chore(deps): update dependency protobuf to v36

[cgrindel-self-hosted-renovate]

This PR contains the following updates:

Package	Type	Update	Change
protobuf	bazel_dep	major	35.1 → 36.2

---

Release Notes

protocolbuffers/protobuf (protobuf)

v36.2: Protocol Buffers v36.2

Announcements

• Protobuf News may include additional announcements or pre-announcements for upcoming changes.

Compiler

• Detects single-crate cross-file symbol collisions and conditionally emits crate-root re-exports. (3078015)
• Prepend the file module name to Rust type paths to use canonical paths. (7390c85)
• Expose generated per-file Rust proto modules as public. (7ed8a4b)

Csharp

• Regenerate stale files. (57ef94f)

Rust

• Update README to note that the protobuf crate is superseded by google-protobuf. (8b6311f)
• Add README.md to google-protobuf-codegen release crate (10b8b5e)
• Detects single-crate cross-file symbol collisions and conditionally emits crate-root re-exports. (3078015)
• Prepend the file module name to Rust type paths to use canonical paths. (7390c85)
• Expose generated per-file Rust proto modules as public. (7ed8a4b)
• Remove iterator trait implementations for RepeatedMutIter (7aca0ec)
• Enable inherent next() and next_back() API for RepeatedMutIter besides trait implementation. (2198c6b)
• See also UPB changes below, which may affect Rust.

UPB (Python/PHP/Ruby C-Extension)

• Include .c files in the source_files glob in upb/port/BUILD (7ff0f88)

v36.1: Protocol Buffers v36.1

Announcements

• Protobuf News may include additional announcements or pre-announcements for upcoming changes.

Csharp

• Allow later enum aliases to overwrite in C# custom JSON enum mapping. (cc7e6bd)

Rust

• Update README files for each crate. (e64a176)
• Include runtime version details in assertion error messages. (fecb404)
• Drop special treatment of rust versions below 4.33. (1312f3b)
• Invert the relationship between rust crates (fbf3069)

Python

• Optimize pure Python parse path for custom JSON enum names. (333846a)
• Additional unit tests for Python handling of custom JSON enum names. (210324c)

v36.0: Protocol Buffers v36.0

Announcements

• Protobuf News may include additional announcements or pre-announcements for upcoming changes.
• Migration Guide may include additional guidance for breaking changes.

Bazel

• Add Bazel9 test (90ad7e9)
• Bazel 9 tests for csharp, hpb, objc, php, python, rust and upb (f9e028f)

Compiler

• Make default_symbol_visibility STRICT in edition 2026 (fcd68c5)
• Add deprecation warnings for (py|cc|java)_generic_service. (517be42)
• Disallow reserving field number INT_MAX. (933c522)
• Add bazel targets for standalone plugin binaries (#​23919) (81880fa)
• Feat: --<lang>_prefix cli option (#​24824) (92dd27c)
• Enforce proto limits in the descriptor by default for EDITION_2026. (d8520d9)
• Fix: Apply path traversal guard to WriteAllToZip() matching WriteAllToDisk() (#​27171) (28bef98)
• Add an enforce_proto_limits feature which will be implemented in Edition 2026. (5ddd524)

C++

• Disable option sub-location mapping in open-source builds. (1d8a656)
• Add json_options.proto and json_enumvalue_options.proto and/or gencode derived from them to release artifacts (15e9334)
• Add deprecation warning for Reflection::GetEnum() and Reflection::GetRepeatedEnum(). (0bca288)
• Migrate top-level protobuf unittest protos from Edition 2024 to Edition 2026. (271ca53)
• Util: validate Duration/Timestamp in TimeUtil::FromString against spec limits (#​27443) (e337495)
• Make default_symbol_visibility STRICT in edition 2026 (fcd68c5)
• Use the direct map reflection API when converting message to JSON, if the repeated field reflection is not valid. (e75aac3)
• Add bazel targets for standalone plugin binaries (#​23919) (81880fa)
• Fix(cpp): stop TextFormat iteration if output stream fails (#​26237) (2718dd5)
• Enforce proto limits in the descriptor by default for EDITION_2026. (d8520d9)
• Add an enforce_proto_limits feature which will be implemented in Edition 2026. (5ddd524)
• Workaround for attribute handling bug in gcc < 13 (ba10a4e)
• Fix confusing error message for map value type name conflicts (7864b85)
• C++Proto JSON: Align behavior on the type.proto path with the descriptor.proto path (0bc1f14)

