chore(deps): bump buffa from 0.9.1 to 0.9.2

[dependabot]

Bumps buffa from 0.9.1 to 0.9.2.

Release notes

Sourced from buffa's releases.

v0.9.2

What's Changed

• json: reject nonempty Any objects without @​type by @​fallintoplace in anthropics/buffa#334
• json: align extension bytes with ProtoJSON base64 parsing by @​fallintoplace in anthropics/buffa#350
• reflect: reject unknown fields in Any WKT wrappers by @​fallintoplace in anthropics/buffa#354
• extensions: keep both registry indexes consistent on replacement by @​fallintoplace in anthropics/buffa#351
• extensions: align ProtoJSON integer parsing with generated fields by @​fallintoplace in anthropics/buffa#356
• reflect: shared descriptor pool mechanism (opt-in) by @​hcrosse in anthropics/buffa#311
• bench: measure selective inline lists by @​ogarciarevett in anthropics/buffa#358
• size_cache: gate panic locations on debug_assertions by @​jlucaso1 in anthropics/buffa#366
• extension: share one decode budget across an extension's records by @​iainmcgin in anthropics/buffa#345
• fix two panics reachable from untrusted input by @​iainmcgin in anthropics/buffa#346
• descriptor: cap fully-qualified symbol names by @​iainmcgin in anthropics/buffa#347
• docs: correct two decode-limit claims that measurement contradicts by @​iainmcgin in anthropics/buffa#349
• view: apply the element-memory limit in generated decode_view by @​iainmcgin in anthropics/buffa#338
• reflect: stop to_dynamic panicking on views that decoded cleanly by @​iainmcgin in anthropics/buffa#341
• text: bound what the textproto parser materializes by @​iainmcgin in anthropics/buffa#344
• view: apply the element-memory budget to the lazy view family by @​iainmcgin in anthropics/buffa#343
• reflect: charge element memory for packed and closed-enum elements by @​iainmcgin in anthropics/buffa#342
• reflect: batch map entries during decode instead of sorted-inserting by @​iainmcgin in anthropics/buffa#348
• codegen: floor descriptor_pool()'s scaled element-memory bound at the default by @​yanmo42 in anthropics/buffa#360
• reflect: align ProtoJSON integer parsing with generated messages by @​fallintoplace in anthropics/buffa#353
• fix(codegen): qualify the core::fmt path in the generated Deserialize impl by @​harshitwandhare in anthropics/buffa#375
• reflect: honor ignore_unknown_fields for Empty by @​fallintoplace in anthropics/buffa#367
• fix: serialize oneof message pointees for JSON by @​fallintoplace in anthropics/buffa#372
• codegen: emit FILE_DESCRIPTOR_SET_BYTES as a byte-string literal by @​th0114nd in anthropics/buffa#361
• codegen: warn when a kept file references an ungenerated or unmapped type (#292) by @​rsd-darshan in anthropics/buffa#352
• buffa-build: shared_descriptor_pool with include_bytes! sidecar by @​hcrosse in anthropics/buffa#369
• codegen: wire shared_descriptor_pool through the plugins by @​hcrosse in anthropics/buffa#370
• fix(codegen): qualify generated serde paths by @​fallintoplace in anthropics/buffa#384
• build: inherit buffa dependency from workspace by @​fallintoplace in anthropics/buffa#386
• fix(reflect): compare DynamicMessage unknown fields by value by @​fallintoplace in anthropics/buffa#388
• json: preserve leading underscores in FieldMask components by @​fallintoplace in anthropics/buffa#390
• perf: avoid allocating extension registry lookup keys by @​fallintoplace in anthropics/buffa#393
• extensions: treat ProtoJSON null as unset by @​fallintoplace in anthropics/buffa#355
• view: drop OwnedView's Drop impl and store the view behind MaybeDangling by @​iainmcgin in anthropics/buffa#379
• Publish Vec length only after the wire bytes are copied by @​iainmcgin in anthropics/buffa#380
• benchmarks/history: re-measure the series 1-up and add v0.9.0 by @​iainmcgin in anthropics/buffa#328
• buffa-build: add Config::exclude_package knob by @​rsd-darshan in anthropics/buffa#383
• types: add Api, Type, and SourceContext well-known types by @​Divyansh151005 in anthropics/buffa#394
• Merge repeated message values within one map entry in view and reflective decoders by @​azdagron in anthropics/buffa#365
• reflect: bound JSON serialization nesting through google.protobuf.Any by @​azdagron in anthropics/buffa#364
• ci: run the shared-pool compile test in lint-and-test by @​iainmcgin in anthropics/buffa#374
• any: bound expansion depth when serializing nested Any by @​iainmcgin in anthropics/buffa#339
• descriptor: reject implementation-reserved field numbers by @​fallintoplace in anthropics/buffa#389
• reflect: preserve whitespace in FieldMask JSON paths by @​fallintoplace in anthropics/buffa#391
• protoc-gen-buffa: add unbox_oneof option by @​fallintoplace in anthropics/buffa#392
• reflect: shared_descriptor_pool_root — external path override for shared-pool mode by @​th0114nd in anthropics/buffa#399
• json: reject empty Any type name by @​fallintoplace in anthropics/buffa#402
• text: accept comments in signed special floats by @​fallintoplace in anthropics/buffa#404

