Roll protobuf to v30.1

This includes rolling cast_core and chromeos/assistant/internal as well

NO_IFTTT=upstream changes

Binary-Size: Size increase is unavoidable. Andrew said the excess for the arm64 might be a false positive
Compile-Size: Size increase is unavoidable. Nico said it was small enough to not block
Bug: 397699183
Change-Id: I92895bebacb2bc64a23647f7092f4bbc187e6cc2
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6363254
Commit-Queue: Sophie Chang <sophiechang@chromium.org>
Reviewed-by: Alex Ilin <alexilin@chromium.org>
Reviewed-by: Andrew Grieve <agrieve@chromium.org>
Reviewed-by: Yuki Awano <yawano@google.com>
Cr-Commit-Position: refs/heads/main@{#1438220}

.vpython3

@@ -43,7 +43,7 @@ verify_pep425_tag: [
 #   //tools/perf/crossbench
 wheel: <
   name: "infra/python/wheels/protobuf-py3"
-  version: "version:5.29.3"
+  version: "version:6.30.1"
 >
 
 # TODO(https://crbug.com/898348): Add in necessary wheels as Python3 versions
@@ -223,11 +223,11 @@ wheel: <
 >
 wheel: <
   name: "infra/python/wheels/googleapis-common-protos-py2_py3"
-  version: "version:1.66.0"
+  version: "version:1.69.2"
 >
 wheel: <
   name: "infra/python/wheels/google-api-core-py3"
-  version: "version:2.24.0"
+  version: "version:2.24.2"
 >
 wheel: <
   name: "infra/python/wheels/google-auth-httplib2-py2_py3"
@@ -270,7 +270,7 @@ wheel: <
 
 wheel: <
   name: "infra/python/wheels/proto-plus-py3"
-  version: "version:1.26.0"
+  version: "version:1.26.1"
 >
 
 wheel: <
@@ -657,7 +657,7 @@ wheel: <
 >
 wheel: <
   name: "infra/python/wheels/google-cloud-bigquery-storage-py3"
-  version: "version:2.27.0"
+  version: "version:2.29.1"
 >
 wheel: <
   name: "infra/python/wheels/google-crc32c/${vpython_platform}"

DEPS

@@ -1917,7 +1917,7 @@ deps = {
     Var('chromium_git') + '/breakpad/breakpad.git' + '@' + Var('breakpad_revision'),
 
   'src/third_party/cast_core/public/src':
-    Var('chromium_git') + '/cast_core/public' + '@' + 'dcb3d2e87cebe20b6dda06d8b29abb9af27ca422',
+    Var('chromium_git') + '/cast_core/public' + '@' + 'f5ee589bdaea60418f670fa176be15ccb9a34942',
 
   'src/third_party/catapult':
     Var('chromium_git') + '/catapult.git' + '@' + Var('catapult_revision'),
@@ -4367,7 +4367,7 @@ deps = {
 
   'src/chromeos/assistant/internal': {
       'url': Var('chrome_git') + '/chrome/assistant.git' + '@' +
-        '202ca42ffe028067860400b174637ff004094a34',
+        '7333fc7271a9c673862fcc3b5fd5d054d2e2ab30',
       'condition': 'checkout_src_internal and checkout_chromeos',
     },
 

build/config/android/internal_rules.gni

@@ -2246,7 +2246,6 @@ if (enable_java_templates) {
       "//third_party/protobuf/python/google/protobuf/descriptor_pb2.py",
       "//third_party/protobuf/python/google/protobuf/descriptor_pool.py",
       "//third_party/protobuf/python/google/protobuf/internal/__init__.py",
-      "//third_party/protobuf/python/google/protobuf/internal/_parameterized.py",
       "//third_party/protobuf/python/google/protobuf/internal/api_implementation.py",
       "//third_party/protobuf/python/google/protobuf/internal/builder.py",
       "//third_party/protobuf/python/google/protobuf/internal/containers.py",
@@ -2290,7 +2289,6 @@ if (enable_java_templates) {
       "//third_party/protobuf/python/google/protobuf/pyext/cpp_message.py",
       "//third_party/protobuf/python/google/protobuf/reflection.py",
       "//third_party/protobuf/python/google/protobuf/runtime_version.py",
-      "//third_party/protobuf/python/google/protobuf/service.py",
       "//third_party/protobuf/python/google/protobuf/service_reflection.py",
       "//third_party/protobuf/python/google/protobuf/symbol_database.py",
       "//third_party/protobuf/python/google/protobuf/text_encoding.py",

build/config/android/system_image.gni

@@ -90,7 +90,6 @@ template("system_image_stub_apk") {
       "//third_party/protobuf/python/google/protobuf/descriptor_pb2.py",
       "//third_party/protobuf/python/google/protobuf/descriptor_pool.py",
       "//third_party/protobuf/python/google/protobuf/internal/__init__.py",
-      "//third_party/protobuf/python/google/protobuf/internal/_parameterized.py",
       "//third_party/protobuf/python/google/protobuf/internal/api_implementation.py",
       "//third_party/protobuf/python/google/protobuf/internal/builder.py",
       "//third_party/protobuf/python/google/protobuf/internal/containers.py",
@@ -134,7 +133,6 @@ template("system_image_stub_apk") {
       "//third_party/protobuf/python/google/protobuf/pyext/cpp_message.py",
       "//third_party/protobuf/python/google/protobuf/reflection.py",
       "//third_party/protobuf/python/google/protobuf/runtime_version.py",
-      "//third_party/protobuf/python/google/protobuf/service.py",
       "//third_party/protobuf/python/google/protobuf/service_reflection.py",
       "//third_party/protobuf/python/google/protobuf/symbol_database.py",
       "//third_party/protobuf/python/google/protobuf/text_encoding.py",

chromeos/assistant/internal

@@ -1 +1 @@
-Subproject commit 202ca42ffe028067860400b174637ff004094a34
+Subproject commit 7333fc7271a9c673862fcc3b5fd5d054d2e2ab30

google_apis/gcm/base/mcs_util.cc

@@ -11,6 +11,8 @@
 
 #include <stddef.h>
 
+#include <string_view>
+
 #include "base/check_op.h"
 #include "base/format_macros.h"
 #include "base/notreached.h"
@@ -150,7 +152,7 @@ std::unique_ptr<google::protobuf::MessageLite> BuildProtobufFromTag(
 // Utility method to extract a MCS tag from a google::protobuf::MessageLite
 // object.
 int GetMCSProtoTag(const google::protobuf::MessageLite& message) {
-  const std::string& type_name = message.GetTypeName();
+  std::string_view type_name = message.GetTypeName();
   if (type_name == kProtoNames[kHeartbeatPingTag]) {
     return kHeartbeatPingTag;
   } else if (type_name == kProtoNames[kHeartbeatAckTag]) {

third_party/cast_core/README.chromium

@@ -2,8 +2,8 @@ Name: CastCore Publics
 Short Name: cast_core/public
 URL: https://chromium.googlesource.com/cast_core/public
 Version: N/A
-Date: 2021-09-14
-Revision: 21e7e00e13122d83507449578c6bfe356d7eb266
+Date: 2025-03-21
+Revision: f5ee589bdaea60418f670fa176be15ccb9a34942
 License: Apache-2.0
 License File: LICENSE
 Security Critical: yes
@@ -13,4 +13,4 @@ Description:
 Public components, such as protos, used by gRPC-based CastCore services and
 clients.
 