Java

With this release JavaProto no longer uses sun.misc.Unsafe as long as you are utilizing the standard generated code. You should no longer see warnings printed about sun.misc.Unsafe. If you see any issues, please let us know on #​20760

Note that the runtime itself still contains references to sun.misc.Unsafe in paths which are exclusively to support Lite generated code. Lite is emitted by a separate code generator which creates generated code optimized for mobile clientside contexts, especially alongside R8 optimizations. Android does not have a timeline to removing sun.misc.Unsafe, and we have found the performance regression too significant to consider removing these paths at this time. It is still TBD for how we can best navigate this mobile vs JVM split on this topic.

• Add json_options.proto and json_enumvalue_options.proto and/or gencode derived from them to release artifacts (15e9334)
• Json/java: add json_name enumval support (bff6ed1)
• Make Timestamps.parse() attempt non-lenient parsing first and warning if this fails. (d5e039a)
• Add a warning for potential OneofDescriptor collisions prior to Q1 2027 breaking changes. (ab69831)
• Make default_symbol_visibility STRICT in edition 2026 (fcd68c5)
• Reject negative size in mergeDelimitedFrom (#​28097) (c56cd5b)
• Add deprecation warnings for (py|cc|java)_generic_service. (517be42)
• Update Java protobuf generator to use Objects.requireNonNull (31ef11c)
• Use natural String comparison instead of UTF-8 ByteString comparison for sorting map keys in JsonFormat. (ae1faee)
• Add option to enable strict JSON parsing in Protobuf Java JsonFormat. (40825a1)
• Add bazel targets for standalone plugin binaries (#​23919) (81880fa)
• Remove experimental FieldOrder enum. (ec52338)
• Optimize GeneratedMessage.ExtendableBuilder to avoid temporary allocations when merging empty extendable messages. (a37dbd6)
• Stop using sun.misc.Unsafe in isValidUtf8 paths. (421d745)
• Use String#encodedLength on JDK versions that support it (efca121)
• Add an enforce_proto_limits feature which will be implemented in Edition 2026. (5ddd524)
• Java: limit numeric string length before BigDecimal parsing (#​26908) (25e7005)
• Validate java package and class against injection risks. (f8514d8)

Csharp

• Cache custom JSON enum names in JsonParser using Lazy. (156d42d)
• Csharp: add support for custom json strings for enum values (f11aac4)
• Validate language-specific namespace options in code generators (#​28667) (34e959b)
• Make default_symbol_visibility STRICT in edition 2026 (fcd68c5)
• Advertise that C# supports Edition 2026, and move C# Nullable Reference Type support into that edition. (a1f718c)
• First implementation of C# nullable reference types enablement using the current (unreleased) edition. (7a732d1)
• Add bazel targets for standalone plugin binaries (#​23919) (81880fa)
• Csharp: propagate recursion depth into JsonReplayTokenizer to honor Any nesting limit (#​26835) (cee45bf)
• Fix csharp string interpolation in Timestamp.ToDateTime() exception message (#​26341) (a298282)

Objective-C

• [ObjC] Carry recursion depth across MessageSet item parsing (#​27571) (f89baed)
• Add bazel targets for standalone plugin binaries (#​23919) (81880fa)
• [ObjC] Add DEBUG-only validations to extension values in GPBMessage, along with tests. (290a537)

Rust

• Re-export to google-protobuf crate in 0.x.y for 36.0 and above (96e772f)
• Remove -release suffix from Rust Crates.io release if minor version >= 36 (e7b3391)
• Add bazel targets for standalone plugin binaries (#​23919) (81880fa)
• RustProto: Add the ability to iterate over the muts of a repeated message-typed field. (70590a5)
• See also UPB changes below, which may affect Rust.

