fix(deps): update protobuf

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Age	Confidence
protoc	tools	major	35.1 → 36.0
com.google.protobuf:protobuf-java (source)	compile	minor	4.35.1 → 4.36.0

---

Release Notes

protocolbuffers/protobuf (protoc)

v36.0: Protocol Buffers v36.0

Compare Source

Announcements

• Protobuf News may include additional announcements or pre-announcements for upcoming changes.
• Migration Guide may include additional guidance for breaking changes.

Bazel

• Add Bazel9 test (90ad7e9)
• Bazel 9 tests for csharp, hpb, objc, php, python, rust and upb (f9e028f)

Compiler

• Make default_symbol_visibility STRICT in edition 2026 (fcd68c5)
• Add deprecation warnings for (py|cc|java)_generic_service. (517be42)
• Disallow reserving field number INT_MAX. (933c522)
• Add bazel targets for standalone plugin binaries (#​23919) (81880fa)
• Feat: --<lang>_prefix cli option (#​24824) (92dd27c)
• Enforce proto limits in the descriptor by default for EDITION_2026. (d8520d9)
• Fix: Apply path traversal guard to WriteAllToZip() matching WriteAllToDisk() (#​27171) (28bef98)
• Add an enforce_proto_limits feature which will be implemented in Edition 2026. (5ddd524)

C++

• Disable option sub-location mapping in open-source builds. (1d8a656)
• Add json_options.proto and json_enumvalue_options.proto and/or gencode derived from them to release artifacts (15e9334)
• Add deprecation warning for Reflection::GetEnum() and Reflection::GetRepeatedEnum(). (0bca288)
• Migrate top-level protobuf unittest protos from Edition 2024 to Edition 2026. (271ca53)
• Util: validate Duration/Timestamp in TimeUtil::FromString against spec limits (#​27443) (e337495)
• Make default_symbol_visibility STRICT in edition 2026 (fcd68c5)
• Use the direct map reflection API when converting message to JSON, if the repeated field reflection is not valid. (e75aac3)
• Add bazel targets for standalone plugin binaries (#​23919) (81880fa)
• Fix(cpp): stop TextFormat iteration if output stream fails (#​26237) (2718dd5)
• Enforce proto limits in the descriptor by default for EDITION_2026. (d8520d9)
• Add an enforce_proto_limits feature which will be implemented in Edition 2026. (5ddd524)
• Workaround for attribute handling bug in gcc < 13 (ba10a4e)
• Fix confusing error message for map value type name conflicts (7864b85)
• C++Proto JSON: Align behavior on the type.proto path with the descriptor.proto path (0bc1f14)

Java

• Add json_options.proto and json_enumvalue_options.proto and/or gencode derived from them to release artifacts (15e9334)
• Json/java: add json_name enumval support (bff6ed1)
• Make Timestamps.parse() attempt non-lenient parsing first and warning if this fails. (d5e039a)
• Add a warning for potential OneofDescriptor collisions prior to Q1 2027 breaking changes. (ab69831)
• Make default_symbol_visibility STRICT in edition 2026 (fcd68c5)
• Reject negative size in mergeDelimitedFrom (#​28097) (c56cd5b)
• Add deprecation warnings for (py|cc|java)_generic_service. (517be42)
• Update Java protobuf generator to use Objects.requireNonNull (31ef11c)
• Use natural String comparison instead of UTF-8 ByteString comparison for sorting map keys in JsonFormat. (ae1faee)
• Add option to enable strict JSON parsing in Protobuf Java JsonFormat. (40825a1)
• Add bazel targets for standalone plugin binaries (#​23919) (81880fa)
• Remove experimental FieldOrder enum. (ec52338)
• Optimize GeneratedMessage.ExtendableBuilder to avoid temporary allocations when merging empty extendable messages. (a37dbd6)
• Stop using sun.misc.Unsafe in isValidUtf8 paths. (421d745)
• Use String#encodedLength on JDK versions that support it (efca121)
• Add an enforce_proto_limits feature which will be implemented in Edition 2026. (5ddd524)
• Java: limit numeric string length before BigDecimal parsing (#​26908) (25e7005)
• Validate java package and class against injection risks. (f8514d8)

Csharp

• Cache custom JSON enum names in JsonParser using Lazy. (156d42d)
• Csharp: add support for custom json strings for enum values (f11aac4)
• Validate language-specific namespace options in code generators (#​28667) (34e959b)
• Make default_symbol_visibility STRICT in edition 2026 (fcd68c5)
• Advertise that C# supports Edition 2026, and move C# Nullable Reference Type support into that edition. (a1f718c)
• First implementation of C# nullable reference types enablement using the current (unreleased) edition. (7a732d1)
• Add bazel targets for standalone plugin binaries (#​23919) (81880fa)
• Csharp: propagate recursion depth into JsonReplayTokenizer to honor Any nesting limit (#​26835) (cee45bf)
• Fix csharp string interpolation in Timestamp.ToDateTime() exception message (#​26341) (a298282)

Objective-C

• [ObjC] Carry recursion depth across MessageSet item parsing (#​27571) (f89baed)
• Add bazel targets for standalone plugin binaries (#​23919) (81880fa)
• [ObjC] Add DEBUG-only validations to extension values in GPBMessage, along with tests. (290a537)

Rust

• Re-export to google-protobuf crate in 0.x.y for 36.0 and above (96e772f)
• Remove -release suffix from Rust Crates.io release if minor version >= 36 (e7b3391)
• Add bazel targets for standalone plugin binaries (#​23919) (81880fa)
• RustProto: Add the ability to iterate over the muts of a repeated message-typed field. (70590a5)
• See also UPB changes below, which may affect Rust.

