From 2d4442d00613fb9240f0ce5be9edbc07003a557d Mon Sep 17 00:00:00 2001 From: blakeli Date: Thu, 29 Jan 2026 18:23:29 -0500 Subject: [PATCH 1/7] chore: Add release notes for protobuf 4.x upgrade --- libraries-bom/releaseNotes.md | 38 +++++++++++++++++++++++++++++++++++ 1 file changed, 38 insertions(+) create mode 100644 libraries-bom/releaseNotes.md diff --git a/libraries-bom/releaseNotes.md b/libraries-bom/releaseNotes.md new file mode 100644 index 00000000000..4a07a2a3c14 --- /dev/null +++ b/libraries-bom/releaseNotes.md @@ -0,0 +1,38 @@ +### Upgrade Overview +The `Libraries-Bom` and its managed libraries have been upgraded to use **Protobuf v4.33.2**. All Protobuf gen code included in the managed libraries has been regenerated using `protoc v33.2`. Please note that this update necessitates a minimum Protobuf runtime of **v4.33.2**. + +--- +### ✅ Backward Compatibility +The new protobuf-java v4.33.2 runtime is fully backward-compatible with protoc gen code 3.x. You should not experience any runtime incompatibilities from using older gen code with the new runtime. +If you encounter any compatibility issues after this upgrade, please create an issue in our [GitHub repository](https://github.com/googleapis/sdk-platform-java/tree/main) or contact our support team through the [support console](https://cloud.google.com/support-hub) for assistance. + +--- +### ⚠️ Advisory: Vulnerability Warnings +After upgrading, you may see a new warning in your logs: `Vulnerable protobuf generated type in use`. +This warning does not mean the Java SDK is vulnerable. It indicates that your application, or one of its other dependencies, is still using gen code < `3.21.7`. +For a detailed explanation and mitigation steps, please refer to the official Protobuf [v4.33.0 release notes](https://github.com/protocolbuffers/protobuf/releases/tag/v33.0). + +--- + +### Known Incompatibilities & Mitigations +While rare, the following incompatibilities may occur due to the version update: + +#### 1. Runtime Version Mismatch +* **Issue:** The minimum required `protobuf-java` runtime version is now **v4.33.2**. Starting with the 4.x runtime, [validations](https://github.com/protocolbuffers/protobuf/blob/1082da2da37a0887d0cfd70abf4a00e8973cd8bf/java/core/src/main/java/com/google/protobuf/RuntimeVersion.java#L55-L73) ensure the runtime version is higher than the gen code version. +* **Symptoms:** + * `java.lang.NoClassDefFoundError: com/google/protobuf/RuntimeVersion$RuntimeDomain` (when using 3.x versions). + * `com.google.protobuf.RuntimeVersion$ProtobufRuntimeVersionException` (when using older 4.x versions). +* **Mitigation:** Upgrade `protobuf-java` to **v4.33.2**. + +#### 2. Class Hierarchy Changes (`GeneratedMessageV3`) +* **Issue:** `GeneratedMessageV3` is no longer a parent class of gen code. +* **Symptoms:** Runtime errors will occur if attempting to cast Proto 4.x gen code to `GeneratedMessageV3`. For example, `DeleteInstanceRequest` now extends [GeneratedMessage](https://github.com/googleapis/google-cloud-java/blob/d7a49aa9502012df1209b55ec741b1d4ac639361/java-compute/proto-google-cloud-compute-v1/src/main/java/com/google/cloud/compute/v1/DeleteInstanceRequest.java#L33) instead of [GeneratedMessageV3](https://github.com/googleapis/google-cloud-java/blob/1b56d017b4f93b5037f7261c488e008ac59897d8/java-compute/proto-google-cloud-compute-v1/src/main/java/com/google/cloud/compute/v1/DeleteInstanceRequest.java#L31). +* **Mitigation:** Migrate usages of `GeneratedMessageV3` to its parent interface, `Message`. + +#### 3. Descriptor Syntax APIs +* **Issue:** Certain internal methods in [Descriptors](https://github.com/protocolbuffers/protobuf/commit/1aeacd4f4eb4e0aa05d6336e2988a565e475e9a0) are no longer available. +* **Mitigation:** There are no direct alternative methods; it is suggested to stop using them. + +#### 4. Legacy Generated Code (v2.x) +* **Issue:** The 4.33.x runtime is incompatible with v2.x gen code. +* **Mitigation:** Migrate gen code to at least **v3.0.0**. Please note that 3.x support will [end in March 2027](https://protobuf.dev/support/version-support/); it is strongly recommended to upgrade gen code to 4.x. \ No newline at end of file From 008ae43af2e8e950f1e4e01cda949f0487f7678b Mon Sep 17 00:00:00 2001 From: Blake Li Date: Mon, 2 Feb 2026 13:47:58 -0500 Subject: [PATCH 2/7] Update libraries-bom/releaseNotes.md Co-authored-by: Lawrence Qiu --- libraries-bom/releaseNotes.