Python

• Add json_options.proto and json_enumvalue_options.proto and/or gencode derived from them to release artifacts (15e9334)
• Emit future warning when mutating GetOptions() in OSS (2255541)
• Emit deprecation warning when comparing descriptor containers with unrecognized types in OSS (5865e6b)
• Migrate top-level protobuf unittest protos from Edition 2024 to Edition 2026. (271ca53)
• Configure extra compile args in setup.py (#​28264) (3aa022a)
• Python: fix heap-use-after-free in MapIterator after map.clear() (#​27257) (9e9dbae)
• Add PyDescriptorPool_FromSharedPool(std::shared_ptr) API (abdf212)
• Fix memory leak in PyUpb_Descriptor_GetExtensionRanges (3d31b0f)
• Warn on out-of-range pop index in upb repeated fields. (a70d121)
• Support assigning repeated scalar fields using Python Buffer API. (ea40f1d)
• Fix Pure Python map<string, ...> key handling for bytes lookups. (156a0b8)
• Change Python DescriptorDatabase FindFileContainingSymbol() to accept leading "." to match DescriptorPool and other languages (e86e536)
• Faster Python cpp protos assignment to bytes/string fields. (593ab17)
• Serialize length-prefixed protos once (#​27252) (e090f8a)
• [py/upb] Make GetOptions() return immutable options for scalar type. UPB will raise a TypeError when options returned GetOptions() by is mutated. (403d429)
• Add bazel targets for standalone plugin binaries (#​23919) (81880fa)
• Add mutex protection to DescriptorPool caches. (cecbbf4)
• Refactor container comparison function in py/C++ and py/upb to return enum instead of integer. (c857f49)
• Py JSON: Fix issue with depth enforcement on Struct/Value WKT paths. (cfcc433)
• Fix RepeatedContainer_pop to raise IndexError for out-of-bounds indices. (78a09ad)

PHP

• Support custom JSON enum names in PHP (49b3b18)
• Remove total_bytes_limit from pure PHP CodedInputStream. (e171c67)
• Validate language-specific namespace options in code generators (#​28667) (34e959b)
• Fix PHP update_reserved_words.sh formatting and CI idempotency test (eff2323)
• Feat(php): script for updating php reserved words (#​27456) (47c8651)
• [PHP] - Add configurable recursion_limit to mergeFromString / serializeToString (#​27874) (5c5ee3c)
• Add bazel targets for standalone plugin binaries (#​23919) (81880fa)
• Clarify FieldMask JSON warnings/errors in the situation of fields which aren't round-trip representable in JSON format. (0488596)
• Add an enforce_proto_limits feature which will be implemented in Edition 2026. (5ddd524)

PHP C-Extension

• Support custom JSON enum names in PHP (49b3b18)
• Feat(php): script for updating php reserved words (#​27456) (47c8651)
• [PHP] - Add configurable recursion_limit to mergeFromString / serializeToString (#​27874) (5c5ee3c)
• See also UPB changes below, which may affect PHP C-Extension.

