← All reportsPublic report

protocolbuffers/protobuf

Protocol Buffers - Google's data interchange format

72k stars C++ View on GitHubprofiled 11d ago
Try GitZoid
326PRs this week
37Contributors
0Deps scanned
0Issues found
01 · Repo overview

How protobuf is put together

This is the Protocol Buffers (protobuf) monorepo: Google's language-neutral data serialization system. It contains the protoc compiler and C++ runtime (src/, built via CMakeLists.txt and Bazel), plus runtime libraries for many languages including Python (pure-python, cpp, and upb backends selected at import time), Java/Kotlin (Maven multi-module), Ruby (native gem plus JRuby), Rust (cpp and upb kernels), and C#. The repo is heavily polyglot with a shared conformance testing framework that runs each language implementation against a common binary/JSON/text-format suite via pipe-based runners. Builds are orchestrated primarily with Bazel (MODULE.bazel, WORKSPACE, .bazelci) with CMake as an alternative for the C++ core; artifacts are published to Maven Central (Sonatype), PyPI, RubyGems, NuGet, and BCR.

Languages

C++PythonJavaKotlinRubyRustC#StarlarkObjective-CPHPC

Frameworks

Abseil (C++)JUnit 4MockitoGoogle TruthGuavabndlib (OSGi)picoclitest-unit (Ruby)rake-compiler

Infrastructure

Bazel CI (Buildkite)Bazel Central Registry (.bcr)CMake buildSonatype Nexus (Maven publishing)ReadTheDocs (.readthedocs.yml)AppVeyor (appveyor.yml)rake-compiler-dock (cross-compiled native gems)

Major components

protoc compiler & C++ runtime (src/)

The core protocol buffer compiler and the canonical C++ implementation of descriptors, wire format parsing/serialization, and text format.

upb (cmake/libupb.cmake, upb generators)

A small, C-based protobuf runtime used as a backend for Python, Ruby, PHP, and other interpreted-language bindings.

Python runtime (python/google/protobuf)

Pure-Python, C++ (pyext), and upb implementations of the protobuf API with runtime backend selection via PROTOCOL_BUFFERS_PYTHON_IMPLEMENTATION.

Java/Kotlin runtimes (java/core, lite, kotlin, util, bom)

Maven-built Java protobuf runtime modules (full, lite, Kotlin extensions, util) published under com.google.protobuf with a shared BOM.

Ruby runtime (ruby/)

Native CRuby extension plus JRuby (Java-based) implementation of the protobuf runtime, packaged as a gem.

Rust runtime (rust/)

Rust protobuf kernel supporting both a pure-Rust upb backend and a C++-shared-memory backend, including release crates like protobuf_example.

Conformance framework (conformance/)

Cross-language test harness that drives every language implementation against a shared suite of binary, JSON, and text-format conformance cases with per-language failure lists.

Build tooling & Bazel rules (bazel/, build_defs/, cmake/, ci/)

Starlark rules (proto_library, cc/java/py/upb proto libraries), CMake packaging/install definitions, and per-platform CI configuration.

Over the past month, the protobuf team has been heavily focused on hardening the library against memory-allocation failures and malformed input, with dozens of new fault-injection tests and fixes across the C, C++, Python, and Ruby runtimes. A second major thread is performance and cleanup work around the 'FastTable' parsing optimization and the aftermath of the 'GLOBALS' experiment, alongside steady refactoring of the Java code generators. There were also user-facing improvements like a published security threat model document, new public APIs for extension handling, and several bug fixes in JSON, TextFormat, and conformance behavior.

Week by week

2026-08-24A quieter week focused on cleaning up after the GLOBALS experiment and polishing the pure-Python and Java Lite code paths.latest6 changes

Refactor

Faster Python JSON parsing for custom enum names

The pure-Python parser now handles custom JSON names for enums more efficiently.

Refactor

Fewer empty byte array allocations in Proto Lite

Java Lite's toByteArray() no longer allocates unnecessary empty byte arrays, saving memory and time.

Refactor

Safer type handling in ProtobufList

Internal list concatenation was made more type-safe to prevent subtle casting bugs.

Docs

Clearer documentation for CodedInputStream

Java documentation now better explains how the input stream behaves when it hits errors or the end of data.

Chore

Continued GLOBALS experiment cleanup

More follow-up tidying of internal code after last month's global-state restructuring.

Fix

Fixed an overly strict internal assertion

A FastTable debug check was too aggressive and could falsely flag valid parsing as an error.