-Local Modifications: None
+Local Modifications: None

third_party/cast_core/public/src

@@ -1 +1 @@
-Subproject commit dcb3d2e87cebe20b6dda06d8b29abb9af27ca422
+Subproject commit f5ee589bdaea60418f670fa176be15ccb9a34942

third_party/dom_distiller_js/BUILD.gn

@@ -20,7 +20,6 @@ protoc_plugin_files = [
   "//third_party/protobuf/python/google/protobuf/descriptor_pool.py",
   "//third_party/protobuf/python/google/protobuf/duration.py",
   "//third_party/protobuf/python/google/protobuf/internal/__init__.py",
-  "//third_party/protobuf/python/google/protobuf/internal/_parameterized.py",
   "//third_party/protobuf/python/google/protobuf/internal/api_implementation.py",
   "//third_party/protobuf/python/google/protobuf/internal/builder.py",
   "//third_party/protobuf/python/google/protobuf/internal/containers.py",
@@ -43,7 +42,6 @@ protoc_plugin_files = [
   "//third_party/protobuf/python/google/protobuf/proto_json.py",
   "//third_party/protobuf/python/google/protobuf/reflection.py",
   "//third_party/protobuf/python/google/protobuf/runtime_version.py",
-  "//third_party/protobuf/python/google/protobuf/service.py",
   "//third_party/protobuf/python/google/protobuf/service_reflection.py",
   "//third_party/protobuf/python/google/protobuf/symbol_database.py",
   "//third_party/protobuf/python/google/protobuf/text_encoding.py",

third_party/protobuf/.bazelignore

@@ -1,4 +1 @@
-# These are fetched as external repositories.
-third_party/abseil-cpp
-third_party/googletest
 _build/

third_party/protobuf/.bazelrc

@@ -28,12 +28,13 @@ build:ubsan --copt=-fno-sanitize=function --copt=-fno-sanitize=vptr
 # Abseil passes nullptr to memcmp with 0 size
 build:ubsan --copt=-fno-sanitize=nonnull-attribute
 
-# TODO: migrate all dependencies from WORKSPACE to MODULE.bazel
-# https://github.com/protocolbuffers/protobuf/issues/14313
-common --noenable_bzlmod
-
 # Important: this flag ensures that we remain compliant with the C++ layering
 # check.
 build --features=layering_check
 
 common --repo_env=BAZEL_NO_APPLE_CPP_TOOLCHAIN=1
+
+common --enable_platform_specific_config
+
+# Use clang-cl by default on Windows (see https://github.com/protocolbuffers/protobuf/issues/20085).
+build:windows --extra_toolchains=@local_config_cc//:cc-toolchain-x64_windows-clang-cl --extra_execution_platforms=//build_defs:x64_windows-clang-cl --host_platform=//build_defs:x64_windows-clang-cl

third_party/protobuf/.bcr/metadata.template.json

@@ -71,7 +71,7 @@
     },
     {
       "email": "sbenza@google.com",
-      "github": "sbenza",
+      "github": "sbenzaquen",
       "name": "Samuel Benzaquen",
       "do_not_notify": true
     },

third_party/protobuf/.bcr/presubmit.yml

@@ -1,36 +1,20 @@
-matrix:
-  platform: ["debian10", "macos", "ubuntu2004", "windows"]
-  bazel: [7.x]
-
-tasks:
-  verify_targets:
-    name: "Verify build targets"
-    platform: ${{ platform }}
-    bazel: ${{ bazel }}
-    build_flags:
-    - '--host_cxxopt=-std=c++14'
-    - '--cxxopt=-std=c++14'
-    build_targets:
-    - '@protobuf//:protobuf'
-    - '@protobuf//:protobuf_lite'
-    - '@protobuf//:protobuf_python'
-    - '@protobuf//:protobuf_java'
-    - '@protobuf//:protoc'
-    - '@protobuf//:test_messages_proto2_cc_proto'
-    - '@protobuf//:test_messages_proto3_cc_proto'
-
 bcr_test_module:
-  module_path: "examples"
+  module_path: examples
   matrix:
     platform: ["debian10", "macos", "ubuntu2004", "windows"]
-    bazel: [7.x]
+    bazel: [7.x, 8.x]
+
   tasks:
-    run_test_module:
-      name: "Run test module"
+    verify_targets:
+      name: "Verify build targets"
       platform: ${{ platform }}
       bazel: ${{ bazel }}
-      build_flags:
-      - '--host_cxxopt=-std=c++14'
-      - '--cxxopt=-std=c++14'
       build_targets:
-      - "//..."
+      - '//...'
+      - '@com_google_protobuf//:protobuf'
+      - '@com_google_protobuf//:protobuf_lite'
+      - '@com_google_protobuf//:protobuf_python'
+      - '@com_google_protobuf//:protobuf_java'
+      - '@com_google_protobuf//:protoc'
+      - '@com_google_protobuf//:test_messages_proto2_cc_proto'
+      - '@com_google_protobuf//:test_messages_proto3_cc_proto'

third_party/protobuf/.github/CODEOWNERS

@@ -1,7 +1,3 @@
-/src/ @protocolbuffers/protobuf-compiler
-
-/src/google/protobuf/compiler/cpp @protocolbuffers/protobuf-cpp
-
 /csharp/ @protocolbuffers/protobuf-csharp
 /src/google/protobuf/compiler/csharp/ @protocolbuffers/protobuf-csharp
 
@@ -25,13 +21,3 @@
 
 /ruby/ @protocolbuffers/protobuf-ruby
 /src/google/protobuf/compiler/ruby/ @protocolbuffers/protobuf-ruby
-
-/build_defs/ @protocolbuffers/protobuf-btr
-/cmake/ @protocolbuffers/protobuf-btr
-/pkg/ @protocolbuffers/protobuf-btr
-/toolchain/ @protocolbuffers/protobuf-btr
-/conformance/ @protocolbuffers/protobuf-btr
-/kokoro/ @protocolbuffers/protobuf-btr
-/third_party/ @protocolbuffers/protobuf-btr
-*.bazel @protocolbuffers/protobuf-btr
-/.github/ @protocolbuffers/protobuf-btr

third_party/protobuf/.github/scripts/validate_yaml.py

@@ -53,15 +53,23 @@ for file in yaml_files:
       continuous_condition = 'inputs.continuous-prefix' in jobs[job]['name']
       steps = jobs[job]['steps']
       for step in steps:
+        if 'name' in step:
+          name = step['name']
+        elif 'with' in step and 'name' in step['with']:
+          name = step['with']['name']
+        else:
+          raise ValueError(
+              'Step in job %s from file %s does not have a name.' % (job, file)
+          )
         if continuous_condition and 'continuous-run' not in step.get('if', ''):
           raise ValueError(
-              'Step %s in job %s does not check the continuous-run condition'
-              % (step['name'], job)
+              'Step %s in job %s from file %s does not check the continuous-run'
+              ' condition' % (name, job, file)
           )
         if not continuous_condition and 'continuous-run' in step.get('if', ''):
           raise ValueError(
-              'Step %s in job %s checks the continuous-run condition but '
-              'the job does not contain the continuous-prefix'
-              % (step['name'], job)
+              'Step %s in job %s from file %s checks the continuous-run'
+              ' condition but the job does not contain the continuous-prefix'
+              % (name, job, file)
           )
 print('PASSED: All steps in all jobs check the continuous-run condition.')

third_party/protobuf/.github/workflows/clear_caches.yml

@@ -23,7 +23,7 @@ jobs:
       actions: write # permission is required to delete caches
       contents: read
     steps:
-      - uses: actions/cache@627f0f41f6904a5b1efbaed9f96d9eb58e92e920 # v3.2.4
+      - uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
         with:
           path: ${{ github.workspace }}/${{ steps.output.outputs.repository-cache }}
           key: repository-cache-${{ github.ref_name }}-${{ runner.os }}-reset-${{ github.sha }}

third_party/protobuf/.github/workflows/staleness_check.yml

@@ -25,7 +25,7 @@ jobs:
     if: ${{ github.event.repository.full_name == 'protocolbuffers/protobuf' }}
     steps:
       - name: Checkout
-        uses: protocolbuffers/protobuf-ci/checkout@v3
+        uses: protocolbuffers/protobuf-ci/checkout@v4
         with:
           ref: ${{ inputs.safe-checkout || github.head_ref || github.ref }}
 
