Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package protobuf for openSUSE:Factory checked in at 2026-09-15 17:09:01 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/protobuf (Old) and /work/SRC/openSUSE:Factory/.protobuf.new.383539 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "protobuf" Tue Sep 15 17:09:01 2026 rev:97 rq:1377638 version:36.1 Changes: -------- --- /work/SRC/openSUSE:Factory/protobuf/protobuf-java.changes 2026-05-28 23:08:55.303954881 +0200 +++ /work/SRC/openSUSE:Factory/.protobuf.new.383539/protobuf-java.changes 2026-09-15 17:09:14.810413490 +0200 @@ -1,0 +2,26 @@ +Sun Sep 13 06:24:56 UTC 2026 - Martin Pluskal <[email protected]> + +- Update to 36.1 (C++ 36.1, Python bindings 7.36.1, Java 4.36.1): + * Shlib packages renamed for the SONAME bump: libprotobuf34_2_0 and + siblings become libprotobuf36_1_0 etc. (baselibs.conf follows; + reverse deps need rebuilds). + * CVE-2026-0994: Python json_format.ParseDict recursion-limit bypass + via nested Any messages (DoS); depth now tracked via ConvertMessage. + * protoc: path traversal guard in WriteAllToZip; new --<lang>_prefix + option; Edition 2026 groundwork (naming enforcement, proto limits, + STRICT default symbol visibility). + * C++: RepeatedPtrField overflow and arena bounds checks, UTF-8 + validation fix, TimeUtil spec-limit validation. + * Java: standard gencode no longer uses sun.misc.Unsafe; BigDecimal + parse length cap; negative-size mergeDelimitedFrom rejected. + * Python: MapIterator heap-use-after-free and descriptor memleak + fixed; Struct/Value JSON depth enforcement; free-threading fixes. +- Install the java_features.proto copy without the exec bit. +- Refresh the protobuf-java lite source list from upstream LITE_SRCS + (drop BinaryReader/Writer, ByteBufferWriter, Reader, SchemaFactory, + Writer; add DoNotInline, InternalLazyField, + InvalidProtobufRuntimeException). +- Generate Java from the new json_options.proto and + json_enumvalue_options.proto in the protobuf-java core build. + +------------------------------------------------------------------- protobuf.changes: same change python-protobuf.changes: same change Old: ---- protobuf-34.2.tar.gz protobuf-7.34.2.tar.gz protobuf-java-4.34.2.pom protobuf-java-util-4.34.2.pom protobuf-javalite-4.34.2.pom New: ---- protobuf-36.1.tar.gz protobuf-7.36.1.tar.gz protobuf-java-4.36.1.pom protobuf-java-util-4.36.1.pom protobuf-javalite-4.36.1.pom ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ protobuf-java.spec ++++++ --- /var/tmp/diff_new_pack.LS8kSz/_old 2026-09-15 17:09:16.164470182 +0200 +++ /var/tmp/diff_new_pack.LS8kSz/_new 2026-09-15 17:09:16.166470265 +0200 @@ -19,11 +19,10 @@ %define tarname protobuf Name: protobuf-java -Version: 34.2 +Version: 36.1 Release: 0 Summary: Java Bindings for Google Protocol Buffers License: BSD-3-Clause -Group: Development/Libraries/Java URL: https://github.com/protocolbuffers/protobuf Source0: https://github.com/protocolbuffers/protobuf/releases/download/v%{version}/%{tarname}-%{version}.tar.gz Source1: https://repo1.maven.org/maven2/com/google/protobuf/%{name}/4.%{version}/%{name}-4.