[renovate-bot]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/jhump/protoreflect	v1.17.0 → v2.0.0

---

Release Notes

jhump/protoreflect (github.com/jhump/protoreflect)

v2.0.0: Version 2.0.0

Compare Source

This is the first formal v2 release of this module! 🎉

If you are coming from v1, see the v2.0.0-beta.2 release notes for a summary of what changed between v1 and v2: many packages have moved and some have been removed (no longer necessary, since that functionality now lives in the core Protobuf runtime, google.golang.org/protobuf). The notes below describe all of the changes since that beta.

When we released the beta, we said we would make a proper release once we had more test coverage. That is what most of the work since then has been: a massive backfill of tests across every package in this module. Unsurprisingly, the new tests turned up quite a few bugs, including some deadlocks and hangs, all of which are fixed in this release.

This backfill of tests also turned up some rough edges in the APIs. Since this is the last chance to make backwards-incompatible changes before committing to a stable v2 API, we took the opportunity to fix those, too. While we were at it we also decided to rename some things to be more idiomatic Go (such as changing Rpc, Json, and Api to RPC, JSON, and API). So if you have been using the beta, expect to update a few call sites. Most of the incompatible changes are simple renames,. All breaking changes are called out below.

Note that this module now requires Go 1.26 or higher. That is the same minimum version supported by the Go team (as of this writing).

"github.com/jhump/protoreflect/v2/grpcdynamic"

Changes/fixes:

• Breaking: The methods of Stub have been renamed: InvokeRpc, InvokeRpcServerStream, InvokeRpcClientStream, and InvokeRpcBidiStream are now InvokeRPC, InvokeRPCServerStream, InvokeRPCClientStream, and InvokeRPCBidiStream.
• Previously, server-streaming and client-streaming calls disabled gRPC's automatic retries. They no longer do.
• Previously, if the server ended a server-streaming call before the request could be fully sent (for example, with a "PermissionDenied" error), InvokeRPCServerStream would return a bare io.EOF. It now returns the call's actual status error.
• Passing a nil request message now returns an error instead of panicking.

"github.com/jhump/protoreflect/v2/grpcreflect"

Changes/fixes:

• Breaking: The Error method of ProtocolError now has a pointer receiver, so a ProtocolError value no longer implements error. The client always returned pointers (*ProtocolError) anyway, so if you were checking for them with errors.As, you're likely already using a *ProtocolError target. If not, that was a bug in your calling code which this release will force into the right shape.
• Previously, the resolver returned by Client.AsResolver() returned the client's own error type when an element was not found. But the core Protobuf runtime requires resolvers to return exactly protoregistry.NotFound. So using this resolver to unmarshal messages that had unknown extensions failed, as did using it with protodesc's AllowUnresolvable option. This has been fixed. (The methods of Client still return more detailed errors.)
• "Not found" errors returned by the client now match protoresolve.ErrNotFound when checked with errors.Is.
• AsResolver() now honors the WithFallbackResolvers option, and AllExtensionNumbersForType now consults the fallback resolvers when the server does not know the type.
• Concurrent lookups for the same file, symbol, or extension, when it is not yet cached, now share a single request to the server, instead of each one sending its own request.
• Previously, an ErrorResponse from the server with a code of zero (which is "OK") would result in a nil error. It is now treated as an "Unknown" error code.
• A possible fatal "stack overflow" error in Client has been fixed.
• Previously, Client.Reset could hang forever waiting for the server. This has been fixed.

"github.com/jhump/protoreflect/v2/protobuilder"

Changes/fixes:

• Breaking: RpcType, RpcTypeMessage, and RpcTypeImportedMessage have been renamed to RPCType, RPCTypeMessage, and RPCTypeImportedMessage. Also, the JsonName field and SetJsonName method of FieldBuilder have been renamed to JSONName and SetJSONName.
• Previously, if builders referred to elements in two separate copies of the same file, building failed with an error that the file was "already registered", even if the two copies were identical. This is easy to do by accident, because the From* functions for elements other than files, like FromMessage, copy the element's entire file. So calling FromMessage for two messages in the same file results in two copies of that file. Identical copies of a file can now be used in the same build. But if the copies differ, such as when they've been modified in different ways, building still fails. In that case, the error now suggests the right approach: use FromFile and then the new FileBuilder.FindElement method (see below).
• Build() now returns errors, instead of panicking, for fields, oneofs, methods, and enum values that do not have a parent, and for methods that are missing a request or response type.
• A message that refers to itself can now be built, even if it has no parent.
• Several bugs in the bookkeeping of names and numbers have been fixed: when renaming groups and map entries, for groups in oneofs, when TryAddOneOf fails and must roll back, when moving a field into a oneof in its own message (which panicked), and when adding a field to a oneof that has no parent. Also, options on group types are now considered when computing a file's imports.
• The package docs previously suggested copying a builder by copying its struct value. That does not work: the copy shares state with the original, and modifying it can corrupt the original. Use the new Clone function instead (see below).

