protobufjs 8.2.0 → 8.2.1

package/README.md

@@ -278,14 +278,6 @@ Protocol Buffers [Text Format](https://protobuf.dev/reference/protobuf/textforma
 
 In [CSP](https://w3c.github.io/webappsec-csp/)-restricted environments that disallow unsafe-eval, use generated static code instead of runtime code generation.
 
-## Compatibility
-
-Supported runtimes are browsers, Node.js v12+, Deno (`deno add npm:protobufjs`) and Bun (`bun add protobufjs`). When using the CLI with Bun, Node.js must also be installed.
-
-## Security
-
-protobuf.js favors transparent disclosure. Security-impacting reports are handled through coordinated GitHub Security Advisories where appropriate. See [SECURITY.md](./SECURITY.md) for supported release lines, reporting instructions, and notes on untrusted schema input.
-
 ## Conformance
 
 protobuf.js targets full binary wire-format conformance for **Proto2**, **Proto3** and **Editions**. CI runs the official Protocol Buffers conformance suite, with logs uploaded as artifacts.
@@ -298,62 +290,71 @@ protobuf.js targets full binary wire-format conformance for **Proto2**, **Proto3
 
 ## Performance
 
-In both reflection and static modes, protobuf.js builds specialized encoders and decoders for each message type instead of interpreting descriptors at runtime.
+In both reflection and static modes, protobuf.js builds specialized encoders and decoders instead of interpreting descriptors at runtime.
 
-The repository includes a small benchmark for the bundled fixture in [`bench/`](./bench/). It compares protobuf.js reflection and static code against native `JSON.stringify`/`JSON.parse` and [google-protobuf](https://www.npmjs.com/package/google-protobuf) (`protoc-gen-js`). Results depend on hardware, Node.js version, and the message shape, so they should be treated as indicative rather than absolute.
+The repository includes a [small benchmark](./bench). It compares protobuf.js reflection and static code against JSON encode/decode, protoc-gen-js, and protoc-gen-es. Results depend on hardware, Node.js version, and message shape, so they should be treated as indicative rather than absolute.
 