%{version}.pom @@ -33,13 +32,15 @@ BuildRequires: fdupes BuildRequires: java-devel >= 1.8 BuildRequires: maven-local -BuildRequires: protobuf-devel >= %{version} +BuildRequires: pkgconfig BuildRequires: mvn(com.google.code.findbugs:jsr305) BuildRequires: mvn(com.google.code.gson:gson) BuildRequires: mvn(com.google.errorprone:error_prone_annotations) BuildRequires: mvn(com.google.guava:guava) BuildRequires: mvn(com.google.j2objc:j2objc-annotations) BuildRequires: mvn(org.apache.felix:maven-bundle-plugin) +BuildRequires: pkgconfig(protobuf) >= %{version} +BuildRequires: pkgconfig(protobuf-lite) >= %{version} Requires: java >= 1.8 BuildArch: noarch @@ -72,7 +73,6 @@ %package javadoc Summary: Javadoc for %{name} -Group: Documentation/HTML %description javadoc This package contains the API documentation for %{name}. @@ -108,6 +108,8 @@ --proto_path=../src \ --proto_path=core/src/main/resources/google/protobuf \ core/src/main/resources/google/protobuf/java_features.proto \ + ../src/google/protobuf/json_enumvalue_options.proto \ + ../src/google/protobuf/json_options.proto \ ../src/google/protobuf/any.proto \ ../src/google/protobuf/api.proto \ ../src/google/protobuf/descriptor.proto \ @@ -121,6 +123,8 @@ ../src/google/protobuf/wrappers.proto \ ../src/google/protobuf/compiler/plugin.proto cp \ + ../src/google/protobuf/json_enumvalue_options.proto \ + ../src/google/protobuf/json_options.proto \ ../src/google/protobuf/any.proto \ ../src/google/protobuf/api.proto \ ../src/google/protobuf/descriptor.proto \ @@ -137,7 +141,7 @@ # Lite build mkdir -p lite/src/main/resources/google/protobuf mkdir -p lite/src/main/java/com/google/protobuf -# lite sources from lite/BUILD.bazel +# lite sources are LITE_SRCS from java/core/BUILD.bazel cp \ core/src/main/java/com/google/protobuf/AbstractMessageLite.java \ core/src/main/java/com/google/protobuf/AbstractParser.java \ @@ -145,11 +149,8 @@ core/src/main/java/com/google/protobuf/AllocatedBuffer.java \ core/src/main/java/com/google/protobuf/Android.java \ core/src/main/java/com/google/protobuf/ArrayDecoders.java \ - core/src/main/java/com/google/protobuf/BinaryReader.java \ - core/src/main/java/com/google/protobuf/BinaryWriter.java \ core/src/main/java/com/google/protobuf/BooleanArrayList.java \ core/src/main/java/com/google/protobuf/BufferAllocator.java \ - core/src/main/java/com/google/protobuf/ByteBufferWriter.java \ core/src/main/java/com/google/protobuf/ByteOutput.java \ core/src/main/java/com/google/protobuf/ByteString.java \ core/src/main/java/com/google/protobuf/CanIgnoreReturnValue.java \ @@ -160,6 +161,7 @@ core/src/main/java/com/google/protobuf/CodedOutputStreamWriter.java \ core/src/main/java/com/google/protobuf/CompileTimeConstant.java \ core/src/main/java/com/google/protobuf/DoubleArrayList.java \ + core/src/main/java/com/google/protobuf/DoNotInline.java \ core/src/main/java/com/google/protobuf/ExperimentalApi.java \ core/src/main/java/com/google/protobuf/ExtensionLite.java \ core/src/main/java/com/google/protobuf/ExtensionRegistryFactory.java \ @@ -177,7 +179,9 @@ core/src/main/java/com/google/protobuf/InlineMe.java \ core/src/main/java/com/google/protobuf/IntArrayList.java \ core/src/main/java/com/google/protobuf/Internal.java \ + core/src/main/java/com/google/protobuf/InternalLazyField.java \ core/src/main/java/com/google/protobuf/InvalidProtocolBufferException.java \ + core/src/main/java/com/google/protobuf/InvalidProtobufRuntimeException.java \ core/src/main/java/com/google/protobuf/IterableByteBufferInputStream.java \ core/src/main/java/com/google/protobuf/Java8Compatibility.java \ core/src/main/java/com/google/protobuf/JavaType.java \ @@ -214,11 +218,9 @@ core/src/main/java/com/google/protobuf/ProtobufArrayList.java \ core/src/main/java/com/google/protobuf/ProtocolStringList.java \ core/src/main/java/com/google/protobuf/RawMessageInfo.java \ - core/src/main/java/com/google/protobuf/Reader.java \ core/src/main/java/com/google/protobuf/RopeByteString.java \ core/src/main/java/com/google/protobuf/RuntimeVersion.java \ core/src/main/java/com/google/protobuf/Schema.java \ - core/src/main/java/com/google/protobuf/SchemaFactory.java \ core/src/main/java/com/google/protobuf/SchemaUtil.java \ core/src/main/java/com/google/protobuf/SmallSortedMap.java \ core/src/main/java/com/google/protobuf/StructuralMessageInfo.java \ @@ -232,7 +234,6 @@ core/src/main/java/com/google/protobuf/UnsafeUtil.java \ core/src/main/java/com/google/protobuf/Utf8.java \ core/src/main/java/com/google/protobuf/WireFormat.java \ - core/src/main/java/com/google/protobuf/Writer.java \ lite/src/main/java/com/google/protobuf/ protoc \ --java_out=lite:lite/src/main/java \ @@ -268,7 +269,7 @@ %install pushd java -%mvn_install +%{mvn_install} %fdupes -s %{buildroot}%{_javadocdir} %files -f java/.mfiles ++++++ protobuf.spec ++++++ --- /var/tmp/diff_new_pack.LS8kSz/_old 2026-09-15 17:09:16.202471773 +0200 +++ /var/tmp/diff_new_pack.LS8kSz/_new 2026-09-15 17:09:16.204471856 +0200 @@ -20,12 +20,10 @@ %define tarname protobuf # see cmake/abseil-cpp.cmake and src/google/protobuf/port_def.inc %define abseil_min_version 20250512.1 -%global sover 34_2_0 +%global sover 36_1_0 %if 0%{?gcc_version} < 11 %define with_gcc 11 %endif -# requires gmock, which is not yet in the distribution -%bcond_with check %global protoc_arch %{_arch} %ifarch x86_64 %{?x86_64} %global protoc_arch x86_64 @@ -65,12 +63,13 @@ %ifarch sparc64 %global protoc_arch sparc_64 %endif +# requires gmock, which is not yet in the distribution +%bcond_with check Name: protobuf -Version: 34.2 +Version: 36.1 Release: 0 Summary: Protocol Buffers - Google's data interchange format License: BSD-3-Clause -Group: Development/Libraries/C and C++ URL: https://github.com/protocolbuffers/protobuf Source0: https://github.com/protocolbuffers/protobuf/releases/download/v%{version}/%{tarname}-%{version}.tar.gz Source1: baselibs.conf @@ -127,7 +126,6 @@ %package -n libprotobuf%{sover} Summary: Protocol Buffers - Google's data interchange format -Group: System/Libraries %description -n libprotobuf%{sover} Protocol Buffers are a way of encoding structured data in an efficient yet @@ -136,7 +134,6 @@ %package -n libprotoc%{sover} Summary: Protocol Buffers - Google's data interchange format -Group: System/Libraries %description -n libprotoc%{sover} Protocol Buffers are a way of encoding structured data in an efficient yet @@ -145,7 +142,6 @@ %package -n libprotobuf-lite%{sover} Summary: Protocol Buffers - Google's data interchange format -Group: System/Libraries %description -n libprotobuf-lite%{sover} Protocol Buffers are a way of encoding structured data in an efficient yet @@ -154,7 +150,6 @@ %package -n libutf8_range-%{sover} Summary: UTF-8 validation libraries from Protobuf -Group: System/Libraries %description -n libutf8_range-%{sover} UTF-8 string validation library with optional SIMD acceleration (armv8a NEON, @@ -162,7 +157,6 @@ %package devel Summary: Header files, libraries and development documentation for %{name} -Group: Development/Libraries/C and C++ Requires: libprotobuf%{sover} = %{version} Requires: libprotobuf-lite%{sover} = %{version} Requires: libutf8_range-%{sover} = %{version} @@ -203,7 +197,7 @@ %install %cmake_install install -Dm 0644 editors/proto.vim %{buildroot}%{_datadir}/vim/site/syntax/proto.vim -install -D java/core/src/main/resources/google/protobuf/java_features.proto %{buildroot}%{_includedir}/java/core/src/main/resources/google/protobuf/java_features.proto +install -D -m 0644 java/core/src/main/resources/google/protobuf/java_features.proto %{buildroot}%{_includedir}/java/core/src/main/resources/google/protobuf/java_features.proto # create maven metadata for the protoc executable install -dm 0755 %{buildroot}%{_datadir}/maven-metadata ++++++ python-protobuf.spec ++++++ --- /var/tmp/diff_new_pack.LS8kSz/_old 2026-09-15 17:09:16.237473238 +0200 +++ /var/tmp/diff_new_pack.LS8kSz/_new 2026-09-15 17:09:16.239473322 +0200 @@ -17,14 +17,13 @@ # -%define baseversion 34.2 +%define baseversion 36.1 %{?sle15_python_module_pythons} Name: python-protobuf Version: 7.