Additions:

• All builders now have a Clone method, which makes a deep copy of the builder, including all of its descendants. There is also a generic Clone function, which returns the same type as its argument (so protobuilder.Clone(msgBuilder) returns a *MessageBuilder). This makes it easy to put the same element in two places. Adding a builder to a new parent moves it, so adding a single builder to two different parents does not work; add a clone to one of them instead.
• FileBuilder has a new FindElement method, which finds an element in the file by its fully-qualified name. Unlike the Get* methods, which only return immediate children, this searches all descendants of the file. To get builders for several elements in the same file, use FromFile and then use this method to find each element.

"github.com/jhump/protoreflect/v2/protodescs"

Changes/fixes:

• Previously, SortFiles was broken: instead of sorting the given files, it produced an empty result. This also affected protoresolve.FromFileDescriptorSet, which uses the same implementation. This has been fixed.
• SortFiles now returns an error if the files have an import cycle (including a file that imports itself), leaves the given slice unchanged when it returns an error, and produces a deterministic order.

"github.com/jhump/protoreflect/v2/protomessage"

Changes/fixes:

• Walk now stops if the callback returns false for the root message.
• As now recognizes extensions that are set on nested messages.
• ReparseUnrecognized now only returns true if something was actually recognized.

"github.com/jhump/protoreflect/v2/protoprint"

Changes/fixes:

• Float and double values in options are now printed in their shortest form (for example, 3.14 instead of 3.140000), and infinity and NaN are printed as inf, -inf, and nan.
• Previously, printing could modify the Printer and the options of the descriptors being printed. It no longer does, so it is now safe to use a Printer from multiple goroutines.
• Type names are now qualified when their first component is a Protobuf keyword, so that the printed source can be correctly parsed by a compiler.
• A panic when printing comments that consist of only blank lines has been fixed.

"github.com/jhump/protoreflect/v2/protoresolve"

Changes/fixes:

• Errors from URL lookups, like FindMessageByURL, now set the URL field of ErrUnexpectedType and leave Name empty, as the docs for those fields indicated. Also, the Actual field is now correctly populated.
• The type resolvers in this package now return an *ErrUnexpectedType, instead of some other error, from FindExtensionByName when the given name refers to a normal field and not an extension.
• Previously, calling String() on a TypeKind that had more than one bit set would loop forever. This has been fixed. Multiple kinds are listed in the order of their constants, like message,enum,extension.
• FromFiles now copies the given files, instead of sharing their internal maps. It also now detects conflicting extensions across files.
• Registering a duplicate file now always returns an error that reads file "x" already registered. Also, a single file that defines multiple extensions with the same extendee and number is now rejected.
• The error returned by FromFileDescriptorSet when a file can't be registered now reads register "x.proto": ..., instead of including the entire descriptor proto.
• Registry.RegisterFileProto no longer modifies the given proto if registration fails.
• The range methods of resolvers returned by Combine and CombinePools could report duplicates, stop early, or ignore the callback's signal to stop. These have been fixed.

"github.com/jhump/protoreflect/v2/protoresolve/remotereg"

Changes/fixes:

• Breaking: HttpTypeFetcher has been renamed to HTTPTypeFetcher.
• Breaking: DescriptorConverter.DescriptorAsApi has been renamed to DescriptorAsAPI.
• Breaking: The includeSubPackages parameter of RegisterPackageBaseURL has been removed. A registration now always applies to sub-packages, too (when multiple apply, the one for the nearest ancestor package wins). A value of false was previously silently ignored anyway.
• The parLimit parameter for HTTPTypeFetcher now means no limit if zero or less. Previously, such a value caused all fetches to hang forever.
• Previously, RegisterPackageBaseURL would deadlock whenever the given package did not already have a registration. This has been fixed.
• When a TypeFetcher does not have a type but the Fallback resolver does, the fallback's descriptor is now cached under the type's URL, so later lookups don't query the fetcher again.
• A data race on the cache of descriptor protos has been fixed. Also, types that are fetched no longer overwrite types that were explicitly registered or already cached.
• Several bugs in CachingTypeFetcher have been fixed: if one caller's context was cancelled, other callers waiting on the same fetch would fail; waiting callers ignored their own contexts; and a panic during a fetch could poison the cache.
• Default values of bytes fields were converted incorrectly, with extra leading zero bytes. This has been fixed.