-One run on an AMD Ryzen 9 9950X3D with Node.js 24.13.0 and google-protobuf 4.0.2 produced:
+One run on an AMD Ryzen 9 9950X3D with Node.js 24.15.0 produced:
 
 ```
-benchmarking encoding performance ...
-
-protobuf.js (reflect) x 2,492,315 ops/sec ±0.56% (94 runs sampled)
-protobuf.js (static) x 2,316,421 ops/sec ±0.49% (96 runs sampled)
-JSON (string) x 2,581,565 ops/sec ±0.22% (99 runs sampled)
-JSON (buffer) x 2,086,216 ops/sec ±0.68% (92 runs sampled)
-google-protobuf x 1,052,145 ops/sec ±0.24% (101 runs sampled)
-
-          JSON (string) was fastest
-  protobuf.js (reflect) was 3.8% ops/sec slower (factor 1.0)
-   protobuf.js (static) was 10.5% ops/sec slower (factor 1.1)
-          JSON (buffer) was 19.6% ops/sec slower (factor 1.2)
-        google-protobuf was 59.3% ops/sec slower (factor 2.5)
-
-benchmarking decoding performance ...
-
-protobuf.js (reflect) x 6,053,370 ops/sec ±0.25% (98 runs sampled)
-protobuf.js (static) x 6,081,190 ops/sec ±0.35% (97 runs sampled)
-JSON (string) x 1,579,677 ops/sec ±0.11% (100 runs sampled)
-JSON (buffer) x 1,383,484 ops/sec ±0.15% (98 runs sampled)
-google-protobuf x 931,575 ops/sec ±0.25% (97 runs sampled)
-
-   protobuf.js (static) was fastest
-  protobuf.js (reflect) was 0.4% ops/sec slower (factor 1.0)
-          JSON (string) was 74.0% ops/sec slower (factor 3.8)
-          JSON (buffer) was 77.2% ops/sec slower (factor 4.4)
-        google-protobuf was 84.7% ops/sec slower (factor 6.5)
-
-benchmarking combined performance ...
-
-protobuf.js (reflect) x 1,259,417 ops/sec ±0.33% (101 runs sampled)
-protobuf.js (static) x 1,296,628 ops/sec ±0.20% (98 runs sampled)
-JSON (string) x 848,422 ops/sec ±0.10% (100 runs sampled)
-JSON (buffer) x 727,866 ops/sec ±0.30% (100 runs sampled)
-google-protobuf x 477,041 ops/sec ±0.22% (101 runs sampled)
-
-   protobuf.js (static) was fastest
-  protobuf.js (reflect) was 3.0% ops/sec slower (factor 1.0)
-          JSON (string) was 34.5% ops/sec slower (factor 1.5)
-          JSON (buffer) was 43.9% ops/sec slower (factor 1.8)
-        google-protobuf was 63.2% ops/sec slower (factor 2.7)
+benchmarking encode performance ...
+
+protobuf.js reflect x 2,430,103 ops/sec ±0.62% (95 runs sampled)
+protobuf.js static x 2,390,407 ops/sec ±0.42% (96 runs sampled)
+JSON encode x 2,155,918 ops/sec ±0.63% (92 runs sampled)
+protoc-gen-js x 995,429 ops/sec ±0.18% (98 runs sampled)
+protoc-gen-es x 403,334 ops/sec ±0.14% (96 runs sampled)
+
+    protobuf.js reflect was fastest
+     protobuf.js static was 1.4% ops/sec slower (factor 1.0)
+            JSON encode was 11.3% ops/sec slower (factor 1.1)
+          protoc-gen-js was 58.9% ops/sec slower (factor 2.4)
+          protoc-gen-es was 83.3% ops/sec slower (factor 6.0)
+
+benchmarking decode performance ...
+
+protobuf.js reflect x 6,440,387 ops/sec ±0.25% (97 runs sampled)
+protobuf.js static x 6,463,283 ops/sec ±0.27% (101 runs sampled)
+JSON decode x 1,409,923 ops/sec ±0.11% (97 runs sampled)
+protoc-gen-js x 947,647 ops/sec ±0.15% (99 runs sampled)
+protoc-gen-es x 731,819 ops/sec ±0.28% (98 runs sampled)
+
+     protobuf.js static was fastest
+    protobuf.js reflect was 0.3% ops/sec slower (factor 1.0)
+            JSON decode was 78.2% ops/sec slower (factor 4.6)
+          protoc-gen-js was 85.3% ops/sec slower (factor 6.8)
+          protoc-gen-es was 88.7% ops/sec slower (factor 8.8)
+
+benchmarking round-trip performance ...
+
+protobuf.js reflect x 1,310,677 ops/sec ±0.21% (97 runs sampled)
+protobuf.js static x 1,310,926 ops/sec ±0.26% (101 runs sampled)
+JSON encode/decode x 741,714 ops/sec ±0.24% (99 runs sampled)
+protoc-gen-js x 472,844 ops/sec ±0.09% (96 runs sampled)
+protoc-gen-es x 254,044 ops/sec ±0.05% (101 runs sampled)
+
+    protobuf.js reflect was fastest
+     protobuf.js static was 0.0% ops/sec slower (factor 1.0)
+     JSON encode/decode was 43.4% ops/sec slower (factor 1.8)
+          protoc-gen-js was 63.9% ops/sec slower (factor 2.8)
+          protoc-gen-es was 80.6% ops/sec slower (factor 5.2)
 ```
 
