protobuf.js is a standalone JavaScript and TypeScript implementation of Protocol Buffers for Node.js and the browser. It helps you work with .proto files, serialize and deserialize structured data with efficient binary I/O, and supports runtime reflection as well as reflection-free static code generation with TypeScript declarations.
Project status
- Actively maintained: Recent upstream pushes are very recent (last upstream push 2026-07-07), with multiple updates to
protobufjs,protobufjs-cli, and@protobufjs/utf8across the past week. - Update cadence: Appears fast and ongoing, with several
protobufjsupdates in July 2026 (for example 8.6.4 on 2026-06-16, then 8.6.5 on 2026-06-23, 8.6.6 and 8.6.5 updates around 2026-07-04, and 8.7.0 on 2026-07-06), plus matching CLI dependency-aligned updates.
AI summary generated
Recent updates
protobufjs-v8.7.0
protobufjs v8.7.0 focuses on encoder improvements, including a reworked encoder architecture and additional fast paths to speed up serialization. It also includes several bug fixes related to JSON name handling and more robust declaration parsing/code generation.
protobufjs-cli-v2.6.0
protobufjs-cli v2.6.0 is primarily a dependency-aligned release: it picks up protobufjs 8.7.0 and includes a noted encoder rework with additional fast paths. The release notes do not call out any CLI-specific behavior changes beyond the protobufjs version update.
Featuresutf8-v1.1.2
Release notes for utf8 v1.1.2 document only a performance improvement: batching String.fromCharCode calls in @protobufjs/utf8.read. However, the actual diff includes broader protobufjs hardening changes (recursion depth limits, prototype pollution protections, stricter descriptor/UTF-8 validation, and removal of @protobufjs/inquire from the fetch implementation).
BreakingSecurityprotobufjs-v7.6.5
protobufjs v7.6.5 is released with a documented fix for handling EOF during options parsing. However, the code diff for this release includes several additional hardening and behavior changes that are not mentioned in the release notes, including recursion depth enforcement and prototype-pollution related defenses.
protobufjs-v8.6.6
protobufjs v8.6.6 ships two documented bug fixes: filtering Any type_url lookups to message types, and handling EOF during options parsing. The code diff for this release, however, also includes substantial undocumented changes in the CLI documentation/type generation tooling (tsd-jsdoc) that can affect generated TypeScript definition output and execution timing.
protobufjs-cli-v2.5.7
protobufjs-cli 2.5.7 mainly bumps its protobufjs dependency to 8.6.6 and updates related lockfile metadata. The code diff also shows behavioral changes in protobufjs itself, even though the cli release notes only document the dependency bump.
protobufjs-v8.6.5
protobufjs v8.6.5 contains several targeted bug fixes focused on correctness of enum handling and encoding behavior. It also improves safety around object property access by adopting hardened prototype and own-property semantics, which can affect how maps and prototype-related edge cases behave.
BreakingSecurityprotobufjs-cli-v2.5.6
protobufjs-cli v2.5.6 includes fixes related to enum open/closed semantics and several hardening changes to avoid prototype-related edge cases. The CLI also bumps its peer and workspace dependency on protobufjs to 8.6.5, which drives additional behavioral changes in encoding and decoding.
protobufjs-v8.6.4
protobufjs v8.6.4 is a maintenance release focused on bug fixes. It improves ProtoJSON handling for well-known types and adds compatibility for environments where ICU is not available.
protobufjs-cli-v2.5.5
protobufjs-cli v2.5.5 release notes only document a dependency bump of protobufjs to 8.6.4 (workspace and peer dependency). The actual code diff for this release includes substantial CLI changes around JSDoc-based type parsing and publishing, plus new exported typings/APIs for pbts and protoc-gen-pbjs.
BreakingFeaturesprotobufjs-v7.6.4
protobufjs v7.6.4 includes CI-related changes and removes the bundled @protobufjs/inquire submodule, with some additional internal fixes. The code diff also reveals multiple runtime behavior and API surface changes around recursion depth handling, stricter object/type validation, and prototype-pollution hardening, none of which are described in the release notes.
BreakingSecurityFeaturesprotobufjs-v8.6.3
protobufjs v8.6.3 focuses on correctness fixes and adds compatibility options for modern Node module loading and stricter UTF-8 handling during decoding. The most user-relevant changes affect varint parsing robustness, path/url resolution behavior, and decoder options.
Featuresprotobufjs-cli-v2.5.4
protobufjs-cli v2.5.4 is primarily a dependency update, bumping protobufjs (and the peerDependency) from 8.6.2 to 8.6.3. However, the underlying protobufjs code change includes multiple runtime behavior modifications (UTF-8 verification, stricter varint truncation handling, and URL-aware path resolution) that are not described in the cli release notes.
protobufjs-v8.6.2
protobufjs v8.6.2 release notes document a single bug fix: unknown protobuf fields are discarded by default during decoding. The provided code diff shows multiple substantial CLI and documentation-generation related changes that are not mentioned in the 8.6.2 release notes.
Breakingprotobufjs-cli-v2.5.3
protobufjs-cli v2.5.3 primarily updates the bundled protobufjs dependency to v8.6.2 and includes a protobuf behavior change around unknown fields. While the release notes only document the unknown-fields default, the code diff shows substantial internal CLI changes related to pbts/JSDoc type parsing and tsd-jsdoc publishing behavior.
Breakingprotobufjs-v7.6.3
The protobufjs v7.6.3 release notes claim only two small bug fixes related to generated-name collisions and null conversion for fieldless messages. However, the actual diff shows substantial internal changes across parsing, reflection/deep recursion handling, encoding/decoding, code generation, and multiple security hardening areas (prototype pollution, special-event names, UTF-8 validation).
BreakingSecurityprotobufjs-cli-v1.3.3
protobufjs-cli v1.3.3 includes a fix intended to avoid name collisions in generated code, plus a wider set of defensive hardening changes across the protobufjs runtime. The diff shows added recursion depth tracking/limits and multiple prototype pollution protections, along with stricter descriptor and UTF-8 validation behavior changes that are not mentioned in the release notes.
Securityprotobufjs-v8.6.1
protobufjs v8.6.1 focuses on CLI-related fixes. The release improves the reliability of the CLI’s pbts and JSDoc generation steps, preserves formatting/descriptor metadata needed for protoc-gen-pbjs, and removes the inquire submodule.
protobufjs-cli-v2.5.2
protobufjs-cli v2.5.2 ships CLI fixes around JSDoc publishing and descriptor metadata handling for code generation. It also bumps protobufjs to 8.6.1 (peer dependency), bringing in descriptor import/context support and related behavior changes.
protobufjs-v8.6.0
protobufjs v8.6.0 adds a spec-compliant protojson extension, improving JSON interoperability for generated or loaded protobuf schemas. The release also includes several bug fixes around code generation stability and converter input handling, plus a change that removes the package postinstall script.
BreakingFeatures