protocolbuffers/protobuf
Protocol Buffers - Google's data interchange format
How protobuf is put together
This is the Protocol Buffers (protobuf) monorepo: Google's language-neutral data serialization system. It contains the protoc compiler and C++ runtime (src/, built via CMakeLists.txt and Bazel), plus runtime libraries for many languages including Python (pure-python, cpp, and upb backends selected at import time), Java/Kotlin (Maven multi-module), Ruby (native gem plus JRuby), Rust (cpp and upb kernels), and C#. The repo is heavily polyglot with a shared conformance testing framework that runs each language implementation against a common binary/JSON/text-format suite via pipe-based runners. Builds are orchestrated primarily with Bazel (MODULE.bazel, WORKSPACE, .bazelci) with CMake as an alternative for the C++ core; artifacts are published to Maven Central (Sonatype), PyPI, RubyGems, NuGet, and BCR.
Languages
Frameworks
Infrastructure
Major components
protoc compiler & C++ runtime (src/)
The core protocol buffer compiler and the canonical C++ implementation of descriptors, wire format parsing/serialization, and text format.
upb (cmake/libupb.cmake, upb generators)
A small, C-based protobuf runtime used as a backend for Python, Ruby, PHP, and other interpreted-language bindings.
Python runtime (python/google/protobuf)
Pure-Python, C++ (pyext), and upb implementations of the protobuf API with runtime backend selection via PROTOCOL_BUFFERS_PYTHON_IMPLEMENTATION.
Java/Kotlin runtimes (java/core, lite, kotlin, util, bom)
Maven-built Java protobuf runtime modules (full, lite, Kotlin extensions, util) published under com.google.protobuf with a shared BOM.
Ruby runtime (ruby/)
Native CRuby extension plus JRuby (Java-based) implementation of the protobuf runtime, packaged as a gem.
Rust runtime (rust/)
Rust protobuf kernel supporting both a pure-Rust upb backend and a C++-shared-memory backend, including release crates like protobuf_example.
Conformance framework (conformance/)
Cross-language test harness that drives every language implementation against a shared suite of binary, JSON, and text-format conformance cases with per-language failure lists.
Build tooling & Bazel rules (bazel/, build_defs/, cmake/, ci/)
Starlark rules (proto_library, cc/java/py/upb proto libraries), CMake packaging/install definitions, and per-platform CI configuration.
A quieter week focused on cleaning up after the GLOBALS experiment and polishing the pure-Python and Java Lite code paths.
5 weeksWeek of 2026-08-24
Week of 2026-08-24latest
A quieter week focused on cleaning up after the GLOBALS experiment and polishing the pure-Python and Java Lite code paths.
Week of 2026-08-17
A very busy week (69 commits) centered on enabling FastTable for more build types, fixing memory-safety issues on allocation failures, and improving support for non-canonical extensions.
Week of 2026-08-10
Security and robustness took center stage with a published threat model document, plus compiler-generated code got smaller and faster via always-inlined stubs.
Week of 2026-08-03
ExtensionSet internals were reworked for safety and efficiency, Java code generators were refactored into cleaner per-field functions, and a Ruby use-after-free bug was fixed.
Week of 2026-07-27
JSON handling was refined with relaxed duplicate-key rules and new enum-value naming support, while upb gained several new public APIs for extensions and unknown fields.
Over the past month, the protobuf team has been heavily focused on hardening the library against memory-allocation failures and malformed input, with dozens of new fault-injection tests and fixes across the C, C++, Python, and Ruby runtimes. A second major thread is performance and cleanup work around the 'FastTable' parsing optimization and the aftermath of the 'GLOBALS' experiment, alongside steady refactoring of the Java code generators. There were also user-facing improvements like a published security threat model document, new public APIs for extension handling, and several bug fixes in JSON, TextFormat, and conformance behavior.
Week by week
2026-08-24A quieter week focused on cleaning up after the GLOBALS experiment and polishing the pure-Python and Java Lite code paths.latest6 changes
Refactor
Faster Python JSON parsing for custom enum names
The pure-Python parser now handles custom JSON names for enums more efficiently.
Refactor
Fewer empty byte array allocations in Proto Lite
Java Lite's toByteArray() no longer allocates unnecessary empty byte arrays, saving memory and time.
Refactor
Safer type handling in ProtobufList
Internal list concatenation was made more type-safe to prevent subtle casting bugs.
Docs
Clearer documentation for CodedInputStream
Java documentation now better explains how the input stream behaves when it hits errors or the end of data.
Chore
Continued GLOBALS experiment cleanup
More follow-up tidying of internal code after last month's global-state restructuring.