... (truncated)

Changelog

Sourced from buffa's changelog.

[0.9.2] - 2026-09-03

A patch release, and a large one: 55 pull requests from twelve contributors, most of them closing gaps in how buffa bounds untrusted input. 0.9.0 introduced the element-memory budget for the binary decoder; an audit of everything downstream of that decoder found the same fail-open shape repeated — the view and lazy-view entry points, the reflective decoder's packed scalars and enums, the textproto parser, extension records, nested unknown groups, descriptor-pool construction, and serialization of nested google.protobuf.Any — and each is now bounded. That includes the CVE-2026-55407 follow-up reported in #357, where the extension-merge path gave every wire record its own full allowance. The two entries under Security are the stack overflow in reflective Any serialization and the map-entry parser differential between view and owned decoding. If your service decodes protobuf from the network, this is the release to take.

Regenerate your code with a version-matched buffa-codegen. Several fixes live on the generated path: decode_view now attaches the element budget, the view decoders merge split map values the way the owned decoder does, to_dynamic no longer rejects large messages the process built itself, generated enums carry #[allow(non_camel_case_types)], and generated code reaches core::fmt and serde through absolute paths so a proto package named core or serde compiles. buffa-build users pick these up on the next build; protoc-gen-buffa and buf generate users must reinstall the plugin and regenerate — code generated by 0.9.1 still builds and runs against this runtime and gets every runtime-side fix, but keeps the old view decoders until it is regenerated.

The API is additive and MSRV is unchanged at 1.75; the migration surface is behavioural. Every hardening entry turns input that was previously unbounded into a limit error, and beyond those, five changes tighten what ordinary use could previously rely on, each called out in its own entry: the textproto parser applies an element budget by default, so a very large checked-in fixture can now fail to parse until the bound is raised; DynamicMessage charges packed scalars, so a reflective decode of a columnar payload above roughly half a million elements needs with_element_memory_limit raised; DescriptorPool rejects descriptor sets that reuse a reserved name or number, place a field in the 19000–19999 band, start an open enum at a non-zero value, or alias enum values without allow_alias — protoc never emits those, so only hand-built sets are affected; PartialEq for DynamicMessage compares unknown fields, so two messages that differ only in unknown content no longer compare equal; and the ProtoJSON FieldMask helpers now round-trip a leading underscore and reject malformed path components on both codecs. One addition can break a build rather than a decode: buffa-types gains google::protobuf::Option, which shadows the prelude Option in any module that glob-imports google::protobuf::*.

Beyond the hardening: SharedCorpusContext and shared_descriptor_pool cut codegen time and duplicated descriptor bytes for workspaces that generate one crate per package; DynamicMessage::try_from_message is a fallible bridge from a generated message; buffa-types now ships the complete well-known set, so googleapis compiles; exclude_package drops packages from a buffa-build run; the plugin gains unbox_oneof and shared_descriptor_pool options; and SizeCache panic sites are gated on debug_assertions, shrinking generated compute_size.

Added

• CodeGenConfig::shared_descriptor_pool emits the reflection descriptor set once at the module-tree root instead of once per package (#311). When enabled, per-package __buffa::reflect modules delegate to a single shared __buffa_fds module; every consumer path (pkg::descriptor_pool(), pkg::FILE_DESCRIPTOR_SET_BYTES) keeps resolving as an alias, and all packages observe one DescriptorPool. Adds the encode_descriptor_set, shared_descriptor_root_module, FdsEmbedding, and CodeGenConfig::reflect_feature_gate surface that front-ends use to emit the shared module.