@@ -48,16 +48,17 @@ jobs:
         # In branches where automatic updates work as post-submits, we don't want to run staleness
         # tests along with user changes.  Any stale files will be automatically fixed in a follow-up
         # commit.
-        uses: protocolbuffers/protobuf-ci/bazel@v3
+        uses: protocolbuffers/protobuf-ci/bazel@v4
         with:
           version: 7.1.2 # Bazel version
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
           bazel-cache: staleness
+          # TODO: Enable bzlmod once //python/dist is buildable.
           bash: >
             set -ex;
             echo "Please run ./regenerate_stale_files.sh to regenerate stale files";
             if [[ -z $COMMIT_TRIGGERED_RUN || -z $MAIN_RUN ]]; then
-            bazel query 'attr(tags, "staleness_test", //...)' | xargs bazel test $BAZEL_FLAGS;
+            bazel query 'attr(tags, "staleness_test", //...)' --noenable_bzlmod | xargs bazel test $BAZEL_FLAGS;
             else
-            bazel query 'attr(tags, "staleness_test", //...)';
+            bazel query 'attr(tags, "staleness_test", //...)' --noenable_bzlmod;
             fi

third_party/protobuf/.github/workflows/test_bazel.yml

@@ -27,31 +27,29 @@ jobs:
       fail-fast: false
       matrix:
         runner: [ ubuntu, windows, macos ]
-        bazelversion: [ '7.1.2' ]
+        bazelversion: [ '7.1.2', '8.0.0' ]
         bzlmod: [ true, false ]
-        toolchain_resolution: [ "" ]
-        include:
-          - runner: ubuntu
-            bazelversion: '6.4.0'
-            # Not running Bazel 6 with bzlmod, because it doesn't support use_repo_rule in rules_jvm_external
-            bzlmod: false
-          - runner: ubuntu
-            bazelversion: '7.1.2'
-            bzlmod: false
-            toolchain_resolution: --incompatible_enable_proto_toolchain_resolution=true
-          - runner: ubuntu
-            bazelversion: '7.1.2'
-            bzlmod: true
-            toolchain_resolution: --incompatible_enable_proto_toolchain_resolution=true
+        toolchain_resolution: [ "", "--incompatible_enable_proto_toolchain_resolution=true" ]
     runs-on: ${{ matrix.runner }}-latest
     name: ${{ matrix.continuous-only && inputs.continuous-prefix || '' }} Examples ${{ matrix.runner }} ${{ matrix.bazelversion }}${{ matrix.bzlmod && ' (bzlmod)' || '' }} ${{ matrix.toolchain_resolution && ' (toolchain resolution)' || '' }}
     steps:
       - name: Checkout pending changes
         if: ${{ !matrix.continuous-only || inputs.continuous-run }}
-        uses: protocolbuffers/protobuf-ci/checkout@v3
+        uses: protocolbuffers/protobuf-ci/checkout@v4
         with:
           ref: ${{ inputs.safe-checkout }}
 
+      # rules_jvm_external doesn't support Java 8, which is the default version
+      # on some github runners.  When this is selected, it results in some
+      # opaque errors about coursier (see
+      # https://github.com/bazel-contrib/rules_jvm_external/issues/1337).
+      - name: Pin to Java 11
+        uses: actions/setup-java@3a4f6e1af504cf6a31855fa899c6aa5355ba6c12 # v4.7.0
+        if: ${{ !matrix.continuous-only || inputs.continuous-run }}
+        with:
+          distribution: 'temurin'
+          java-version: '11'
+
       - name: Windows startup flags
         if: ${{ runner.os == 'Windows' && (!matrix.continuous-only || inputs.continuous-run) }}
         working-directory: examples
@@ -66,9 +64,11 @@ jobs:
 
       - name: Run tests
         if: ${{ !matrix.continuous-only || inputs.continuous-run }}
-        uses: protocolbuffers/protobuf-ci/bazel@v3
+        uses: protocolbuffers/protobuf-ci/bazel@v4
         with:
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
           bazel-cache: examples
           version: ${{ matrix.bazelversion }}
-          bash: cd examples && bazel build //... $BAZEL_FLAGS --enable_bzlmod=${{ matrix.bzlmod }} ${{ matrix.toolchain_resolution }}
+          bash: >
+            cd examples;
+            bazel build //... @com_google_protobuf-examples-with-hyphen//... $BAZEL_FLAGS --enable_bzlmod=${{ matrix.bzlmod }} --enable_workspace=${{ !matrix.bzlmod }} ${{ matrix.toolchain_resolution }};

third_party/protobuf/.github/workflows/test_cpp.yml

@@ -37,38 +37,36 @@ jobs:
           - { name: No-RTTI, flags: --cxxopt=-fno-rtti, continuous-only: true }
         include:
           # Set defaults
-          - image: us-docker.pkg.dev/protobuf-build/containers/test/linux/sanitize:6.4.0-27cf7b86212020d7e552bc13b1e084abb971da75
-          - targets: //pkg/... //src/... @com_google_protobuf_examples//... //third_party/utf8_range/... //conformance:conformance_framework_tests
-
+          - image: us-docker.pkg.dev/protobuf-build/containers/test/linux/sanitize:7.1.2-2c05f44c25a209933743ddf0296ef0c1e583d2c3
+          - targets: //pkg/... //src/... //third_party/utf8_range/... //conformance:conformance_framework_tests
           # Override cases with custom images
-          - config: { name: "Bazel7", flags: --noenable_bzlmod }
-            cache_key: Bazel7
-            image: "us-docker.pkg.dev/protobuf-build/containers/common/linux/bazel:7.1.2-cf84e92285ca133b9c8104ad7b14d70e953cbb8e"
-            targets: "//src/... //third_party/utf8_range/..."
-            # TODO: remove -Wno-unreachable-code" when dropping C++14
-          - config: { name: "Bazel7 with Bzlmod", flags: --enable_bzlmod --enable_workspace --per_file_copt=.*/absl/strings/string_view.h@-Wno-unreachable-code --cxxopt="-Wno-self-assign-overloaded" }
+          - config: { name: "Bazel7", flags: --cxxopt="-Wno-self-assign-overloaded" }
             cache_key: Bazel7bzlmod
-            image: "us-docker.pkg.dev/protobuf-build/containers/common/linux/bazel:7.1.2-cf84e92285ca133b9c8104ad7b14d70e953cbb8e"
+            image: "us-docker.pkg.dev/protobuf-build/containers/common/linux/bazel:7.1.2-27cf7b86212020d7e552bc13b1e084abb971da75"
+            targets: "//src/... //third_party/utf8_range/..."
+          - config: { name: "Bazel7 Workspace", flags: --noenable_bzlmod }
+            cache_key: Bazel7nobzlmod
+            image: "us-docker.pkg.dev/protobuf-build/containers/common/linux/bazel:7.1.2-27cf7b86212020d7e552bc13b1e084abb971da75"
             targets: "//src/... //third_party/utf8_range/..."
           - config: { name: "TCMalloc" }
             cache_key: TcMalloc
-            image: "us-docker.pkg.dev/protobuf-build/containers/test/linux/tcmalloc:6.4.0-27cf7b86212020d7e552bc13b1e084abb971da75"
+            image: "us-docker.pkg.dev/protobuf-build/containers/test/linux/tcmalloc:7.1.2-d9624f2aa83cba3eaf906f751d75b36aacb9aa82"
             targets: "//src/... //third_party/utf8_range/..."
-          - config: { name: "aarch64" }
-            cache_key: TcMalloc
+          - config: { name: "aarch64", flags: "--platforms=//build_defs:aarch64_linux" }
+            cache_key: aarch64-bazel7
             targets: "//src/... //src/google/protobuf/compiler:protoc_aarch64_test //third_party/utf8_range/..."
-            image: "us-docker.pkg.dev/protobuf-build/containers/test/linux/emulation:6.4.0-aarch64-08714ed7a713068c8418003a2d95f423d4b1eac9"
+            image: "us-docker.pkg.dev/protobuf-build/containers/test/linux/emulation:7.1.2-aarch64-2920199ab0090ed427413a8e422e62695c8392a8"
     name: ${{ matrix.config.continuous-only && inputs.continuous-prefix || '' }} Linux ${{ matrix.config.name }}
     runs-on: ${{ matrix.config.runner || 'ubuntu-latest' }}
     steps:
       - name: Checkout pending changes
         if: ${{ !matrix.config.continuous-only || inputs.continuous-run }}
-        uses: protocolbuffers/protobuf-ci/checkout@v3
+        uses: protocolbuffers/protobuf-ci/checkout@v4
         with:
           ref: ${{ inputs.safe-checkout }}
       - name: Run tests
         if: ${{ !matrix.config.continuous-only || inputs.continuous-run }}
-        uses: protocolbuffers/protobuf-ci/bazel-docker@v3
+        uses: protocolbuffers/protobuf-ci/bazel-docker@v4
         with:
           image: ${{ matrix.image }}
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
@@ -80,58 +78,57 @@ jobs:
     strategy:
       fail-fast: false   # Don't cancel all jobs if one fails.
       matrix:
-        version: ['9.5', '13.1']
+        version: ['7.5', '9.1', '9.5', '13.1']
     name: Linux GCC ${{ matrix.version }}
     runs-on: ubuntu-latest
     steps:
       - name: Checkout pending changes
-        uses: protocolbuffers/protobuf-ci/checkout@v3
+        uses: protocolbuffers/protobuf-ci/checkout@v4
         with:
           ref: ${{ inputs.safe-checkout }}
       - name: Run tests
-        uses: protocolbuffers/protobuf-ci/bazel-docker@v3
+        uses: protocolbuffers/protobuf-ci/bazel-docker@v4
         with:
-          image: us-docker.pkg.dev/protobuf-build/containers/test/linux/gcc:6.4.0-${{ matrix.version }}-27cf7b86212020d7e552bc13b1e084abb971da75
+          image: us-docker.pkg.dev/protobuf-build/containers/test/linux/gcc:7.1.2-${{ matrix.version }}-e78301df86b3e4c46ec9ac4d98be00e19305d8f3
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
           bazel-cache: cpp_linux/gcc-${{ matrix.version }}
-          bazel: test //pkg/... //src/... @com_google_protobuf_examples//... //third_party/utf8_range/... //conformance:conformance_framework_tests
+          bazel: test //pkg/... //src/... //third_party/utf8_range/... //conformance:conformance_framework_tests
 
