Protobuf

Latest version: v6.30.2

Safety actively analyzes 723177 Python packages for vulnerabilities to keep your Python projects secure.

Scan your dependencies

Page 17 of 31

3.19.0

Not secure
C++
* Make proto2::Message::DiscardUnknownFields() non-virtual
* Separate RepeatedPtrField into its own header file
* For default floating point values of 0, consider all bits significant
* cmake: support `MSVC_RUNTIME_LIBRARY` property (8851)
* Fix shadowing warnings (8926)
* Fix for issue 8484, constant initialization doesn't compile in msvc clang-cl environment (8993)
* Fix build on AIX and SunOS (8373) (9065)
* Add Android stlport and default toolchains to BUILD. (8290)

Java
* For default floating point values of 0, consider all bits significant
* Annotate `//java/com/google/protobuf/util/...` with nullness annotations
* Use ArrayList copy constructor (7853)

Kotlin
* Switch Kotlin proto DSLs to be implemented with inline value classes
* Fixing inlining and deprecation for repeated string fields (9120)

Python
* Proto2 DecodeError now includes message name in error message
* Make MessageToDict convert map keys to strings (8122)
* Add python-requires in setup.py (8989)
* Add python 3.10 (9034)

JavaScript
* Skip exports if not available by CommonJS (8856)
* JS: Comply with CSP no-unsafe-eval. (8864)

PHP
* Added "object" as a reserved name for PHP (8962)

Ruby
* Override Map.clone to use Map's dup method (7938)
* Ruby: build extensions for arm64-darwin (8232)
* Add class method Timestamp.from_time to ruby well known types (8562)
* Adopt pure ruby DSL implementation for JRuby (9047)
* Add size to Map class (8068)
* Fix for descriptor_pb.rb: google/protobuf should be required first (9121)

C
* Correctly set ExtensionRegistry when parsing with MessageParser, but using an already existing CodedInputStream (7246)
* [C] Make FieldDescriptor propertyName public (7642)

3.19.0rc2

Not secure
Java
* Update changelog to reflect that we are not yet dropping Java 7 support after all

3.19.0rc1

Not secure
C++
* Make proto2::Message::DiscardUnknownFields() non-virtual
* Separate RepeatedPtrField into its own header file
* For default floating point values of 0, consider all bits significant
* cmake: support `MSVC_RUNTIME_LIBRARY` property (8851)
* Fix shadowing warnings (8926)
* Fix for issue 8484, constant initialization doesn't compile in msvc clang-cl environment (8993)
* Fix build on AIX and SunOS (8373) (9065)
* Add Android stlport and default toolchains to BUILD. (8290)

Java
* This release drops support for Java 7. Use 3.18.x if you still need Java 7 support.
* For default floating point values of 0, consider all bits significant
* Annotate `//java/com/google/protobuf/util/...` with nullness annotations
* Use ArrayList copy constructor (7853)

Kotlin
* Switch Kotlin proto DSLs to be implemented with inline value classes

Python
* Proto2 DecodeError now includes message name in error message
* Make MessageToDict convert map keys to strings (8122)
* Add python-requires in setup.py (8989)
* Add python 3.10 (9034)

JavaScript
* Skip exports if not available by CommonJS (8856)
* JS: Comply with CSP no-unsafe-eval. (8864)

PHP
* Added "object" as a reserved name for PHP (8962)

Ruby
* Override Map.clone to use Map's dup method (7938)
* Ruby: build extensions for arm64-darwin (8232)
* Add class method Timestamp.from_time to ruby well known types (8562)
* Adopt pure ruby DSL implementation for JRuby (9047)
* Add size to Map class (8068)

C
* Correctly set ExtensionRegistry when parsing with MessageParser, but using an already existing CodedInputStream (7246)
* [C] Make FieldDescriptor propertyName public (7642)

3.18.3

C++
* Reduce memory consumption of MessageSet parsing
* This release addresses a [Security Advisory for C++ and Python users](https://github.com/protocolbuffers/protobuf/security/advisories/GHSA-8gq9-2x98-w8hf)

3.18.2

Java
* Improve performance characteristics of UnknownFieldSet parsing (9371)

3.18.1

Not secure
Python
* Update setup.py to reflect that we now require at least Python 3.5 (8989)
* Performance fix for DynamicMessage: force GetRaw() to be inlined (9023)

Ruby
* Update ruby_generator.cc to allow proto2 imports in proto3 (9003)

Page 17 of 31

© 2025 Safety CLI Cybersecurity Inc. All Rights Reserved.