release: v0.9.0

[iainmcgin]

Cuts v0.9.0: workspace version bump plus the 44 unreleased changelog fragments rolled into CHANGELOG.md.

Scope

53 merged PRs since v0.8.0, in four themes:

• Resource bounds — encode enforces the 2 GiB protobuf limit (encode: enforce the protobuf 2 GiB message-size limit #271), decode bounds materialized element memory (decode: bound the memory repeated elements and map entries materialize #319), closed-enum unknowns charge the allowance they were bypassing (codegen: enforce closed-enum unknown-field limits #313, reflect: preserve closed enum unknowns #304), and try_encode_bounded lets a caller express their own budget in one size pass (Add try_encode_bounded: budget-checked single-pass encode entry points #320).
• Performance — singular message fields inline by default (codegen: store singular message fields inline by default (PointerRepr::Inline) (#248) #250), bulk packed decode (decode: bulk path for packed fixed-width payloads #314, decode: slice-specialized loop for packed plain-varint payloads #315), cross-crate view inlining restored (codegen: inline view field decoding #312), Tag::new and varint inlining (encoding: add #[inline] to Tag::new #259, encoding: force-inline varint decode in packed element loops #265), smoothutf8 0.2.3 (deps: bump smoothutf8 to 0.2.3 #246).
• Reflection — cross-pool adoption (reflect: adopt message values from another descriptor pool on set #308), validate-before-mutate (Validate DynamicMessage values before set #272), transactional pool (descriptor: make add_file_descriptor_set transactional #253), field-identity and symbol validation (descriptor: reject ambiguous field identities #300, descriptor: validate service and method symbols #302).
• New surface — buffa-remote-derive (Add buffa-remote-derive: ProtoString/ProtoBytes/ProtoList/ProtoBox/MapStorage for remote types #251), override_feature_in (codegen: path-scoped editions feature overrides (override_feature_in), first entry enum_type:OPEN #291), exclude_package (feat(codegen): add exclude_package to drop option-only imports #279), the jiff feature (buffa-types: add jiff feature (Timestamp/Duration conversions) #264), EncodeSink/Rope (encode: vectored (rope) output via an EncodeSink abstraction #284), package-root FILE_DESCRIPTOR_SET_BYTES (codegen: root re-export of FILE_DESCRIPTOR_SET_BYTES, strip source_code_info #286).

Four breaking changes, all on the trait surface or generated-code shape: WirePayload opaque, inline message fields, infallible OwnedView::to_owned_message, u64 size helpers. MSRV unchanged at 1.75.

Notes on the prep

Four crates pinned buffa by literal version rather than through the workspace table — buffa-codegen, buffa-build, protoc-gen-buffa, protoc-gen-buffa-packaging. Bumping the root manifest alone left them on ^0.8.0, which does not resolve against a 0.9.0 workspace; the local CI-parity run failed on it before CI saw it. Left unfixed, this would have published the tooling depending on the previous runtime. Worth converting these to workspace = true in a follow-up so the next bump cannot repeat it.

v0.8.1 is not an ancestor of main — it shipped from the v0.8.x maintenance branch, so git describe on main reports v0.8.0. I checked whether 0.9.0 would regress it: it does not. v0.8.1 was a single release commit, and its fix (#266, 6ac87ed) reached main independently and is documented in main's [0.8.1] section. 0.9.0 is a strict superset.

Fragment audit. 44 fragments cover every user-visible merged PR. The ones without a fragment are CI (#230, #245, #288, #296), benchmarks (#243, #258, #318), and work already released in 0.8.1 (#252, #266) — none warrant release notes.

Verification

• CI-parity locally per the pre-release checklist: cargo clippy --workspace --all-targets --all-features -- -D warnings, cargo test --workspace --all-features (48 suites), RUSTDOCFLAGS="-D warnings" cargo doc --workspace --all-features --no-deps, cargo fmt --all --check, task lint-md — all clean.
• task changelog-merge is idempotent, so check-changelog should pass.
• The intro's claims are checked against the data rather than recalled: exactly 4 breaking bullets batched; column_batch/decode −24.664% is from the metal run's criterion output; the view range is −7% to −32% across seven of eight benchmarks, the eighth being a dataset the change cannot touch.

Post-merge

Tag v0.9.0 on the merge commit → the tag-triggered publish workflow ships all crates.

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[iainmcgin]

[claude code] Pushed 479c357 after a review pass over the prose. Four corrections, two of them substantive:

The intro counted four breaking changes; there are five. The encoders taking &mut impl EncodeSink instead of &mut impl BufMut (#284) labels itself Breaking: but was filed under Changed — so counting the Breaking section, which is exactly how I checked the number, could not see it. Moved into Breaking changes and the count corrected. Someone porting a hand-written ViewEncode impl would have trusted the list of four and met a compile error.

The performance figures claimed more than the measurements support. I had written -24.66% — four significant figures against the ±5% reproducibility floor that benchmarks/history/README.md documents. The deltas are real and clear the floor comfortably, but the precision was fiction; they now state the effect and name the floor. Same for the view range, whose -7% end sat inside the band that document calls noise.

Also: the intro described the plain-varint path as a bulk pass, which its own entry contradicts (fixed-width decodes in one call; varint hoists the per-element dispatch out of a loop that remains), and the two migration guides still told new users to depend on 0.7. Only the buffa pins moved there — the neighbouring pbjson = "0.7" lines quote prost's real version and are untouched.

Marking ready. Post-merge: tag v0.9.0 on the merge commit and the tag-triggered workflow publishes.