   linux-release:
     strategy:
       fail-fast: false   # Don't cancel all jobs if one fails.
       matrix:
-        arch: [x86_64, aarch64]
-    name: Linux Release ${{ matrix.arch}}
+        arch: [x86_64]
+    name: Linux Release ${{ matrix.arch }}
     runs-on: ubuntu-20-4core
     steps:
       - name: Checkout pending changes
-        uses: protocolbuffers/protobuf-ci/checkout@v3
+        uses: protocolbuffers/protobuf-ci/checkout@v4
         with:
           ref: ${{ inputs.safe-checkout }}
-          submodules: recursive
       - name: Cross compile protoc for ${{ matrix.arch }}
         id: cross-compile
-        uses: protocolbuffers/protobuf-ci/cross-compile-protoc@v3
+        uses: protocolbuffers/protobuf-ci/cross-compile-protoc@v4
         with:
-          image: us-docker.pkg.dev/protobuf-build/containers/common/linux/bazel:6.4.0-cf84e92285ca133b9c8104ad7b14d70e953cbb8e
+          image: us-docker.pkg.dev/protobuf-build/containers/common/linux/bazel:7.1.2-27cf7b86212020d7e552bc13b1e084abb971da75
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
           architecture: linux-${{ matrix.arch }}
       - name: Setup sccache
-        uses: protocolbuffers/protobuf-ci/sccache@v3
+        uses: protocolbuffers/protobuf-ci/sccache@v4
         with:
           cache-prefix: linux-release-${{ matrix.arch }}
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
       - name: Run tests
-        uses: protocolbuffers/protobuf-ci/docker@v3
+        uses: protocolbuffers/protobuf-ci/docker@v4
         with:
-          image: us-docker.pkg.dev/protobuf-build/containers/test/linux/emulation:6.4.0-${{ matrix.arch }}-08714ed7a713068c8418003a2d95f423d4b1eac9
+          image: us-docker.pkg.dev/protobuf-build/containers/test/linux/emulation:7.1.2-${{ matrix.arch }}-2920199ab0090ed427413a8e422e62695c8392a8
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
           entrypoint: bash
           command: >
             -c "set -ex;
             sccache -z;
             cmake . -DWITH_PROTOC=/workspace/${{ steps.cross-compile.outputs.protoc }}
-            -Dprotobuf_BUILD_LIBUPB=OFF -Dprotobuf_BUILD_CONFORMANCE=ON -DCMAKE_CXX_STANDARD=14
+            -Dprotobuf_BUILD_LIBUPB=OFF -Dprotobuf_BUILD_CONFORMANCE=ON -DCMAKE_CXX_STANDARD=17
             -Dprotobuf_WITH_ZLIB=OFF ${{ env.SCCACHE_CMAKE_FLAGS }};
             cmake --build . --parallel 20;
             ctest --parallel 20;
@@ -142,78 +139,158 @@ jobs:
       fail-fast: false   # Don't cancel all jobs if one fails.
       matrix:
         include:
-          - flags: -Dprotobuf_BUILD_EXAMPLES=ON -DCMAKE_CXX_STANDARD=14
+          - flags: -Dprotobuf_BUILD_EXAMPLES=ON -DCMAKE_CXX_STANDARD=17
           - name: Ninja
-            flags: -G Ninja -DCMAKE_CXX_STANDARD=14
+            flags: -G Ninja -DCMAKE_CXX_STANDARD=17
             continuous-only: true
           - name: Shared
-            flags: -Dprotobuf_BUILD_SHARED_LIBS=ON -Dprotobuf_BUILD_EXAMPLES=ON -DCMAKE_CXX_STANDARD=14
+            flags: -Dprotobuf_BUILD_SHARED_LIBS=ON -Dprotobuf_BUILD_EXAMPLES=ON -DCMAKE_CXX_STANDARD=17
             continuous-only: true
-          - name: C++17
-            flags: -DCMAKE_CXX_STANDARD=17
-          # TODO Re-enable this.
-          #- name: C++20
-          #  flags: -DCMAKE_CXX_STANDARD=20
+          - name: C++20
+            flags: -DCMAKE_CXX_STANDARD=20
+          - name: Package
+            flags: -DCMAKE_CXX_STANDARD=17 -Dprotobuf_LOCAL_DEPENDENCIES_ONLY=ON
+          - name: Fetch
+            flags: -DCMAKE_CXX_STANDARD=17 -Dprotobuf_FORCE_FETCH_DEPENDENCIES=ON
 
     name: ${{ matrix.continuous-only && inputs.continuous-prefix || '' }} Linux CMake ${{ matrix.name}}
     runs-on: ubuntu-latest
     steps:
       - name: Checkout pending changes
         if: ${{ !matrix.continuous-only || inputs.continuous-run }}
-        uses: protocolbuffers/protobuf-ci/checkout@v3
+        uses: protocolbuffers/protobuf-ci/checkout@v4
         with:
           ref: ${{ inputs.safe-checkout }}
 
       - name: Setup sccache
         if: ${{ !matrix.continuous-only || inputs.continuous-run }}
-        uses: protocolbuffers/protobuf-ci/sccache@v3
+        uses: protocolbuffers/protobuf-ci/sccache@v4
         with:
           cache-prefix: linux-cmake
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
 