%{baseversion} Release: 0 Summary: Python Bindings for Google Protocol Buffers License: BSD-3-Clause -Group: Development/Libraries/Python URL: https://github.com/protocolbuffers/protobuf Source0: https://files.pythonhosted.org/packages/source/p/protobuf/protobuf-%{version}.tar.gz BuildRequires: %{python_module devel} ++++++ baselibs.conf ++++++ --- /var/tmp/diff_new_pack.LS8kSz/_old 2026-09-15 17:09:16.292475541 +0200 +++ /var/tmp/diff_new_pack.LS8kSz/_new 2026-09-15 17:09:16.295475667 +0200 @@ -1,5 +1,5 @@ -libprotobuf34_2_0 -libprotoc34_2_0 -libprotobuf-lite34_2_0 -libutf8_range-34_2_0 +libprotobuf36_1_0 +libprotoc36_1_0 +libprotobuf-lite36_1_0 +libutf8_range-36_1_0 ++++++ protobuf-34.2.tar.gz -> protobuf-36.1.tar.gz ++++++ /work/SRC/openSUSE:Factory/protobuf/protobuf-34.2.tar.gz /work/SRC/openSUSE:Factory/.protobuf.new.383539/protobuf-36.1.tar.gz differ: char 12, line 1 ++++++ protobuf-7.34.2.tar.gz -> protobuf-7.36.1.tar.gz ++++++ ++++ 29702 lines of diff (skipped) ++++++ protobuf-java-4.34.2.pom -> protobuf-java-4.36.1.pom ++++++ --- /work/SRC/openSUSE:Factory/protobuf/protobuf-java-4.34.2.pom 2026-05-28 23:08:53.979900413 +0200 +++ /work/SRC/openSUSE:Factory/.protobuf.new.383539/protobuf-java-4.36.1.pom 2026-09-15 17:09:14.792412736 +0200 @@ -4,7 +4,7 @@ <parent> <groupId>com.google.protobuf</groupId> <artifactId>protobuf-parent</artifactId> - <version>4.34.2</version> + <version>4.36.1</version> </parent> <artifactId>protobuf-java</artifactId> ++++++ protobuf-java-util-4.34.2.pom -> protobuf-java-util-4.36.1.pom ++++++ --- /work/SRC/openSUSE:Factory/protobuf/protobuf-java-util-4.34.2.pom 2026-05-28 23:08:54.735931514 +0200 +++ /work/SRC/openSUSE:Factory/.protobuf.new.383539/protobuf-java-util-4.36.1.pom 2026-09-15 17:09:14.800413071 +0200 @@ -4,7 +4,7 @@ <parent> <groupId>com.google.protobuf</groupId> <artifactId>protobuf-parent</artifactId> - <version>4.34.2</version> + <version>4.36.1</version> </parent> <artifactId>protobuf-java-util</artifactId> @@ -16,7 +16,7 @@ <dependency> <groupId>com.google.protobuf</groupId> <artifactId>protobuf-java</artifactId> - <version>4.34.2</version> + <version>4.36.1</version> </dependency> <dependency> <groupId>com.google.code.findbugs</groupId> ++++++ protobuf-javalite-4.34.2.pom -> protobuf-javalite-4.36.1.pom ++++++ --- /work/SRC/openSUSE:Factory/protobuf/protobuf-javalite-4.34.2.pom 2026-05-28 23:08:56.444001780 +0200 +++ /work/SRC/openSUSE:Factory/.protobuf.new.383539/protobuf-javalite-4.36.1.pom 2026-09-15 17:09:14.822413992 +0200 @@ -4,7 +4,7 @@ <parent> <groupId>com.google.protobuf</groupId> <artifactId>protobuf-parent</artifactId> - <version>4.34.2</version> + <version>4.36.1</version> </parent> <artifactId>protobuf-javalite</artifactId> @@ -12,8 +12,9 @@ <name>Protocol Buffers [Lite]</name> <description> - Lite version of Protocol Buffers library. This version is optimized for code size, but does - not guarantee API/ABI stability. + Lite version of Protocol Buffers library. This version is targeted for mobile client use + rather than server side use. It is optimized for code size, but does not guarantee API/ABI + stability. </description> <dependencies>