• shared_descriptor_pool=true plugin option on protoc-gen-buffa and protoc-gen-buffa-packaging (#370) — enables the shared descriptor pool (see CodeGenConfig::shared_descriptor_pool) on the plugin path. Set it on both plugins (same name on both, like exclude_package). Rejected together with feature overrides, feature-gating, or file_per_package, which the plugin path cannot support.

• buffa_build::Config::shared_descriptor_pool enables the shared descriptor pool from build.rs (#369). The descriptor set is written once as a binary sidecar next to the generated tree and include_bytes!-d by the shared __buffa_fds module, removing both the per-package duplication and the byte-literal source expansion. Requires reflection and .include_file(...). With a checked-in out_dir, commit the emitted *.descriptor_set.binpb sidecar alongside the generated .rs.

• DynamicMessage::decode_with_options and merge_with_options decode under caller-supplied limits (#341), mirroring DescriptorPool::decode_with_options.

• TextDecoder::with_element_memory_limit and buffa::text::decode_from_str_with_element_memory_limit raise the textproto parser bound above the default (#344), reported past the limit as the new ParseErrorKind::ElementMemoryLimitExceeded variant.

• A defaulted SingularCodec::decode_one_ctx lets repeated extension elements share one decode budget (#345). Existing implementations need no change; the default forwards to decode_one, which is correct for any codec with a fixed per-record cost. A codec whose value can materialize an unbounded subtree must override it.

• buffa_descriptor::MAX_SYMBOL_LEN and the PoolError::NameTooLong variant (#347). PoolError is #[non_exhaustive], so the variant is additive.

• generate_with_diagnostics warns when a kept file references a type from an excluded or unmapped package (#352, closes #292). generate_with_diagnostics now emits a CodeGenWarning::ExcludedPackageFieldRef when a field in a kept file references a type that is neither being generated nor covered by an extern_path. The warning precedes the consumer's build, so the dangling super::…::Type compile error is accompanied by an actionable diagnostic that names the file, message, and field where the reference appears, the missing package, and the exact extern_path or .files() fix. Detection is type-granular: references to a specific type from a partially-generated package are correctly flagged even when other types in the same package are being generated.

• buffa-build: Config::exclude_package knob (#383, closes #293). Config::exclude_package("buf.validate") (or .exclude_package(".buf.validate")) drops all .proto files in that package — and any sub-packages — from code generation. Multiple calls accumulate. The same knob is exposed as exclude_package=<pkg> in the protoc-gen-buffa plugin option string and as CodeGenConfig::exclude_packages for direct codegen users. An entry that matches no package in the input now raises CodeGenWarning::ExcludePackageMatchedNothing (a cargo:warning from buffa-build).

• protoc-gen-buffa gains unbox_oneof=true and repeatable unbox_oneof_in=<path> options (#392), the plugin equivalents of buffa_build::Config::unbox_oneof() / unbox_oneof_in(&[..]), opting non-recursive message/group oneof variants into inline storage. Paths are normalized like the other path-scoped options (leading dot optional, whitespace and trailing dots stripped); an empty path is rejected rather than treated as the blanket rule.

• buffa-types ships google.protobuf.Api, Type, Enum, and SourceContext (#394, closes #382). Codegen auto-maps the whole .google.protobuf package to buffa-types, so compiling googleapis (or any schema importing api.proto / type.proto / source_context.proto) failed with cannot find type Api / TypeView / EnumView. The three files are the rest of the official well-known set; they are vendored at protobuf v33.5 and generated next to Timestamp/Any, with binary, view, and text codecs and textproto Any expansion. They have no Serialize/Deserialize impls, so a json = true message that embeds one of them does not compile; map the type to a locally generated copy with extern_path if JSON is needed. One of the new types is google::protobuf::Option, which is not re-exported at the crate root: a module that glob-imports buffa_types::google::protobuf::* now has it shadowing the prelude Option, and Option<T> there fails with E0107 — import the types you use by name.