       - name: Run tests
         if: ${{ !matrix.continuous-only || inputs.continuous-run }}
-        uses: protocolbuffers/protobuf-ci/docker@v3
+        uses: protocolbuffers/protobuf-ci/docker@v4
         with:
-          image: us-docker.pkg.dev/protobuf-build/containers/test/linux/cmake:3.13.3-384d5abe83a791c6b1ce04f5d7bc0b1f84a30d38
+          image: us-docker.pkg.dev/protobuf-build/containers/test/linux/cmake:3.16.9-d9624f2aa83cba3eaf906f751d75b36aacb9aa82
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
           command: >-
             /test.sh ${{ matrix.flags}} ${{ env.SCCACHE_CMAKE_FLAGS }}
-            -Dprotobuf_BUILD_TESTS=ON -Dprotobuf_USE_EXTERNAL_GTEST=ON
-            -Dprotobuf_ABSL_PROVIDER=package
+            -Dprotobuf_BUILD_TESTS=ON ${{ matrix.package_flags }}
 
   linux-cmake-install:
-    name: Linux CMake Install
+    strategy:
+      fail-fast: false   # Don't cancel all jobs if one fails.
+      matrix:
+        type: [package, static, fetch]
+        include:
+          # Set defaults
+          - type: package
+            name: Install
+            flags: -Dprotobuf_LOCAL_DEPENDENCIES_ONLY=ON -Dprotobuf_BUILD_SHARED_LIBS=ON
+          - type: static
+            name: Install (static)
+            flags: -Dprotobuf_LOCAL_DEPENDENCIES_ONLY=ON -Dprotobuf_BUILD_SHARED_LIBS=OFF
+          - type: fetch
+            name: Install (Fetch)
+            flags: -Dprotobuf_FORCE_FETCH_DEPENDENCIES=ON -Dprotobuf_BUILD_SHARED_LIBS=ON
+            continuous-only: true
+    name: ${{ matrix.continuous-only && inputs.continuous-prefix || '' }}Linux CMake ${{ matrix.name }}
     runs-on: ubuntu-latest
     steps:
       - name: Checkout pending changes
-        uses: protocolbuffers/protobuf-ci/checkout@v3
+        uses: protocolbuffers/protobuf-ci/checkout@v4
+        if: ${{ !matrix.continuous-only || inputs.continuous-run }}
         with:
           ref: ${{ inputs.safe-checkout }}
-          submodules: recursive
 
       - name: Setup sccache
-        uses: protocolbuffers/protobuf-ci/sccache@v3
+        uses: protocolbuffers/protobuf-ci/sccache@v4
+        if: ${{ !matrix.continuous-only || inputs.continuous-run }}
         with:
           cache-prefix: linux-cmake-install
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
 
       - name: Run tests
-        uses: protocolbuffers/protobuf-ci/docker@v3
+        uses: protocolbuffers/protobuf-ci/docker@v4
+        if: ${{ !matrix.continuous-only || inputs.continuous-run }}
         with:
-          image: us-docker.pkg.dev/protobuf-build/containers/test/linux/cmake:3.13.3-384d5abe83a791c6b1ce04f5d7bc0b1f84a30d38
+          image: us-docker.pkg.dev/protobuf-build/containers/test/linux/cmake:3.16.9-d9624f2aa83cba3eaf906f751d75b36aacb9aa82
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
           command: >-
-            /install.sh -DCMAKE_CXX_STANDARD=14 ${{ env.SCCACHE_CMAKE_FLAGS }}
-            -Dprotobuf_USE_EXTERNAL_GTEST=ON -Dprotobuf_ABSL_PROVIDER=package
-            -Dprotobuf_BUILD_SHARED_LIBS=ON \&\&
+            /install.sh -DCMAKE_CXX_STANDARD=17 ${{ env.SCCACHE_CMAKE_FLAGS }}
+            ${{ matrix.flags }}
+            \&\&
+            cp build/install_manifest.txt .
+            \&\&
             /test.sh
             ${{ env.SCCACHE_CMAKE_FLAGS }}
             -Dprotobuf_REMOVE_INSTALLED_HEADERS=ON
             -Dprotobuf_BUILD_PROTOBUF_BINARIES=OFF
             -Dprotobuf_BUILD_CONFORMANCE=ON
-            -DCMAKE_CXX_STANDARD=14
-            -Dprotobuf_USE_EXTERNAL_GTEST=ON -Dprotobuf_ABSL_PROVIDER=package
+            -DCMAKE_CXX_STANDARD=17
+            ${{ matrix.flags }}
+
+      - name: Clean up install manifest
+        if: ${{ !matrix.continuous-only || inputs.continuous-run }}
+        run: |
+          set -ex
+          mkdir manifest
+          cat install_manifest.txt | sort | sed 's:/usr/local/::g' > manifest/all.txt
+          cat manifest/all.txt | grep -E '^include/' | grep -vE 'internal' | sed 's:^include/::g' > manifest/include.txt
+          cat manifest/all.txt | grep -E '^bin/' | grep -vE '\-[0-9]+\.[0-9]+\.[0-9]+$' | sed 's:^bin/::g' > manifest/bin.txt
+          cat manifest/all.txt | grep -E '^lib/' | grep -vE '\.[0-9]+\.[0-9]+\.[0-9]+$' | sed 's:^lib/::g' > manifest/lib.txt
+
+      - name: Upload install manifest
+        uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
+        if: ${{ !matrix.continuous-only || inputs.continuous-run }}
+        with:
+          name: installed_files_${{ matrix.type }}
+          path: manifest/*.txt
+
+  install-manifests:
+    strategy:
+      fail-fast: false   # Don't cancel all jobs if one fails.
+      matrix:
+        type: [include, bin, lib]
+        build: [static, package]
+        include:
+            - type: lib
+              build: static
+              golden: 'lib_static'
+            - type: lib
+              build: package
+              golden: 'lib_shared'
+    name: Check Installed Files
+    needs: linux-cmake-install
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout pending changes
+        uses: protocolbuffers/protobuf-ci/checkout@v4
+        with:
+          ref: ${{ inputs.safe-checkout }}
+
+      - name: Download manifest
+        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 #4.1.8
+        with:
+          name: installed_files_${{ matrix.build }}
+          path: ${{ matrix.build }}
+      
+      - name: Compare against golden
+        run: |
+          set +e
+          GOLDEN_FILE=cmake/installed_${{ matrix.golden || matrix.type }}_golden.txt
+          DIFF="$(diff -u ${GOLDEN_FILE} ${{ matrix.build }}/${{ matrix.type }}.txt)"
+          if [ -n "$DIFF" ]; then
+            echo "Installed files do not match goldens!"
+            echo "If this is expected, please update the golden file: ${GOLDEN_FILE}"
+            echo "The following diffs were found:"
+            echo "$DIFF"
+            exit 1
+          else
+            echo "Installed files match goldens."
+          fi
 
   # This test should always be skipped on presubmit
   linux-cmake-examples:
@@ -222,30 +299,30 @@ jobs:
     steps:
       - name: Checkout pending changes
         if: ${{ inputs.continuous-run }}
-        uses: protocolbuffers/protobuf-ci/checkout@v3
+        uses: protocolbuffers/protobuf-ci/checkout@v4
         with:
           ref: ${{ inputs.safe-checkout }}
 
       - name: Setup sccache
         if: ${{ inputs.continuous-run }}
-        uses: protocolbuffers/protobuf-ci/sccache@v3
+        uses: protocolbuffers/protobuf-ci/sccache@v4
         with:
           cache-prefix: linux-cmake-examples
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
 
