() to accept leading "." to match DescriptorPool and other languages (e86e536)
• Faster Python cpp protos assignment to bytes/string fields. (593ab17)
• Serialize length-prefixed protos once (#​27252) (e090f8a)
• [py/upb] Make GetOptions() return immutable options for scalar type. UPB will raise a TypeError when options returned GetOptions() by is mutated. (403d429)
• Add bazel targets for standalone plugin binaries (#​23919) (81880fa)
• Add mutex protection to DescriptorPool caches. (cecbbf4)
• Refactor container comparison function in py/C++ and py/upb to return enum instead of integer. (c857f49)
• Py JSON: Fix issue with depth enforcement on Struct/Value WKT paths. (cfcc433)
• Fix RepeatedContainer_pop to raise IndexError for out-of-bounds indices. (78a09ad)

PHP

• Support custom JSON enum names in PHP (49b3b18)
• Remove total_bytes_limit from pure PHP CodedInputStream. (e171c67)
• Validate language-specific namespace options in code generators (#​28667) (34e959b)
• Fix PHP update_reserved_words.sh formatting and CI idempotency test (eff2323)
• Feat(php): script for updating php reserved words (#​27456) (47c8651)
• [PHP] - Add configurable recursion_limit to mergeFromString / serializeToString (#​27874) (5c5ee3c)
• Add bazel targets for standalone plugin binaries (#​23919) (81880fa)
• Clarify FieldMask JSON warnings/errors in the situation of fields which aren't round-trip representable in JSON format. (0488596)
• Add an enforce_proto_limits feature which will be implemented in Edition 2026. (5ddd524)

PHP C-Extension

• Support custom JSON enum names in PHP (49b3b18)
• Feat(php): script for updating php reserved words (#​27456) (47c8651)
• [PHP] - Add configurable recursion_limit to mergeFromString / serializeToString (#​27874) (5c5ee3c)
• See also UPB changes below, which may affect PHP C-Extension.

Ruby

• Validate language-specific namespace options in code generators (#​28667) (34e959b)
• Drop support for Ruby 3.1 (7008dd1)
• Add bazel targets for standalone plugin binaries (#​23919) (81880fa)

UPB (Python/PHP/Ruby C-Extension)

• Json/upb: Implement json EnumValueName for upb (0e8519e)
• Avoid UB in upb by switching to the XCT section, which will run our constructors before the compiler-generated initializers. (58e5ac8)
• [py/upb] Make GetOptions() return immutable options for scalar type. UPB will raise a TypeError when options returned GetOptions() by is mutated. (403d429)
• Clarify FieldMask JSON warnings/errors in the situation of fields which aren't round-trip representable in JSON format. (0488596)
• Add Bazel9 test (90ad7e9)
• Fixed two GCC-only issues around upb's generated extension registry. (d56b385)
• Fix RepeatedContainer_pop to raise IndexError for out-of-bounds indices. (78a09ad)

Other

• Fix typo in legacy_rust (daf4964)
• Add JSON and CPP option protos to C++ toolchain blacklisted_protos (c4846de)
• Remove fallback behavior (2d3c0d3)
• Add deprecation warning for internal_py_proto_library prior to Q1 2027 breaking changes. (a8d0be3)

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

• If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.