 Run it locally with:
 
 ```sh
+npm --prefix bench install
 npm run bench
 ```
 
+## Compatibility
+
+Supported runtimes are browsers, Node.js v12+, Deno and Bun. When using the CLI with Bun, Node.js must also be installed.
+
+## Security
+
+protobuf.js favors transparent disclosure. Security-impacting reports are handled through coordinated GitHub Security Advisories where appropriate. See [SECURITY.md](./SECURITY.md) for supported release lines, reporting instructions, and notes on untrusted schema input.
+
 ## Development
 
 ```sh

package/dist/light/protobuf.js

@@ -1,6 +1,6 @@
 /*!
- * protobuf.js v8.2.0 (c) 2016, daniel wirtz
- * compiled sat, 09 may 2026 19:37:43 utc
+ * protobuf.js v8.2.1 (c) 2016, daniel wirtz
+ * compiled wed, 13 may 2026 10:17:57 utc
  * licensed under the bsd-3-clause license
  * see: https://github.com/dcodeio/protobuf.js for details
  */
@@ -149,15 +149,15 @@ converter.fromObject = function fromObject(mtype) {
     /* eslint-disable no-unexpected-multiline, block-scoped-var, no-redeclare */
     var fields = mtype.fieldsArray;
     var gen = util.codegen(["d", "q"], mtype.name + "$fromObject")
-    ("if(d instanceof this.ctor)")
+    ("if(d instanceof C)")
         ("return d")
     ("if(q===undefined)q=0")
     ("if(q>util.recursionLimit)")
         ("throw Error(\"max depth exceeded\")");
     if (!fields.length) return gen
-    ("return new this.ctor");
+    ("return new C");
     gen
-    ("var m=new this.ctor");
+    ("var m=new C");
     for (var i = 0; i < fields.length; ++i) {
         var field  = fields[i].resolve(),
             prop   = util.safeProp(field.name),
@@ -413,7 +413,7 @@ function decoder(mtype) {
     ("if(q===undefined)q=0")
     ("if(q>Reader.recursionLimit)")
         ("throw Error(\"max depth exceeded\")")
-    ("var c=l===undefined?r.len:r.pos+l,m=g||new this.ctor" + (hasMapField ? ",k,v" : hasImplicitPresenceField ? ",v" : ""))
+    ("var c=l===undefined?r.len:r.pos+l,m=g||new C" + (hasMapField ? ",k,v" : hasImplicitPresenceField ? ",v" : ""))
     ("while(r.pos<c){")
         ("var s=r.pos")
         ("var t=r.tag()")
@@ -537,7 +537,11 @@ function decoder(mtype) {
             ("case %i:{", field.id)
                 ("if(u!==%i)", types.basic[type])
                     ("break");
-            if (type === "string" || type === "bytes") gen
+            if (field.resolvedType instanceof Enum && field.typeDefault !== 0) gen
+                // TODO: Protoc rejects open enums whose first value is not zero.
+                // We should do the same, but for v8 this would be a regression.
+                ("if((v=r.%s())!==%j)", type, field.typeDefault);
+            else if (type === "string" || type === "bytes") gen
                 ("if((v=r.%s()).length)", type);
             else if (types.long[type] !== undefined) gen
                 ("if(typeof(v=r.%s())===\"object\"?v.low||v.high:v!==0)", type);
@@ -1991,7 +1995,10 @@ var Type,    // cyclic
  * @throws {TypeError} If arguments are invalid
  */
 Namespace.fromJSON = function fromJSON(name, json, depth) {
-    depth = util.checkDepth(depth);
+    if (depth === undefined)
+        depth = 0;
+    if (depth > util.recursionLimit)
+        throw Error("max depth exceeded");
     return new Namespace(name, json.options).addJSON(json.nested, depth);
 };
 
@@ -2154,7 +2161,10 @@ Namespace.prototype.toJSON = function toJSON(toJSONOptions) {
  * @returns {Namespace} `this`
  */
 Namespace.prototype.addJSON = function addJSON(nestedJson, depth) {
-    depth = util.checkDepth(depth);
+    if (depth === undefined)
+        depth = 0;
+    if (depth > util.recursionLimit)
+        throw Error("max depth exceeded");
