Skip to content

v1.19.0

Latest
Latest

Choose a tag to compare

View all tags
@jhump jhump released this 05 Oct 19:16
· 1 commit to v1 since this release
v1.19.0
bc7afd9
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

This point release addresses a potential issue identified here: GHSA-mm34-2v69-6vg6

"github.com/jhump/protoreflect/dynamic"

Changes/fixes:

  • Address potential stack overflow fatal errors in dynamic.Message, when unmarshaling untrusted input or when marshaling a message that contains a reference cycle. A mitigation has been added for all three formats: binary, text, and json.
  • Fixed a bug that prevented the convert and merge methods (for converting to/from other message implementations) from working correctly with *dynamicpb.Message (the dynamic message implementation added to the core runtime in API v2).

Additions:

  • Adds new ToDynamicPB method to dynamic.Message, to aid with users migrating to API v2 and to work around interop issues with API v2's prototext and protojson packages.
Assets 2
Loading