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libraries-bom/releaseNotes.md b/libraries-bom/releaseNotes.md index 4a07a2a3c14..5efe0736414 100644 --- a/libraries-bom/releaseNotes.md +++ b/libraries-bom/releaseNotes.md @@ -35,4 +35,4 @@ While rare, the following incompatibilities may occur due to the version update: #### 4. Legacy Generated Code (v2.x) * **Issue:** The 4.33.x runtime is incompatible with v2.x gen code. -* **Mitigation:** Migrate gen code to at least **v3.0.0**. Please note that 3.x support will [end in March 2027](https://protobuf.dev/support/version-support/); it is strongly recommended to upgrade gen code to 4.x. \ No newline at end of file +* **Mitigation:** Migrate gen code to at least **v3.0.0**. Please note that 3.x support will [end in March 2027](https://protobuf.dev/support/version-support/#java); it is strongly recommended to upgrade gen code to 4.x. \ No newline at end of file From ba565d35112986625027ac8aff76414edb445c67 Mon Sep 17 00:00:00 2001 From: Blake Li Date: Mon, 2 Feb 2026 13:49:49 -0500 Subject: [PATCH 3/7] Update libraries-bom/releaseNotes.md Co-authored-by: Lawrence Qiu --- libraries-bom/releaseNotes.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libraries-bom/releaseNotes.md b/libraries-bom/releaseNotes.md index 5efe0736414..81c7d8f4235 100644 --- a/libraries-bom/releaseNotes.md +++ b/libraries-bom/releaseNotes.md @@ -10,7 +10,7 @@ If you encounter any compatibility issues after this upgrade, please create an i ### ⚠️ Advisory: Vulnerability Warnings After upgrading, you may see a new warning in your logs: `Vulnerable protobuf generated type in use`. This warning does not mean the Java SDK is vulnerable. It indicates that your application, or one of its other dependencies, is still using gen code < `3.21.7`. -For a detailed explanation and mitigation steps, please refer to the official Protobuf [v4.33.0 release notes](https://github.com/protocolbuffers/protobuf/releases/tag/v33.0). +For a detailed explanation and mitigation steps, please refer to Java section in the official Protobuf [v4.33.0 release notes](https://github.com/protocolbuffers/protobuf/releases/tag/v33.0). --- From 49bdb13d537d1b1d2aa6ab5814d67c194a9ae7b6 Mon Sep 17 00:00:00 2001 From: blakeli Date: Mon, 2 Feb 2026 15:22:07 -0500 Subject: [PATCH 4/7] Address review comments --- libraries-bom/releaseNotes.md | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/libraries-bom/releaseNotes.md b/libraries-bom/releaseNotes.md index 81c7d8f4235..91ebbf4444e 100644 --- a/libraries-bom/releaseNotes.md +++ b/libraries-bom/releaseNotes.md @@ -1,10 +1,10 @@ ### Upgrade Overview -The `Libraries-Bom` and its managed libraries have been upgraded to use **Protobuf v4.33.2**. All Protobuf gen code included in the managed libraries has been regenerated using `protoc v33.2`. Please note that this update necessitates a minimum Protobuf runtime of **v4.33.2**. +The `Libraries-Bom` and its managed libraries have been upgraded to use **Protobuf v4.33.2**. All Protobuf gen code included in the managed libraries has been regenerated using `protoc v33.2`. --- ### ✅ Backward Compatibility -The new protobuf-java v4.33.2 runtime is fully backward-compatible with protoc gen code 3.x. You should not experience any runtime incompatibilities from using older gen code with the new runtime. -If you encounter any compatibility issues after this upgrade, please create an issue in our [GitHub repository](https://github.com/googleapis/sdk-platform-java/tree/main) or contact our support team through the [support console](https://cloud.google.com/support-hub) for assistance. +The new protobuf-java v4.33.2 runtime is fully backward-compatible with protoc gen code 3.x. You should not experience any incompatibilities from using older gen code with the new runtime. +Should you experience compatibility issues, please consult the [Known Incompatibilities & Mitigations](#known-incompatibilities-mitigations). If the issue persists, please file a report via the [support console](https://cloud.google.com/support-hub) or our [GitHub repository](https://github.com/googleapis/sdk-platform-java/tree/main) --- ### ⚠️ Advisory: Vulnerability Warnings @@ -18,19 +18,20 @@ For a detailed explanation and mitigation steps, please refer to Java section in While rare, the following incompatibilities may occur due to the version update: #### 1. Runtime Version Mismatch -* **Issue:** The minimum required `protobuf-java` runtime version is now **v4.33.2**. Starting with the 4.x runtime, [validations](https://github.com/protocolbuffers/protobuf/blob/1082da2da37a0887d0cfd70abf4a00e8973cd8bf/java/core/src/main/java/com/google/protobuf/RuntimeVersion.java#L55-L73) ensure the runtime version is higher than the gen code version. +* **Issue:** The minimum required `protobuf-java` runtime version is now **v4.33.2**. Starting with the 4.x runtime, [validations](https://github.com/protocolbuffers/protobuf/blob/1082da2da37a0887d0cfd70abf4a00e8973cd8bf/java/core/src/main/java/com/google/protobuf/RuntimeVersion.java#L55-L73) ensure the runtime version is higher than the gen code version. Using a lower version of protobuf-java will produce errors below. * **Symptoms:** * `java.lang.NoClassDefFoundError: com/google/protobuf/RuntimeVersion$RuntimeDomain` (when using 3.x versions). * `com.google.protobuf.RuntimeVersion$ProtobufRuntimeVersionException` (when using older 4.x versions). -* **Mitigation:** Upgrade `protobuf-java` to **v4.33.2**. +* **Mitigation:** Upgrade the version of `protobuf-java` to be greater than or equal to **v4.33.2**. #### 2. Class Hierarchy Changes (`GeneratedMessageV3`) * **Issue:** `GeneratedMessageV3` is no longer a parent class of gen code. -* **Symptoms:** Runtime errors will occur if attempting to cast Proto 4.x gen code to `GeneratedMessageV3`. For example, `DeleteInstanceRequest` now extends [GeneratedMessage](https://github.com/googleapis/google-cloud-java/blob/d7a49aa9502012df1209b55ec741b1d4ac639361/java-compute/proto-google-cloud-compute-v1/src/main/java/com/google/cloud/compute/v1/DeleteInstanceRequest.java#L33) instead of [GeneratedMessageV3](https://github.com/googleapis/google-cloud-java/blob/1b56d017b4f93b5037f7261c488e008ac59897d8/java-compute/proto-google-cloud-compute-v1/src/main/java/com/google/cloud/compute/v1/DeleteInstanceRequest.java#L31). +* **Symptoms:** Runtime errors will occur if attempting to cast Proto 4.x gen code to `GeneratedMessageV3`. For example, `DeleteInstanceRequest` now extends [GeneratedMessage](https://github.com/googleapis/google-cloud-java/blob/d7a49aa9502012df1209b55ec741b1d4ac639361/java-compute/proto-google-cloud-compute-v1/src/main/java/com/google/cloud/compute/v1/DeleteInstanceRequest.java#L33) instead of [GeneratedMessageV3](https://github.com/googleapis/google-cloud-java/blob/1b56d017b4f93b5037f7261c488e008ac59897d8/java-compute/proto-google-cloud-compute-v1/src/main/java/com/google/cloud/compute/v1/DeleteInstanceRequest.java#L31). You will run into `java.lang.ClassCastException` when trying to run `(GeneratedMessageV3)DeleteInstanceRequest`. * **Mitigation:** Migrate usages of `GeneratedMessageV3` to its parent interface, `Message`. #### 3. Descriptor Syntax APIs * **Issue:** Certain internal methods in [Descriptors](https://github.com/protocolbuffers/protobuf/commit/1aeacd4f4eb4e0aa05d6336e2988a565e475e9a0) are no longer available. +* **Symptoms:** `java.lang.NoSuchMethodError` when calling `Syntax`, `getSyntax()`, `hasOptionalKeyword()` or `isSynthetic()`. * **Mitigation:** There are no direct alternative methods; it is suggested to stop using them. #### 4. Legacy Generated Code (v2.x) From 3744d5859792e79b87093b103c2b836fd8d1a8f8 Mon Sep 17 00:00:00 2001 From: Blake Li Date: Mon, 2 Feb 2026 17:33:57 -0500 Subject: [PATCH 5/7] Update libraries-bom/releaseNotes.md Co-authored-by: Lawrence Qiu --- libraries-bom/releaseNotes.