     var ns = this;
     /* istanbul ignore else */
     if (nestedJson) {
@@ -2294,6 +2304,8 @@ Namespace.prototype.define = function define(path, json) {
         throw TypeError("illegal path");
     if (path && path.length && path[0] === "")
         throw Error("path must be relative");
+    if (path.length > util.recursionLimit)
+        throw Error("max depth exceeded");
 
     var ptr = this;
     while (path.length > 0) {
@@ -3793,7 +3805,10 @@ function Root(options) {
  * @returns {Root} Root namespace
  */
 Root.fromJSON = function fromJSON(json, root, depth) {
-    depth = util.checkDepth(depth);
+    if (depth === undefined)
+        depth = 0;
+    if (depth > util.recursionLimit)
+        throw Error("max depth exceeded");
     if (!root)
         root = new Root();
     if (json.options)
@@ -4398,7 +4413,10 @@ function Service(name, options) {
  * @throws {TypeError} If arguments are invalid
  */
 Service.fromJSON = function fromJSON(name, json, depth) {
-    depth = util.checkDepth(depth);
+    if (depth === undefined)
+        depth = 0;
+    if (depth > util.recursionLimit)
+        throw Error("max depth exceeded");
     var service = new Service(name, json.options);
     /* istanbul ignore else */
     if (json.methods)
@@ -4713,6 +4731,8 @@ Object.defineProperties(Type.prototype, {
             util.merge(ctor, Message, true);
 
             this._ctor = ctor;
+            delete this.decode;
+            delete this.fromObject;
 
             // Messages have non-enumerable default values on their prototype
             var i = 0;
@@ -4781,7 +4801,10 @@ function clearCache(type) {
  * @returns {Type} Created message type
  */
 Type.fromJSON = function fromJSON(name, json, depth) {
-    depth = util.checkDepth(depth);
+    if (depth === undefined)
+        depth = 0;
+    if (depth > util.nestingLimit)
+        throw Error("max depth exceeded");
     var type = new Type(name, json.options);
     type.extensions = json.extensions;
     type.reserved = json.reserved;
@@ -5021,7 +5044,8 @@ Type.prototype.setup = function setup() {
     this.decode = decoder(this)({
         Reader : Reader,
         types  : types,
-        util   : util
+        util   : util,
+        C      : this.ctor
     });
     this.verify = verifier(this)({
         types : types,
@@ -5029,7 +5053,8 @@ Type.prototype.setup = function setup() {
     });
     this.fromObject = converter.fromObject(this)({
         types : types,
-        util  : util
+        util  : util,
+        C     : this.ctor
     });
     this.toObject = converter.toObject(this)({
         types : types,
@@ -5404,20 +5429,6 @@ var reservedRe = util.patterns.reservedRe,
  */
 util.fs = require(31);
 
-/**
- * Checks a recursion depth.
- * @param {number|undefined} depth Depth of recursion
- * @returns {number} Depth of recursion
- * @throws {Error} If depth exceeds util.recursionLimit
- */
-util.checkDepth = function checkDepth(depth) {
-    if (depth === undefined)
-        depth = 0;
-    if (depth > util.recursionLimit)
-        throw Error("max depth exceeded");
-    return depth;
-};
-
 /**
  * Converts an object's values to an array.
  * @param {Object.<string,*>} object Object to convert
@@ -5594,6 +5605,8 @@ util.setProperty = function setProperty(dst, path, value, ifNotSet) {
         throw TypeError("path must be specified");
 
     path = path.split(".");
+    if (path.length > util.recursionLimit)
+        throw Error("max depth exceeded");
     return setProp(dst, path, value);
 };
 
@@ -6995,12 +7008,19 @@ function merge(dst, src, ifNotSet) { // used by converters
 
 util.merge = merge;
 
+/**
+ * Schema declaration nesting limit.