       - name: Run tests
         if: ${{ inputs.continuous-run }}
-        uses: protocolbuffers/protobuf-ci/docker@v3
+        uses: protocolbuffers/protobuf-ci/docker@v4
         with:
-          image: us-docker.pkg.dev/protobuf-build/containers/test/linux/cmake:3.13.3-384d5abe83a791c6b1ce04f5d7bc0b1f84a30d38
+          image: us-docker.pkg.dev/protobuf-build/containers/test/linux/cmake:3.16.9-d9624f2aa83cba3eaf906f751d75b36aacb9aa82
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
           command: >-
-            /install.sh -DCMAKE_CXX_STANDARD=14 ${{ env.SCCACHE_CMAKE_FLAGS }}
-            -Dprotobuf_USE_EXTERNAL_GTEST=ON -Dprotobuf_ABSL_PROVIDER=package
+            /install.sh -DCMAKE_CXX_STANDARD=17 ${{ env.SCCACHE_CMAKE_FLAGS }}
+            -Dprotobuf_LOCAL_DEPENDENCIES_ONLY=OFF
             -Dprotobuf_BUILD_EXAMPLES=OFF \&\&
             mkdir examples/build \&\&
             cd examples/build \&\&
-            cmake .. -DCMAKE_CXX_STANDARD=14 \&\&
+            cmake .. -DCMAKE_CXX_STANDARD=17 \&\&
             cmake --build .
 
   linux-cmake-gcc:
@@ -253,8 +330,6 @@ jobs:
       fail-fast: false   # Don't cancel all jobs if one fails.
       matrix:
         include:
-          - name: C++14
-            flags: -DCMAKE_CXX_STANDARD=14
           - name: C++17
             flags: -DCMAKE_CXX_STANDARD=17
             continuous-only: true
@@ -266,23 +341,22 @@ jobs:
     steps:
       - name: Checkout pending changes
         if: ${{ !matrix.continuous-only || inputs.continuous-run }}
-        uses: protocolbuffers/protobuf-ci/checkout@v3
+        uses: protocolbuffers/protobuf-ci/checkout@v4
         with:
           ref: ${{ inputs.safe-checkout }}
-          submodules: recursive
 
       - name: Setup sccache
         if: ${{ !matrix.continuous-only || inputs.continuous-run }}
-        uses: protocolbuffers/protobuf-ci/sccache@v3
+        uses: protocolbuffers/protobuf-ci/sccache@v4
         with:
           cache-prefix: linux-cmake-gcc
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
 
       - name: Run tests
         if: ${{ !matrix.continuous-only || inputs.continuous-run }}
-        uses: protocolbuffers/protobuf-ci/docker@v3
+        uses: protocolbuffers/protobuf-ci/docker@v4
         with:
-          image: us-docker.pkg.dev/protobuf-build/containers/test/linux/gcc:6.4.0-12.2-27cf7b86212020d7e552bc13b1e084abb971da75
+          image: us-docker.pkg.dev/protobuf-build/containers/test/linux/gcc:7.1.2-12.2-e78301df86b3e4c46ec9ac4d98be00e19305d8f3
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
           entrypoint: bash
           command: >-
@@ -294,58 +368,32 @@ jobs:
               ctest --verbose --parallel 20;
               sccache -s'
 
-  linux-cmake-submodules:
-    name: Linux CMake Submodules
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout pending changes
-        uses: protocolbuffers/protobuf-ci/checkout@v3
-        with:
-          ref: ${{ inputs.safe-checkout }}
-          submodules: recursive
-
-      - name: Setup sccache
-        uses: protocolbuffers/protobuf-ci/sccache@v3
-        with:
-          cache-prefix: linux-cmake-submodules
-          credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
-
-      - name: Run tests
-        uses: protocolbuffers/protobuf-ci/docker@v3
-        with:
-          image: us-docker.pkg.dev/protobuf-build/containers/test/linux/cmake:3.13.3-384d5abe83a791c6b1ce04f5d7bc0b1f84a30d38
-          credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
-          command: >-
-            /test.sh ${{ env.SCCACHE_CMAKE_FLAGS }}
-            -Dprotobuf_BUILD_CONFORMANCE=ON -Dprotobuf_BUILD_EXAMPLES=ON -DCMAKE_CXX_STANDARD=14
-
   linux-cmake-32-bit:
     name: Linux CMake 32-bit
     runs-on: ubuntu-latest
     steps:
       - name: Checkout pending changes
-        uses: protocolbuffers/protobuf-ci/checkout@v3
+        uses: protocolbuffers/protobuf-ci/checkout@v4
         with:
           ref: ${{ inputs.safe-checkout }}
-          submodules: recursive
 
       - name: Setup sccache
-        uses: protocolbuffers/protobuf-ci/sccache@v3
+        uses: protocolbuffers/protobuf-ci/sccache@v4
         with:
           cache-prefix: linux-cmake-32-bit
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
 
       - name: Run tests
-        uses: protocolbuffers/protobuf-ci/docker@v3
+        uses: protocolbuffers/protobuf-ci/docker@v4
         with:
-          image: us-docker.pkg.dev/protobuf-build/containers/test/linux/32bit@sha256:429f924aec315704b4233adcbe4b29006116f27769db98acd176b9eb69c31299
+          image: us-docker.pkg.dev/protobuf-build/containers/test/linux/32bit@sha256:d6028ab408c49932836cdc514116f06886d7f6868a4d430630aa52adc5aee2fc
           platform: linux/386
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
           command: >-
               /bin/bash -cex '
               cd /workspace;
               sccache -z;
-              cmake . -DCMAKE_CXX_STANDARD=14 ${{ env.SCCACHE_CMAKE_FLAGS }};
+              cmake . -DCMAKE_CXX_STANDARD=17 ${{ env.SCCACHE_CMAKE_FLAGS }};
               cmake --build . --parallel 20;
               ctest --verbose --parallel 20;
               sccache -s'
@@ -356,15 +404,9 @@ jobs:
       matrix:
         include:
           - name: MacOS Bazel
-            os: macos-13
-            cache_key: macos-13
-            bazel: test //src/... //third_party/utf8_range/... //conformance:conformance_framework_tests
-          - name: MacOS Bazel 7
             os: macos-13
             cache_key: macos-13-bazel7
             bazel: test //src/... //third_party/utf8_range/... //conformance:conformance_framework_tests
-            bazel_version: '7.1.2'
-            continuous-only: true
           - name: MacOS Apple Silicon (build only) Bazel
             os: macos-13
             cache_key: macos-13-arm
@@ -373,30 +415,28 @@ jobs:
             bazel: build --cpu=darwin_arm64 //src/... //third_party/utf8_range/... //conformance:conformance_framework_tests
           - name: Windows Bazel
             os: windows-2022
-            cache_key: windows-2022
-            bazel: test //src/...  @com_google_protobuf_examples//... --test_tag_filters=-conformance --build_tag_filters=-conformance
-          - name: Windows Bazel 7 
+            cache_key: windows-2022-msvc-cl
+            bazel: test //src/...  --config=msvc-cl --test_tag_filters=-conformance --build_tag_filters=-conformance --define=protobuf_allow_msvc=true
+          - name: Windows Bazel clang-cl
             os: windows-2022
-            cache_key: windows-2022-bazel7
-            bazel: test //src/...  @com_google_protobuf_examples//... --test_tag_filters=-conformance --build_tag_filters=-conformance
-            bazel_version: '7.1.2'
-            continuous-only: true
+            cache_key: windows-2022-clang-cl
+            bazel: test //src/...  --test_tag_filters=-conformance --build_tag_filters=-conformance
     name: ${{ matrix.continuous-only && inputs.continuous-prefix || '' }} ${{ matrix.name }}
     runs-on: ${{ matrix.os }}
     steps:
       - name: Checkout pending changes
         if: ${{ !matrix.continuous-only || inputs.continuous-run }}
-        uses: protocolbuffers/protobuf-ci/checkout@v3
+        uses: protocolbuffers/protobuf-ci/checkout@v4
         with:
           ref: ${{ inputs.safe-checkout }}
       - name: Run tests
         if: ${{ !matrix.continuous-only || inputs.continuous-run }}
-        uses: protocolbuffers/protobuf-ci/bazel@v3
+        uses: protocolbuffers/protobuf-ci/bazel@v4
         with:
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
           bazel: ${{ matrix.bazel }}
           bazel-cache: cpp_${{ matrix.cache_key }}
-          version: ${{ matrix.bazel_version || '6.4.0' }}
+          version: ${{ matrix.bazel_version || '7.1.2' }}
 