2026-08-17A very busy week (69 commits) centered on enabling FastTable for more build types, fixing memory-safety issues on allocation failures, and improving support for non-canonical extensions.6 changes

Refactor

FastTable enabled for non-optimized builds

The fast table-driven parsing path is no longer limited to optimized builds, bringing speedups to debug builds too.

Fix

Better handling when memory runs out

Multiple changes across Python, upb, and unknown-field handling now gracefully handle allocation failures instead of corrupting state, backed by new tests.

Feature

Support for non-canonical extensions

New APIs let messages carry and convert extension fields that don't match the canonical form, including printing them in text format.

Fix

Fixed a data race in free-threaded Python

An obsolete workaround was removed that could cause race conditions when running Python without the global interpreter lock.

Fix

Guarded against malformed tags in FastTable

Gaps in the fast-table's checking of corrupted wire data were closed so bad input can't slip through.

Feature

Opt-in lazy parsing control for extensions

Applications can now disable lazy parsing on individual extension registries, giving finer control over when extension bytes are decoded.

2026-08-10Security and robustness took center stage with a published threat model document, plus compiler-generated code got smaller and faster via always-inlined stubs.6 changes

Docs

Published SECURITY.md threat model

The project now publicly documents its security assumptions and threat model so users understand what guarantees protobuf provides.

Refactor

Smaller, faster generated message stubs

Generated serialization and clear methods are now marked always-inline and hidden from debug info, shrinking binaries and speeding calls.

Fix

Fixed plugin-not-found hint in protoc

When protoc can't find a code-generator plugin, its error hint now correctly matches plugins by exact name.

Fix

CMake no longer overrides MSVC runtime setting

Projects building protobuf via CMake can now set their own Windows runtime library option without it being clobbered.

Feature

Group recursion limit flag enabled

A limit on deeply nested group messages can now be turned on, protecting against stack exhaustion from hostile input.

Fix

Bounds check before linking mini-tables

upb now verifies array bounds before indexing during mini-table linking, preventing out-of-bounds access.

2026-08-03ExtensionSet internals were reworked for safety and efficiency, Java code generators were refactored into cleaner per-field functions, and a Ruby use-after-free bug was fixed.6 changes

Fix

Fixed Ruby use-after-free with map keys

Ruby map keys that aliased a temporary string could be used after being freed; this crash-prone bug is fixed.

Refactor

Cleaner Java code generation structure

The Java generator's method-printing logic for maps, strings, primitives, enums, and messages was split into dedicated private functions, making the generator easier to maintain.

Fix

Fixed capacity truncation bug in ExtensionSet

A uint16 overflow could silently truncate the extension set's capacity when growing; growth logic was also slowed from 4x to 2x to use memory more conservatively.

Chore

Allocation fault injection tests for upb

New tests deliberately fail memory allocations during encoding and decoding to verify the runtime handles out-of-memory conditions safely.

Feature

Public API to serialize unknown extension data

A new upb_MessageUnknown_Encode function lets callers turn raw extension structures back into serialized bytes.

Chore

Reserved extension numbers for Flyte

Extension numbers 1364-1373 were reserved in the global registry for the Flyte project.

2026-07-27JSON handling was refined with relaxed duplicate-key rules and new enum-value naming support, while upb gained several new public APIs for extensions and unknown fields.6 changes

Feature

Relaxed duplicate key handling in ProtoJSON

Conformance tests were updated to reflect new rules for how duplicate keys in JSON objects are treated.

Feature

Enum value name support in upb JSON

The upb JSON implementation can now look up and emit custom enum value names, matching other language runtimes.

Feature

New public APIs for extensions and unknown fields

upb exposed the upb_Extension struct, a SetNonCanonicalExtension function, and an unknown-fields encoder as supported public APIs.

Fix

Fixed reachable crash in JSON unparser

Serializing an empty Value inside an Any message could hit an internal CHECK failure; that path is now handled safely.

Fix

Python rejects mismatched CopyToProto targets

Copying a descriptor into the wrong kind of proto target now produces a clear error instead of undefined behavior.

Fix

Fixed missed out-of-memory handling

Several spots that allocate memory when unsetting required fields or copying messages now properly detect and report allocation failures.

03 · Security check

Dependencies and code review

0 dependencies scanned

Dependency advisories

Security Watch

No known advisories across 0 scanned dependencies.

No known advisories in the scanned dependencies.

Code review

No concrete code-level issues confirmed.

Get this report every week for your repos.

GitZoid learns each repo, reports what changed, and flags what needs attention. One flat price for the whole team.

$19 a month, flat · First 10 outputs free · No card required