Ruby

• Validate language-specific namespace options in code generators (#​28667) (34e959b)
• Drop support for Ruby 3.1 (7008dd1)
• Add bazel targets for standalone plugin binaries (#​23919) (81880fa)

UPB (Python/PHP/Ruby C-Extension)

• Json/upb: Implement json EnumValueName for upb (0e8519e)
• Avoid UB in upb by switching to the XCT section, which will run our constructors before the compiler-generated initializers. (58e5ac8)
• [py/upb] Make GetOptions() return immutable options for scalar type. UPB will raise a TypeError when options returned GetOptions() by is mutated. (403d429)
• Clarify FieldMask JSON warnings/errors in the situation of fields which aren't round-trip representable in JSON format. (0488596)
• Add Bazel9 test (90ad7e9)
• Fixed two GCC-only issues around upb's generated extension registry. (d56b385)
• Fix RepeatedContainer_pop to raise IndexError for out-of-bounds indices. (78a09ad)

Other

• Fix typo in legacy_rust (daf4964)
• Add JSON and CPP option protos to C++ toolchain blacklisted_protos (c4846de)
• Remove fallback behavior (2d3c0d3)
• Add deprecation warning for internal_py_proto_library prior to Q1 2027 breaking changes. (a8d0be3)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[cgrindel-self-hosted-renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

[cgrindel]

@Mergifyio queue

[mergify]

Merge Queue Status

• 🟠 Waiting for queue conditions
• ⏳ Enter queue
• ⏳ Run checks
• ⏳ Merge

Waiting for

• github-review-approved [🛡 GitHub branch protection]

All conditions

• any of [🔀 queue conditions]:
  • all of [📌 queue conditions of queue rule default]:
    • github-review-approved [🛡 GitHub branch protection]
    • #review-threads-unresolved = 0 [🛡 GitHub branch protection]
    • check-success=all_ci_tests
    • check-success=conventional_commit_check
    • any of [🛡 GitHub branch protection]:
      • check-success = all_ci_tests
      • check-neutral = all_ci_tests
      • check-skipped = all_ci_tests
    • any of [🛡 GitHub branch protection]:
      • check-success = conventional_commit_check
      • check-neutral = conventional_commit_check
      • check-skipped = conventional_commit_check
• -closed [📌 queue requirement]
• -conflict [📌 queue requirement]
• -draft [📌 queue requirement]
• any of [📌 queue -> configuration change requirements]:
  • -mergify-configuration-changed
  • check-success = @mergify/Configuration changed
  • check-success = @mergify/Configuration has been deleted

[cgrindel]

Blocked on an upstream bug: protobuf 36.0 ships the wrong protoc checksums for macOS.

The only real failure is //examples:grpc_example_test_bazel_.bazelversion on macos-15 — all_ci_tests just reports that job.

Error downloading protoc-36.0-osx-aarch_64.zip:
Checksum was b6bc4afdcb880124bf342851d05155b6e3d9b6e661236d87b9c614250d26ae00
but wanted 726141c541c84a01cdc501ae6c0c845d2dda26414ccf42e641ed096e7491344f

Claude checked this against the actual release artifacts. protobuf-36.0.bazel.tar.gz (the archive BCR pulls) contains bazel/private/oss/toolchains/prebuilt/tool_integrity.bzl with hashes hardcoded at release time. Both macOS entries are wrong; Linux and Windows are correct:

Artifact	Recorded in 36.0	Actual on GitHub	Match
protoc-36.0-osx-aarch_64.zip	726141c5…	b6bc4afd…	no
protoc-36.0-osx-x86_64.zip	98c3ebfc…	2847d952…	no
protoc-36.0-linux-x86_64.zip	bc8211ce…	bc8211ce…	yes
protoc-36.0-win64.zip	510fb236…	510fb236…	yes

The release assets were never re-uploaded after publication (every updated_at is 2026-08-20T13:27:2*Z), so this is a bad hash baked in by protobuf's release prep — the macOS binaries were evidently rebuilt after the hashes were computed. Only the mac runners hit it, which is why a single macOS integration job fails.

Nothing in this repo can work around it. It needs a protobuf 36.0.x release or a BCR 36.0.bcr.1 patch correcting tool_integrity.bzl. Neither exists yet, and there is no issue filed for it in protocolbuffers/protobuf or bazelbuild/bazel-central-registry.

Holding this PR until then. Note that BCR also has protobuf 35.1, which is an unblocked intermediate step off 35.0 if we want one.