• SharedCorpusContext lets a workspace that generates one crate per proto package pay the corpus-wide codegen analysis once (#401, closes #400). generate() re-derives which oneof variants are unboxed, which message fields are stored inline, and the per-symbol comment map from the whole FileDescriptorSet on every call, although none of that depends on the per-package extern_paths; a ~2900-package workspace paid that walk 2900 times. Build a SharedCorpusContext::new(&files, &config) once and set CodeGenConfig::shared_corpus_context on each per-package config; the output is byte-identical, and a context built from a different corpus or different oneof/pointer-repr rules is refused with CodeGenError::SharedCorpusContextMismatch rather than silently resolving against the wrong one. The corpus comparison is structural, not by file name, so a regenerated FileDescriptorSet with edited content is refused too; it costs O(corpus) per call, measured at roughly a quarter of the name-only comparison's saving on that workspace and still well ahead of not sharing. Off by default.

• CodeGenConfig::shared_descriptor_pool_root (#399): override the computed super::-relative path to the shared __buffa_fds root in shared-pool mode (shared_descriptor_pool) with a caller-supplied path, for workspaces where one crate does not host the whole package tree as nested modules (e.g. one independent Cargo crate per proto package). None (the default) keeps the existing super::-relative behaviour — purely additive, no change to any existing consumer. Reachable only by direct buffa-codegen callers this release; buffa-build and the protoc-gen-buffa* plugins do not expose it yet.

• DynamicMessage::try_from_message: a fallible, name-resolving bridge from a generated message (#414, refs #413). Resolves the descriptor from the type's MessageName and returns a new BridgeError (MessageNotFound / MessageTooLarge / Decode, re-exported from buffa_descriptor::reflect and the crate root) instead of panicking when the pool lacks the type or the encoded bytes fail to decode against its descriptor. DynamicMessage::try_from_message_with_index is the fallible form for callers that already hold a MessageIndex; from_message now shares its decode step. The bridge uses the same encoded-length-scaled memory budgets as generated ReflectMessage::to_dynamic, so large generated messages avoid false ElementMemoryLimitExceeded failures without making the second representation unbounded.

Changed

• Two decode-limit documentation claims corrected (#349). The unknown-field count limit was described as capping overhead at roughly limit x 40 bytes; that holds for flat input only, and nested groups are now charged separately (see the Fixed entry for #349). And the Map hasher docs described the foldhash process-wide seed as mixing ASLR addresses with process start time; that holds on std, but no_std builds drop the clock and allocator entropy, and on a bare-metal target with no ASLR the seed is a link-time constant, so a colliding key set can be precomputed from the firmware image. These two corrections are documentation-only.

• SizeCache panic locations are now gated on debug_assertions, shrinking generated code (#366). Generated compute_size calls SizeCache::set once per length-delimited sub-message field, and generated write_to calls consume_next once as well, so a large schema produces hundreds to thousands of call sites for each. Both carried #[track_caller], which materializes a Location record at every one of them, and set inlined a formatted assert! panic block on top of that. The attribute is now gated on debug_assertions and set's panic joins consume_next's out of line. Measured on a ~1000-message schema linked into a 13.2 MiB binary (fat LTO, codegen-units = 1, panic = "abort", stripped): 1068 Location records removed, and 106 KiB (0.79%) off the linked binary. Both bound checks still run, with the same conditions and messages as before. What changes is that a violation reports a location inside buffa rather than in your compute_size / write_to. The gate follows the profile buffa itself was compiled with; to get caller locations back in a release build, set [profile.release.package.buffa] debug-assertions = true (which also enables buffa's other debug assertions, so treat it as a diagnostic setting).

... (truncated)

Commits

• 1f5d80e release: v0.9.2 (#424)
• 5a3f293 codegen: precompute corpus-wide context once and share across generate() call...
• 71fed8c reflect: add DynamicMessage::try_from_message and BridgeError (#414)
• 8adabe1 descriptor: reject duplicate enum numbers without aliases (#410)
• 836a39f descriptor: reject reserved enum values (#405)
• 0c617a9 descriptor: reject nonzero first value for open enums (#411)
• 32f4cea descriptor: reject message-reserved fields (#412)
• d0ee852 codegen: suppress non_camel_case_types warning on enums (#408) (#409)
• f004f70 text: accept comments in signed special floats (#404)
• dd37a9b json: reject empty Any type name (#402)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)