NewYour coding agent can read the release notes before it upgrades.Set up the MCP server →
Go modules · #1288 by repository stars
Last release 3 days ago
05 Oct 2026
Ships unpredictably
gaps range from 2 weeks to 1.4 years
Some releases are documented
notes for 10 of 39 stable releases
Nothing withdrawn
no release was ever pulled
10 years old
339 releases · first in 2017
This point release addresses a potential issue identified here: https://github.com/jhump/protoreflect/security/advisories/GHSA-mm34-2v69-6vg6
This point release addresses a potential issue identified here: https://github.com/jhump/protoreflect/security/advisories/GHSA-mm34-2v69-6vg6
Changes/fixes:
dynamic.Message, when unmarshaling untrusted input or when marshaling a message that contains a reference cycle. A mitigation has been added for all three formats: binary, text, and json.Additions:
ToDynamicPB method to dynamic.Message, to aid with users migrating to API v2 and to work around interop issues with API v2's prototext and protojson packages.This point release addresses a potential issue identified here: GHSA-4qcm-mfjx-j36w
This point release addresses a potential issue identified here: GHSA-4qcm-mfjx-j36w
Changes/fixes:
One column per quarter.
…occasionally been a turbulent dependency. More breaking changes are expected since it is expected to get a totally new compiler and API before it reac…
This is expected to be the final release of this module with a v1.x version. (All subsequent releases are expected to be v2.x.)
The main change here is to insulate users from any future backwards-incompatible changes in bufbuild/protocompile. Previous releases (between 1.15 and 1.17, inclusive) depended on this module, but it hasn't yet released a stable v1.0 version, so it has occasionally been a turbulent dependency. More breaking changes are expected since it is expected to get a totally new compiler and API before it reaches v1.0. So anyone still using v1 of this repo should update to this new release before then to avoid being broken when that happens.
Changes/fixes:
protoc-gen-go, a nil-dereference panic could occur. This has been fixed. Instead, the legacy extension that would otherwise have caused a panic will now either be ignored or, if BuilderOptions.RequireInterpretedOptions is set to true, result in an error that not all options could be interpreted.
"github.com/golang/protobuf/protoc-gen-go". It was replaced in 2020 by the v2, which is at path "google.golang.org/protobuf/cmd/protoc-gen-go".Changes/fixes:
bufbuild/protocompile, which will maintain stability even when the upstream repo diverges with unstable/breaking changes. The only user-visible changes would be related to Editions support, thanks to unreleased changes in upstream that were included in this repo's fork. (See more below.)Additions:
AllowExperimentalEditions to the protoparse.Parser struct. When set to true, the parser will accept and return descriptors for files that use Edition 2024 (the only experimental edition at this time). It is experimental because it does not implement all of the rules and semantics of Edition 2024. But it does provide the ability to parse and compile files that include new language features in Edition 2024, such as visibility modifiers (export and local) as well as the option import modifier.Changes/fixes:
protoc-gen-go, a nil-dereference panic could occur. This has been fixed. Instead, the legacy extension that would otherwise have caused a panic is ignored and will not be included in the printed output (since it would result in an invalid source file that could not be compiled).Nothing published for this version
This release deprecates some packages that have newer alternatives in the Protobuf runtime. It also includes some small additions to the grpcreflect a…
This release deprecates some packages that have newer alternatives in the Protobuf runtime. It also includes some small additions to the grpcreflect and desc/sourceinfo packages. The rest of the changes are bug fixes.