Fix
Fixed an overly strict internal assertion
A FastTable debug check was too aggressive and could falsely flag valid parsing as an error.
2026-08-17A very busy week (69 commits) centered on enabling FastTable for more build types, fixing memory-safety issues on allocation failures, and improving support for non-canonical extensions.6 changes
Refactor
FastTable enabled for non-optimized builds
The fast table-driven parsing path is no longer limited to optimized builds, bringing speedups to debug builds too.
Fix
Better handling when memory runs out
Multiple changes across Python, upb, and unknown-field handling now gracefully handle allocation failures instead of corrupting state, backed by new tests.
Feature
Support for non-canonical extensions
New APIs let messages carry and convert extension fields that don't match the canonical form, including printing them in text format.
Fix
Fixed a data race in free-threaded Python
An obsolete workaround was removed that could cause race conditions when running Python without the global interpreter lock.
Fix
Guarded against malformed tags in FastTable
Gaps in the fast-table's checking of corrupted wire data were closed so bad input can't slip through.
Feature
Opt-in lazy parsing control for extensions
Applications can now disable lazy parsing on individual extension registries, giving finer control over when extension bytes are decoded.
2026-08-10Security and robustness took center stage with a published threat model document, plus compiler-generated code got smaller and faster via always-inlined stubs.6 changes
Docs
Published SECURITY.md threat model
The project now publicly documents its security assumptions and threat model so users understand what guarantees protobuf provides.
Refactor
Smaller, faster generated message stubs
Generated serialization and clear methods are now marked always-inline and hidden from debug info, shrinking binaries and speeding calls.
Fix
Fixed plugin-not-found hint in protoc
When protoc can't find a code-generator plugin, its error hint now correctly matches plugins by exact name.
Fix
CMake no longer overrides MSVC runtime setting
Projects building protobuf via CMake can now set their own Windows runtime library option without it being clobbered.
Feature
Group recursion limit flag enabled
A limit on deeply nested group messages can now be turned on, protecting against stack exhaustion from hostile input.
Fix
Bounds check before linking mini-tables
upb now verifies array bounds before indexing during mini-table linking, preventing out-of-bounds access.
2026-08-03ExtensionSet internals were reworked for safety and efficiency, Java code generators were refactored into cleaner per-field functions, and a Ruby use-after-free bug was fixed.6 changes
Fix
Fixed Ruby use-after-free with map keys
Ruby map keys that aliased a temporary string could be used after being freed; this crash-prone bug is fixed.
Refactor
Cleaner Java code generation structure
The Java generator's method-printing logic for maps, strings, primitives, enums, and messages was split into dedicated private functions, making the generator easier to maintain.
Fix
Fixed capacity truncation bug in ExtensionSet
A uint16 overflow could silently truncate the extension set's capacity when growing; growth logic was also slowed from 4x to 2x to use memory more conservatively.
Chore
Allocation fault injection tests for upb
New tests deliberately fail memory allocations during encoding and decoding to verify the runtime handles out-of-memory conditions safely.
Feature
Public API to serialize unknown extension data
A new upb_MessageUnknown_Encode function lets callers turn raw extension structures back into serialized bytes.
Chore
Reserved extension numbers for Flyte
Extension numbers 1364-1373 were reserved in the global registry for the Flyte project.
2026-07-27JSON handling was refined with relaxed duplicate-key rules and new enum-value naming support, while upb gained several new public APIs for extensions and unknown fields.6 changes
Feature
Relaxed duplicate key handling in ProtoJSON
Conformance tests were updated to reflect new rules for how duplicate keys in JSON objects are treated.
Feature
Enum value name support in upb JSON
The upb JSON implementation can now look up and emit custom enum value names, matching other language runtimes.
Feature
New public APIs for extensions and unknown fields
upb exposed the upb_Extension struct, a SetNonCanonicalExtension function, and an unknown-fields encoder as supported public APIs.
Fix
Fixed reachable crash in JSON unparser
Serializing an empty Value inside an Any message could hit an internal CHECK failure; that path is now handled safely.
Fix
Python rejects mismatched CopyToProto targets
Copying a descriptor into the wrong kind of proto target now produces a clear error instead of undefined behavior.
Fix
Fixed missed out-of-memory handling
Several spots that allocate memory when unsetting required fields or copying messages now properly detect and report allocation failures.
Dependencies and code review
Dependency advisories
Security Watch
No known advisories across 0 scanned dependencies.
No known advisories in the scanned dependencies.
Code review
No concrete code-level issues confirmed.
Get this report every week for your repos.
GitZoid learns each repo, reports what changed, and flags what needs attention. One flat price for the whole team.
$19 a month, flat · First 10 outputs free · No card required