   non-linux-cmake:
     strategy:
@@ -405,7 +445,6 @@ jobs:
         include:
           - name: MacOS CMake
             os: macos-13
-            flags: -DCMAKE_CXX_STANDARD=14
             cache-prefix: macos-cmake
             continuous-only: true
           - name: Windows CMake
@@ -416,7 +455,6 @@ jobs:
               -Dprotobuf_BUILD_EXAMPLES=ON
             vsversion: '2022'
             cache-prefix: windows-2022-cmake
-            continuous-only: true
           - name: Windows CMake 2019
             os: windows-2019
             flags: >-
@@ -445,7 +483,8 @@ jobs:
             cache-prefix: windows-2022-cmake
           - name: Windows CMake Install
             os: windows-2022
-            install-flags: -G Ninja -Dprotobuf_WITH_ZLIB=OFF -Dprotobuf_BUILD_CONFORMANCE=OFF -Dprotobuf_BUILD_TESTS=OFF
+            install-flags: >-
+              -G Ninja -Dprotobuf_WITH_ZLIB=OFF -Dprotobuf_BUILD_CONFORMANCE=OFF
             flags: >-
               -G Ninja -Dprotobuf_WITH_ZLIB=OFF -Dprotobuf_BUILD_CONFORMANCE=OFF
               -Dprotobuf_REMOVE_INSTALLED_HEADERS=ON
@@ -458,10 +497,9 @@ jobs:
     steps:
       - name: Checkout pending changes
         if: ${{ !matrix.continuous-only || inputs.continuous-run }}
-        uses: protocolbuffers/protobuf-ci/checkout@v3
+        uses: protocolbuffers/protobuf-ci/checkout@v4
         with:
           ref: ${{ inputs.safe-checkout }}
-          submodules: recursive
 
       - name: Setup MSVC
         if: ${{ runner.os == 'Windows' && (!matrix.continuous-only || inputs.continuous-run) }}
@@ -483,7 +521,7 @@ jobs:
 
       - name: Setup sccache
         if: ${{ !matrix.continuous-only || inputs.continuous-run }}
-        uses: protocolbuffers/protobuf-ci/sccache@v3
+        uses: protocolbuffers/protobuf-ci/sccache@v4
         with:
           cache-prefix: ${{ matrix.cache-prefix }}
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
@@ -491,10 +529,13 @@ jobs:
       # Install phase.
       - name: Configure CMake for install
         if: ${{ matrix.install-flags && (!matrix.continuous-only || inputs.continuous-run) }}
-        uses: protocolbuffers/protobuf-ci/bash@v3
+        uses: protocolbuffers/protobuf-ci/bash@v4
         with:
+          bazel-version: 7.1.2
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
-          command: cmake . ${{ matrix.install-flags }} ${{ env.SCCACHE_CMAKE_FLAGS }} -Dprotobuf_ALLOW_CCACHE=ON
+          command: >-
+            cmake . -DCMAKE_CXX_STANDARD=17 ${{ matrix.install-flags }}
+            ${{ env.SCCACHE_CMAKE_FLAGS }} -Dprotobuf_ALLOW_CCACHE=ON
       - name: Build for install
         if: ${{ matrix.install-flags && (!matrix.continuous-only || inputs.continuous-run) }}
         shell: bash
@@ -514,10 +555,13 @@ jobs:
 
       - name: Configure CMake
         if: ${{ !matrix.continuous-only || inputs.continuous-run }}
-        uses: protocolbuffers/protobuf-ci/bash@v3
+        uses: protocolbuffers/protobuf-ci/bash@v4
         with:
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
-          command: cmake . ${{ matrix.flags }} ${{ env.SCCACHE_CMAKE_FLAGS }} -Dprotobuf_ALLOW_CCACHE=ON 
+          bazel-version: 7.1.2
+          command: >-
+            cmake . -DCMAKE_CXX_STANDARD=17 ${{ matrix.flags }}
+            ${{ env.SCCACHE_CMAKE_FLAGS }} -Dprotobuf_ALLOW_CCACHE=ON
 
       - name: Build
         if: ${{ !matrix.continuous-only || inputs.continuous-run }}

third_party/protobuf/.github/workflows/test_csharp.yml

@@ -19,19 +19,19 @@ jobs:
     runs-on: ubuntu-22-4core
     steps:
       - name: Checkout pending changes
-        uses: protocolbuffers/protobuf-ci/checkout@v3
+        uses: protocolbuffers/protobuf-ci/checkout@v4
         with:
           ref: ${{ inputs.safe-checkout }}
 
       # TODO Run this with Bazel once codegen is handled properly.
       - name: Run tests
-        uses: protocolbuffers/protobuf-ci/docker@v3
+        uses: protocolbuffers/protobuf-ci/docker@v4
         with:
-          image: us-docker.pkg.dev/protobuf-build/containers/test/linux/csharp:6.4.0-3.1.415-6.0.100-08714ed7a713068c8418003a2d95f423d4b1eac9
+          image: us-docker.pkg.dev/protobuf-build/containers/test/linux/csharp:7.1.2-3.1.415-6.0.100-d9624f2aa83cba3eaf906f751d75b36aacb9aa82
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
           entrypoint: /bin/bash
           command: >-
-            -c "
+            -cex "
             cd csharp &&
             dotnet restore src/Google.Protobuf.sln &&
             dotnet build -c Release src/Google.Protobuf.sln &&
@@ -41,9 +41,9 @@ jobs:
         run: sudo rm -rf _build .repository-cache
 
       - name: Run conformance tests
-        uses: protocolbuffers/protobuf-ci/bazel-docker@v3
+        uses: protocolbuffers/protobuf-ci/bazel-docker@v4
         with:
-          image: us-docker.pkg.dev/protobuf-build/containers/test/linux/csharp:6.4.0-3.1.415-6.0.100-08714ed7a713068c8418003a2d95f423d4b1eac9
+          image: us-docker.pkg.dev/protobuf-build/containers/test/linux/csharp:7.1.2-3.1.415-6.0.100-d9624f2aa83cba3eaf906f751d75b36aacb9aa82
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
           bazel-cache: csharp_linux
           bazel: test //csharp:conformance_test --action_env=DOTNET_CLI_TELEMETRY_OPTOUT=1 --test_env=DOTNET_CLI_HOME=/home/bazel
@@ -53,7 +53,7 @@ jobs:
     runs-on: windows-2019
     steps:
       - name: Checkout pending changes
-        uses: protocolbuffers/protobuf-ci/checkout@v3
+        uses: protocolbuffers/protobuf-ci/checkout@v4
         with:
           ref: ${{ inputs.safe-checkout }}
 
@@ -72,8 +72,9 @@ jobs:
         shell: bash
 
       - name: Run tests
-        uses: protocolbuffers/protobuf-ci/bash@v3
+        uses: protocolbuffers/protobuf-ci/bash@v4
         with:
+          bazel-version: 7.1.2
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
           command: |
             dotnet build csharp/src/Google.Protobuf.sln
@@ -84,14 +85,14 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout pending changes
-        uses: protocolbuffers/protobuf-ci/checkout@v3
+        uses: protocolbuffers/protobuf-ci/checkout@v4
         with:
           ref: ${{ inputs.safe-checkout }}
 