Changes:
"google.golang.org/protobuf/reflect/protoreflect" package in the Protobuf runtime. In a v2 of this repo, this package will no longer be present.MessageDescriptor.FindFieldByName method.Changes and bugfixes:
"github.com/bufbuild/protocompile" package. There are some behavioral differences that we hope to address with additional API and enhancements to protocompile. But the protoparse package here is just a veneer on top of protocompile and we plan to do as little maintenance as possible here. In a v2 of this repo, this package will no longer be present.protocompile dependency has been updated to use a more recent version of that package. This addresses potential panics when calling Parser.ParseButDontLink.Changes and bugfixes:
sourceinfo.GlobalFiles.FindDescriptorByName has been fixed.sourceinfo.GlobalFiles registry or from the various Wrap* functions could induce panics in user code if querying for non-existent elements. For example, calling messageDescriptor.Fields().ByNumber(123) could return a typed-nil value on failure, instead of a nil interface. This would result in nil-dereference panics if methods were called on this later. These have been fixed.sourceinfo.GlobalFiles registry and from the various Wrap* functions had concrete types defined in this package, not in the Protobuf runtime. But the protoreflect.Descriptor interface has a "do not implement" marker, indicating that concrete types implementing the interface should not be implemented outside of that module. To avoid future issues with the Protobuf runtime, there are no more implementations in this repo. Instead of wrapping other descriptor implementations (via embedding, and then overriding some methods), this package now builds new descriptors, using the protodesc package in the Protobuf runtime module.Wrap* functions are now deprecated. The name is no longer accurate since they no longer return wrapper values. Also the new implementation, which builds new descriptors, can fail (though unlikely), but the existing signature of these functions did not allow for returning an error. So these functions could possibly panic in the face of malformed input descriptors. Users should use the new AddSourceInfoTo* versions of these functions instead.Additions:
AddSourceInfoTo* functions to replace the Wrap* functions. These functions augment the input descriptors by adding source code information to them.Changes:
"google.golang.org/protobuf/types/dynamicpb" package in the Protobuf runtime. In a v2 of this repo, this package will no longer be present.Additions:
NewClientV1 function to return a client that uses v1 of the server reflection service. This fills the gap in the existing factory functions, NewClientV1Alpha and NewClientAuto.AllowFallbackResolver method to the *grpcreflect.Client type. This allows the client to be configured with an alternate resolver that can be used as a backup when trying to satisfy dependencies, for cases where the remote server is non-authoritative and unable to provide all of them.Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
This release adds support for Protobuf Editions to many of the packages. Note, however, that the desc/protoparse package does not yet work to parse Pr
This release adds support for Protobuf Editions to many of the packages. Note, however, that the desc/protoparse package does not yet work to parse Protobuf Editions source files. This release also includes a handful of bug-fixes.
Additions:
Edition method to *desc.FileDescriptor, which returns non-zero for files that use Protobuf Editions (instead of syntax "proto2" or "proto3").Changes/fixes:
Wrap* functions, that could result in a descriptor hierarchy where the same descriptors were incorrectly present multiple times. This could happen if a file in the transitive dependency graph being wrapped had more than one incoming edge (e.g. same file appearing in import statements from two or more other files).Additions:
Editions field and SetEditions method to *builder.FileBuilder, for creating files that use Protobuf Editions.Changes/fixes:
Printer.CustomSortFunction was set wherein enum values could be printed in incorrect order, resulting in invalid source output. In syntax "proto3" and in open enums in Protobuf Editions, the first value must be the one with a zero numeric value.Additions:
AllowMissingFileDescriptors method to *grpcreflect.Client that allows users to opt-in to a lenient mode that will try to return schemas even when some files are unavailable. This will only be successful in cases where the missing files only provide custom options or are unused imports. This restores some lenience that was inadvertently provided (due to bugs and missing validation checks) when versions of this repo prior to v1.15 were combined with versions of the google.golang.org/grpc module prior to v1.61.Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
This is a bugfix release to address recently identified regressions in the desc/protoparse package -- things that worked in v1.14.1 but did not work i
This is a bugfix release to address recently identified regressions in the desc/protoparse package -- things that worked in v1.14.1 but did not work in v1.15.x.
Changes/fixes:
Parser.ImportPaths field specifies that the field is not used for calls to the Parser.ParseFilesButDoNotLink method. This is because import paths do not need to be resolved if not linking. But as of v1.15.0, the ImportPaths field was being used for that method, and the difference in behavior could break existing programs. This has been fixed, and the behavior once again matches the spec.Parser.ParseFiles were resolved as descriptors (via the Parser.LookupImport or Parser.LookupImportProto functions) instead of as source code (via the Parser.Accessor function or the default action of os.Open), the parse operation would fail with a "no such file" error. This would succeed with v1.14.1, with the descriptor being used as the input for the file instead of the file being parsed from source. So working programs could have been broken by an upgrade to v1.15.x. The package has been changed back to the v1.14.1 behavior.Nothing published for this version
This is a bugfix release to address bugs in the desc/builder , desc/protoparse , and grpcreflect packages and a compatibility issue with the most rece
This is a bugfix release to address bugs in the desc/builder, desc/protoparse, and grpcreflect packages and a compatibility issue with the most recent version of github.com/bufbuild/protocompile.