+ * @memberof util
+ * @type {number}
+ */
+util.nestingLimit = 32; // protoc: MaxMessageDeclarationNestingDepth
+
 /**
  * Recursion limit.
  * @memberof util
  * @type {number}
  */
-util.recursionLimit = 100;
+util.recursionLimit = 100; // protoc: CodedInputStream::default_recursion_limit_
 
 /**
  * Makes a property safe for assignment as an own property.
@@ -7382,19 +7402,7 @@ utf8.length = function utf8_length(string) {
     return len;
 };
 
-/**
- * Reads UTF8 bytes as a string.
- * @param {Uint8Array} buffer Source buffer
- * @param {number} start Source start
- * @param {number} end Source end
- * @returns {string} String read
- */
-utf8.read = function utf8_read(buffer, start, end) {
-    if (end - start < 1) {
-        return "";
-    }
-
-    var str = "";
+function utf8_read_js(buffer, start, end, str) {
     for (var i = start; i < end;) {
         var t = buffer[i++];
         if (t <= 0x7F) {
@@ -7416,6 +7424,44 @@ utf8.read = function utf8_read(buffer, start, end) {
             }
         }
     }
+    return str;
+}
+
+/**
+ * Reads UTF8 bytes as a string.
+ * @param {Uint8Array} buffer Source buffer
+ * @param {number} start Source start
+ * @param {number} end Source end
+ * @returns {string} String read
+ */
+utf8.read = function utf8_read_ascii(buffer, start, end) {
+    if (end - start < 1)
+        return "";
+
+    var str = "",
+        i = start,
+        c1, c2, c3, c4, c5, c6, c7, c8;
+
+    for (; i + 7 < end; i += 8) {
+        c1 = buffer[i];
+        c2 = buffer[i + 1];
+        c3 = buffer[i + 2];
+        c4 = buffer[i + 3];
+        c5 = buffer[i + 4];
+        c6 = buffer[i + 5];
+        c7 = buffer[i + 6];
+        c8 = buffer[i + 7];
+        if ((c1 | c2 | c3 | c4 | c5 | c6 | c7 | c8) & 0x80)
+            return utf8_read_js(buffer, i, end, str);
+        str += String.fromCharCode(c1, c2, c3, c4, c5, c6, c7, c8);
+    }
+
+    for (; i < end; ++i) {
+        c1 = buffer[i];
+        if (c1 & 0x80)
+            return utf8_read_js(buffer, i, end, str);
+        str += String.fromCharCode(c1);
+    }
 
     return str;
 };
@@ -7917,6 +7963,11 @@ function writeByte(val, buf, pos) {
     buf[pos] = val & 255;
 }
 
+function writeStringAscii(val, buf, pos) {
+    for (var i = 0; i < val.length;)
+        buf[pos++] = val.charCodeAt(i++);
+}
+
 function writeVarint32(val, buf, pos) {
     while (val > 127) {
         buf[pos++] = val & 127 | 128;
@@ -8145,7 +8196,7 @@ Writer.prototype.raw = function write_raw(value) {
 Writer.prototype.string = function write_string(value) {
     var len = utf8.length(value);
     return len
-        ? this.uint32(len)._push(utf8.write, len, value)
+        ? this.uint32(len)._push(len === value.length ? writeStringAscii : utf8.write, len, value)
         : this._push(writeByte, 1, 0);
 };
 
@@ -8300,6 +8351,11 @@ BufferWriter.prototype.raw = function write_raw_buffer(value) {
     return len ? this._push(BufferWriter.writeBytesBuffer, len, value) : this;
 };
 
+function writeStringBufferAscii(val, buf, pos) {
+    for (var i = 0; i < val.length;)
+        buf[pos++] = val.charCodeAt(i++);
+}
+
 function writeStringBuffer(val, buf, pos) {
     if (val.length < 40) // plain js is faster for short strings (probably due to redundant assertions)
         util.utf8.write(val, buf, pos);
@@ -8316,7 +8372,7 @@ BufferWriter.prototype.string = function write_string_buffer(value) {
     var len = util.Buffer.byteLength(value);
     this.uint32(len);
     if (len)
-        this._push(writeStringBuffer, len, value);
+        this._push(len === value.length && len < 40 ? writeStringBufferAscii : writeStringBuffer, len, value);
     return this;
 };