Python

• Add json_options.proto and json_enumvalue_options.proto and/or gencode derived from them to release artifacts (15e9334)
• Emit future warning when mutating GetOptions() in OSS (2255541)
• Emit deprecation warning when comparing descriptor containers with unrecognized types in OSS (5865e6b)
• Migrate top-level protobuf unittest protos from Edition 2024 to Edition 2026. (271ca53)
• Configure extra compile args in setup.py (#​28264) (3aa022a)
• Python: fix heap-use-after-free in MapIterator after map.clear() (#​27257) (9e9dbae)
• Add PyDescriptorPool_FromSharedPool(std::shared_ptr) API (abdf212)
• Fix memory leak in PyUpb_Descriptor_GetExtensionRanges (3d31b0f)
• Warn on out-of-range pop index in upb repeated fields. (a70d121)
• Support assigning repeated scalar fields using Python Buffer API. (ea40f1d)
• Fix Pure Python map<string, ...> key handling for bytes lookups. (156a0b8)
• Change Python DescriptorDatabase FindFileContainingSymbol() to accept leading "." to match DescriptorPool and other languages (e86e536)
• Faster Python cpp protos assignment to bytes/string fields. (593ab17)
• Serialize length-prefixed protos once (#​27252) (e090f8a)
• [py/upb] Make GetOptions() return immutable options for scalar type. UPB will raise a TypeError when options returned GetOptions() by is mutated. (403d429)
• Add bazel targets for standalone plugin binaries (#​23919) (81880fa)
• Add mutex protection to DescriptorPool caches. (cecbbf4)
• Refactor container comparison function in py/C++ and py/upb to return enum instead of integer. (c857f49)
• Py JSON: Fix issue with depth enforcement on Struct/Value WKT paths. (cfcc433)
• Fix RepeatedContainer_pop to raise IndexError for out-of-bounds indices. (78a09ad)

PHP

• Support custom JSON enum names in PHP (49b3b18)
• Remove total_bytes_limit from pure PHP CodedInputStream. (e171c67)
• Validate language-specific namespace options in code generators (#​28667) (34e959b)
• Fix PHP update_reserved_words.sh formatting and CI idempotency test (eff2323)
• Feat(php): script for updating php reserved words (#​27456) (47c8651)
• [PHP] - Add configurable recursion_limit to mergeFromString / serializeToString (#​27874) (5c5ee3c)
• Add bazel targets for standalone plugin binaries (#​23919) (81880fa)
• Clarify FieldMask JSON warnings/errors in the situation of fields which aren't round-trip representable in JSON format. (0488596)
• Add an enforce_proto_limits feature which will be implemented in Edition 2026. (5ddd524)

PHP C-Extension

• Support custom JSON enum names in PHP (49b3b18)
• Feat(php): script for updating php reserved words (#​27456) (47c8651)
• [PHP] - Add configurable recursion_limit to mergeFromString / serializeToString (#​27874) (5c5ee3c)
• See also UPB changes below, which may affect PHP C-Extension.

Ruby

• Validate language-specific namespace options in code generators (#​28667) (34e959b)
• Drop support for Ruby 3.1 (7008dd1)
• Add bazel targets for standalone plugin binaries (#​23919) (81880fa)

UPB (Python/PHP/Ruby C-Extension)

• Json/upb: Implement json EnumValueName for upb (0e8519e)
• Avoid UB in upb by switching to the XCT section, which will run our constructors before the compiler-generated initializers. (58e5ac8)
• [py/upb] Make GetOptions() return immutable options for scalar type. UPB will raise a TypeError when options returned GetOptions() by is mutated. (403d429)
• Clarify FieldMask JSON warnings/errors in the situation of fields which aren't round-trip representable in JSON format. (0488596)
• Add Bazel9 test (90ad7e9)
• Fixed two GCC-only issues around upb's generated extension registry. (d56b385)
• Fix RepeatedContainer_pop to raise IndexError for out-of-bounds indices. (78a09ad)

Other

• Fix typo in legacy_rust (daf4964)
• Add JSON and CPP option protos to C++ toolchain blacklisted_protos (c4846de)
• Remove fallback behavior (2d3c0d3)
• Add deprecation warning for internal_py_proto_library prior to Q1 2027 breaking changes. (a8d0be3)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Benchmark results

Benchmark run finished with conclusion skipped for a4a516fe93acc84e956c6478d1c5a0911bf6a4a9.

• Workflow run: https://github.com/prometheus/client_java/actions/runs/32413332072
• Artifact: pr-benchmark-results-pr-2400-a4a516fe93acc84e956c6478d1c5a0911bf6a4a9

Benchmark summary artifact was not found; see the workflow run for details.

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.