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libraries-bom/releaseNotes.md b/libraries-bom/releaseNotes.md index 91ebbf4444e..8312a4d156a 100644 --- a/libraries-bom/releaseNotes.md +++ b/libraries-bom/releaseNotes.md @@ -10,7 +10,7 @@ Should you experience compatibility issues, please consult the [Known Incompatib ### ⚠️ Advisory: Vulnerability Warnings After upgrading, you may see a new warning in your logs: `Vulnerable protobuf generated type in use`. This warning does not mean the Java SDK is vulnerable. It indicates that your application, or one of its other dependencies, is still using gen code < `3.21.7`. -For a detailed explanation and mitigation steps, please refer to Java section in the official Protobuf [v4.33.0 release notes](https://github.com/protocolbuffers/protobuf/releases/tag/v33.0). +For a detailed explanation and mitigation steps, please refer to the Java section in the official Protobuf [v4.33.0 release notes](https://github.com/protocolbuffers/protobuf/releases/tag/v33.0). --- From 810ae6b67eb8810ea07fee21d3816d1ce1799ee5 Mon Sep 17 00:00:00 2001 From: Blake Li Date: Mon, 2 Feb 2026 17:38:02 -0500 Subject: [PATCH 6/7] Update releaseNotes.md --- libraries-bom/releaseNotes.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libraries-bom/releaseNotes.md b/libraries-bom/releaseNotes.md index 8312a4d156a..01ae0a83786 100644 --- a/libraries-bom/releaseNotes.md +++ b/libraries-bom/releaseNotes.md @@ -1,5 +1,5 @@ ### Upgrade Overview -The `Libraries-Bom` and its managed libraries have been upgraded to use **Protobuf v4.33.2**. All Protobuf gen code included in the managed libraries has been regenerated using `protoc v33.2`. +The `libraries-bom` and its managed libraries have been upgraded to use **Protobuf v4.33.2**. All Protobuf gen code included in the managed libraries has been regenerated using `protoc v33.2`. --- ### ✅ Backward Compatibility @@ -36,4 +36,4 @@ While rare, the following incompatibilities may occur due to the version update: #### 4. Legacy Generated Code (v2.x) * **Issue:** The 4.33.x runtime is incompatible with v2.x gen code. -* **Mitigation:** Migrate gen code to at least **v3.0.0**. Please note that 3.x support will [end in March 2027](https://protobuf.dev/support/version-support/#java); it is strongly recommended to upgrade gen code to 4.x. \ No newline at end of file +* **Mitigation:** Migrate gen code to at least **v3.0.0**. Please note that 3.x support will [end in March 2027](https://protobuf.dev/support/version-support/#java); it is strongly recommended to upgrade gen code to 4.x. From 2f0eae1e865b798ccce4760b180d30541be860f7 Mon Sep 17 00:00:00 2001 From: Blake Li Date: Mon, 2 Feb 2026 17:40:13 -0500 Subject: [PATCH 7/7] Update releaseNotes.md --- libraries-bom/releaseNotes.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libraries-bom/releaseNotes.md b/libraries-bom/releaseNotes.md index 01ae0a83786..a13a25fcbe3 100644 --- a/libraries-bom/releaseNotes.md +++ b/libraries-bom/releaseNotes.md @@ -18,7 +18,7 @@ For a detailed explanation and mitigation steps, please refer to the Java sectio While rare, the following incompatibilities may occur due to the version update: #### 1. Runtime Version Mismatch -* **Issue:** The minimum required `protobuf-java` runtime version is now **v4.33.2**. Starting with the 4.x runtime, [validations](https://github.com/protocolbuffers/protobuf/blob/1082da2da37a0887d0cfd70abf4a00e8973cd8bf/java/core/src/main/java/com/google/protobuf/RuntimeVersion.java#L55-L73) ensure the runtime version is higher than the gen code version. Using a lower version of protobuf-java will produce errors below. +* **Issue:** The minimum required `protobuf-java` runtime version is now **v4.33.2**. Starting with the 4.x runtime, [validations](https://github.com/protocolbuffers/protobuf/blob/1082da2da37a0887d0cfd70abf4a00e8973cd8bf/java/core/src/main/java/com/google/protobuf/RuntimeVersion.java#L55-L73) ensure the runtime version is higher than or equal to the gen code version. Using a lower version of protobuf-java will produce errors below. * **Symptoms:** * `java.lang.NoClassDefFoundError: com/google/protobuf/RuntimeVersion$RuntimeDomain` (when using 3.x versions). * `com.google.protobuf.RuntimeVersion$ProtobufRuntimeVersionException` (when using older 4.x versions).