"github.com/jhump/protoreflect/v2/sourceinfo"

Changes/fixes:

• Previously, if source info could not be added to a file (for example, because the registered data was corrupt), Files.FindFileByPath and Files.FindDescriptorByName would return an error. They now return the plain descriptor instead, like all of the other methods of Files and Types already did. (The AddSourceInfoTo* functions still return such errors.)
• A possible deadlock in the Range* methods has been fixed.

v1.19.0

Compare Source

This point release addresses a potential issue identified here: GHSA-mm34-2v69-6vg6

"github.com/jhump/protoreflect/dynamic"

Changes/fixes:

• Address potential stack overflow fatal errors in dynamic.Message, when unmarshaling untrusted input or when marshaling a message that contains a reference cycle. A mitigation has been added for all three formats: binary, text, and json.
• Fixed a bug that prevented the convert and merge methods (for converting to/from other message implementations) from working correctly with *dynamicpb.Message (the dynamic message implementation added to the core runtime in API v2).

Additions:

• Adds new ToDynamicPB method to dynamic.Message, to aid with users migrating to API v2 and to work around interop issues with API v2's prototext and protojson packages.

v1.18.1

Compare Source

This point release addresses a potential issue identified here: GHSA-4qcm-mfjx-j36w

"github.com/jhump/protoreflect/grpcreflect"

Changes/fixes:

• If a file to download has an import cycle, it is now detected, and an error is returned. This fixes an issue where such a set of files would previously induce infinite recursion and result in the calling program terminating with a "stack overflow" fatal error.
• If a file does not have an import cycle but still has a pathologically deep import tree, that is also detected, and an error is returned. Such a set of files could be generated by a malicious server and result in the same "stack overflow" fatal error. The import depth is now limited to 1024, which should be signifcantly higher than import depths in any real code bases (so we don't trigger false positives), but also low enough that it won't result in a stack overflow.

v1.18.0

Compare Source

This is expected to be the final release of this module with a v1.x version. (All subsequent releases are expected to be v2.x.)

The main change here is to insulate users from any future backwards-incompatible changes in bufbuild/protocompile. Previous releases (between 1.15 and 1.17, inclusive) depended on this module, but it hasn't yet released a stable v1.0 version, so it has occasionally been a turbulent dependency. More breaking changes are expected since it is expected to get a totally new compiler and API before it reaches v1.0. So anyone still using v1 of this repo should update to this new release before then to avoid being broken when that happens.

"github.com/jhump/protoreflect/desc/builder"

Changes/fixes:

• If resolving custom options and extensions resulted in a generated extension description created by the older v1 of protoc-gen-go, a nil-dereference panic could occur. This has been fixed. Instead, the legacy extension that would otherwise have caused a panic will now either be ignored or, if BuilderOptions.RequireInterpretedOptions is set to true, result in an error that not all options could be interpreted.
  • The older v1 has import path "github.com/golang/protobuf/protoc-gen-go". It was replaced in 2020 by the v2, which is at path "google.golang.org/protobuf/cmd/protoc-gen-go".

"github.com/jhump/protoreflect/desc/protoparse"

Changes/fixes:

• The internal compiler no longer comes from a separate Go module. Instead, this module now contains a fork of bufbuild/protocompile, which will maintain stability even when the upstream repo diverges with unstable/breaking changes. The only user-visible changes would be related to Editions support, thanks to unreleased changes in upstream that were included in this repo's fork. (See more below.)

Additions:

• This adds a field named AllowExperimentalEditions to the protoparse.Parser struct. When set to true, the parser will accept and return descriptors for files that use Edition 2024 (the only experimental edition at this time). It is experimental because it does not implement all of the rules and semantics of Edition 2024. But it does provide the ability to parse and compile files that include new language features in Edition 2024, such as visibility modifiers (export and local) as well as the option import modifier.

"github.com/jhump/protoreflect/desc/protoprint"

Changes/fixes:

• If resolving custom options and extensions resulted in a generated extension description created by the older v1 of protoc-gen-go, a nil-dereference panic could occur. This has been fixed. Instead, the legacy extension that would otherwise have caused a panic is ignored and will not be included in the printed output (since it would result in an invalid source file that could not be compiled).

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[forking-renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 1 additional dependency was updated

Details:

Package	Change
google.golang.org/protobuf	v1.36.11 -> v1.36.12