Changes/fixes:
Changes/fixes:
github.com/bufbuild/protocompile package under the hood as the parser. But that package is still using major version zero, since it's API has not completely stabilized. A recent release (v0.8.0) included backwards-incompatible changes that caused this repo to no longer compile. This release addresses the compile errors: this repo now uses that latest release of protocompile and correctly compiles against it.desc/protoparse package that could cause it to incorrectly accept or reject some Protobuf source files. See the release notes for protocompile v0.8.0 for more details.Changes/fixes:
grpcreflect.NewClientAuto function (added in v1.14.0) returns a client that automatically falls back to using v1alpha of the reflection protocol if the server does not support v1. However, it relied on the server returning an "unimplemented" error to decide to fall back, but this condition has been observed to sometimes instead manifest as an "unavailable" error (in proxies that fail to write a 404 error before closing the connection). In those cases, the client was not correctly falling back to v1alpha. This release remedies that, so it can fallback to v1alpha when this category of error occurs.Nothing published for this version
Nothing published for this version
This is a bugfix release to address bugs in the desc/protoprint package and a compatibility issue with the most recent version of github.com/bufbuild/
This is a bugfix release to address bugs in the desc/protoprint package and a compatibility issue with the most recent version of github.com/bufbuild/protocompile.
Changes/fixes:
github.com/bufbuild/protocompile package under the hood as the parser. But that package is still using major version zero, since it's API has not completely stabilized. A recent release (v0.7.0) included backwards-incompatible changes that caused this repo to no longer compile. This release addresses the compile errors: this repo now uses that latest release of protocompile and correctly compiles against it.Changes/fixes:
"), it would get printed incorrectly leading to either an incorrect string literal in some cases or an invalid and uncompilable source file in others. This has been fixed.FileDescriptorProto but never linked, the descriptor may be missing the type field of a FieldDescriptorProto (since it is not known whether a named type refers to a message, group, or enum), and it may have options left in the uninterpreted_options field of the various options messages, which has a peculiar representation for aggregate values. When printing a descriptor that had these characteristics, they were not correctly handled, so the output of the printer would be an invalid and uncompilable source file. Both of these cases have been fixed.Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
This is a bugfix release to address a panics in the desc/builder and desc/protoparse packages.
This is a bugfix release to address a panics in the desc/builder and desc/protoparse packages.
Changes/fixes:
EnumBuilder had numbers explicitly assigned and others did not, a panic could occur. This panic has now been fixed. When there is a mix of explicit value numbers and implicit numbers, the implicit values will be auto-assigned available numbers (starting at zero) while the explicit values will use the configured number.Changes/fixes:
protoparse package was overhauled in v1.15.0, a bug was inadvertently introduced to the functionality related to the Parser.InferImportPaths flag. If the files being processed imported a file for which an AST was not available (which is actually quite common, since they may import a standard file such as "google/protobuf/empty.proto"), a panic would occur. This panic has been fixed.Parser.InferImportPaths flag which now allow it to better detect file layouts and remedy import mismatches in more scenarios.Nothing published for this version
Nothing published for this version
This is a bugfix release to address issues found in the desc/protoparse package.
This is a bugfix release to address issues found in the desc/protoparse package.
Changes/fixes:
Parser were updated in this fashion. Other files in the transitive dependency (i.e. imports) did not have options represented this way. As of this release, the fix is complete and all descriptors returned by this package should have the same representation for custom options as in v1.14 and earlier.github.com/bufbuild/protocompile package under the hood as the parser. But that package is still using major version zero, since it's API has not completely stabilized. A recent release (v0.6.0) included backwards-incompatible changes that caused this repo to no longer compile. This release addresses the compile errors: this repo now uses that latest release of protocompile and correctly compiles against it.Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Your coding agent can read these notes before it upgrades. Set up the MCP server →