       - name: Build protobuf C# tests under x86_64 docker image
         # Tests are built "dotnet publish" because we want all the dependencies to the copied to the destination directory
         # (we want to avoid references to ~/.nuget that won't be available in the subsequent docker run)
-        uses: protocolbuffers/protobuf-ci/docker@v3
+        uses: protocolbuffers/protobuf-ci/docker@v4
         with:
           image: mcr.microsoft.com/dotnet/sdk:6.0.100-bullseye-slim
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
@@ -108,7 +109,7 @@ jobs:
         #   running under current user's UID and GID. To be able to do that, we need to provide a home directory for the user
         #   otherwise the UID would be homeless under the docker container and pip install wouldn't work. For simplicity,
         #   we just run map the user's home to a throwaway temporary directory
-        uses: protocolbuffers/protobuf-ci/docker@v3
+        uses: protocolbuffers/protobuf-ci/docker@v4
         with:
           image: mcr.microsoft.com/dotnet/sdk:6.0.100-bullseye-slim-arm64v8
           skip-staleness-check: true

third_party/protobuf/.github/workflows/test_java.yml

@@ -30,44 +30,46 @@ jobs:
         include:
           - name: OpenJDK 8
             cache_key: '8'
-            image: us-docker.pkg.dev/protobuf-build/containers/test/linux/java:6.4.0-8-27cf7b86212020d7e552bc13b1e084abb971da75
+            image: us-docker.pkg.dev/protobuf-build/containers/test/linux/java:7.1.2-8-d9624f2aa83cba3eaf906f751d75b36aacb9aa82
             # TODO: b/318555165 - enable the layering check. Currently it does
             # not work correctly with the toolchain in this Docker image.
             targets: //java/... //java/internal:java_version //compatibility/... --features=-layering_check
+            # TODO: b/393604460 - enable bzlmod once coursier error is fixed.
+            flags: --java_language_version=8 --noenable_bzlmod
           - name: OpenJDK 11
             cache_key: '11'
-            image: us-docker.pkg.dev/protobuf-build/containers/test/linux/java:6.4.0-11-27cf7b86212020d7e552bc13b1e084abb971da75
+            image: us-docker.pkg.dev/protobuf-build/containers/test/linux/java:7.1.2-11-d9624f2aa83cba3eaf906f751d75b36aacb9aa82
             targets: //java/... //java/internal:java_version //compatibility/...
             continuous-only: true
           - name: OpenJDK 17
             cache_key: '17'
-            image: us-docker.pkg.dev/protobuf-build/containers/test/linux/java:6.4.0-17-27cf7b86212020d7e552bc13b1e084abb971da75
+            image: us-docker.pkg.dev/protobuf-build/containers/test/linux/java:7.1.2-17-641278a52587c01f44525819b76499db35c2804d
             targets: //java/... //java/internal:java_version //compatibility/...
           - name: Bazel7
+            cache_key: 'bazel7bzlmod'
+            image: us-docker.pkg.dev/protobuf-build/containers/common/linux/bazel:7.1.2-27cf7b86212020d7e552bc13b1e084abb971da75
+            targets: //java/... //java/internal:java_version //compatibility/...
+          - name: Bazel7 Workspace
             cache_key: 'bazel7nobzlmod'
-            image: us-docker.pkg.dev/protobuf-build/containers/common/linux/bazel:7.1.2-cf84e92285ca133b9c8104ad7b14d70e953cbb8e
+            image: us-docker.pkg.dev/protobuf-build/containers/common/linux/bazel:7.1.2-27cf7b86212020d7e552bc13b1e084abb971da75
             targets: //java/... //java/internal:java_version //compatibility/...
             flags: --noenable_bzlmod
-          - name: Bazel7 with Bzlmod
-            cache_key: 'bazel7bzlmod'
-            image: us-docker.pkg.dev/protobuf-build/containers/common/linux/bazel:7.1.2-cf84e92285ca133b9c8104ad7b14d70e953cbb8e
-            targets: //java/... //java/internal:java_version //compatibility/...
-            flags: --enable_bzlmod --enable_workspace
-          - name: aarch64
-            cache_key: 'aarch64'
-            image: us-docker.pkg.dev/protobuf-build/containers/test/linux/emulation:6.4.0-aarch64-08714ed7a713068c8418003a2d95f423d4b1eac9
-            targets: //java/... //compatibility/... //src/google/protobuf/compiler:protoc_aarch64_test
+          # TODO: b/395623141 - restore this test once runtime uses / emulates aarch64.
+          # - name: aarch64
+          #   cache_key: 'aarch64'
+          #   image: us-docker.pkg.dev/protobuf-build/containers/test/linux/emulation:7.1.2-aarch64-2920199ab0090ed427413a8e422e62695c8392a8
+          #   targets: //java/... //compatibility/... //src/google/protobuf/compiler:protoc_aarch64_test
 
     name: ${{ matrix.continuous-only && inputs.continuous-prefix || '' }} Linux ${{ matrix.name }}
     runs-on: ubuntu-latest
     steps:
       - name: Checkout pending changes
-        uses: protocolbuffers/protobuf-ci/checkout@v3
+        uses: protocolbuffers/protobuf-ci/checkout@v4
         if: ${{ !matrix.continuous-only || inputs.continuous-run }}
         with:
           ref: ${{ inputs.safe-checkout }}
       - name: Run tests
-        uses: protocolbuffers/protobuf-ci/bazel-docker@v3
+        uses: protocolbuffers/protobuf-ci/bazel-docker@v4
         if: ${{ !matrix.continuous-only || inputs.continuous-run }}
         with:
           image: ${{ matrix.image }}
@@ -81,11 +83,11 @@ jobs:
   #   runs-on: ubuntu-latest
   #   steps:
   #     - name: Checkout pending changes
-  #       uses: protocolbuffers/protobuf-ci/checkout@v3
+  #       uses: protocolbuffers/protobuf-ci/checkout@v4
   #       with:
   #         ref: ${{ inputs.safe-checkout }}
   #     - name: Run Linkage Monitor test
-  #       uses: protocolbuffers/protobuf-ci/bazel-docker@v3
+  #       uses: protocolbuffers/protobuf-ci/bazel-docker@v4
   #       with:
   #         image: us-docker.pkg.dev/protobuf-build/containers/test/linux/java:8-1fdbb997433cb22c1e49ef75ad374a8d6bb88702
   #         credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
@@ -99,18 +101,18 @@ jobs:
     runs-on: ubuntu-22-4core
     steps:
     - name: Checkout pending changes
-      uses: protocolbuffers/protobuf-ci/checkout@v3
+      uses: protocolbuffers/protobuf-ci/checkout@v4
       with:
         ref: ${{ inputs.safe-checkout }}
     - name: Generate maven artifacts with bazel and install using maven
-      uses: protocolbuffers/protobuf-ci/bazel-docker@v3
+      uses: protocolbuffers/protobuf-ci/bazel-docker@v4
       with:
-        image: us-docker.pkg.dev/protobuf-build/containers/test/linux/java:6.4.0-11-27cf7b86212020d7e552bc13b1e084abb971da75
+        image: us-docker.pkg.dev/protobuf-build/containers/test/linux/java:7.1.2-11-d9624f2aa83cba3eaf906f751d75b36aacb9aa82
         credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
         bazel-cache: java_linux/11
         bash: |
           set -ex
-          bazel build //java:release
+          bazel build //java:release $BAZEL_FLAGS
           mvn install:install-file -Dfile=java/bom/pom.xml -DpomFile=java/bom/pom.xml
           mvn install:install-file -Dfile=java/pom.xml -DpomFile=java/pom.xml
           mvn install:install-file -Dfile=bazel-bin/java/core/core_mvn-project.jar -DpomFile=bazel-bin/java/core/core_mvn-pom.xml

third_party/protobuf/.github/workflows/test_objectivec.yml

@@ -50,20 +50,20 @@ jobs:
     steps:
       - name: Checkout pending changes
         if: ${{ !matrix.continuous-only || inputs.continuous-run }}
-        uses: protocolbuffers/protobuf-ci/checkout@v3
+        uses: protocolbuffers/protobuf-ci/checkout@v4
         with:
           ref: ${{ inputs.safe-checkout }}
 
       - name: Setup ccache
         if: ${{ !matrix.continuous-only || inputs.continuous-run }}
-        uses: protocolbuffers/protobuf-ci/ccache@v3
+        uses: protocolbuffers/protobuf-ci/ccache@v4
         with:
           cache-prefix: objectivec_${{ matrix.platform }}_${{ matrix.xc_config }}
           support-modules: true
 
       - name: Run tests
         if: ${{ !matrix.continuous-only || inputs.continuous-run }}
-        uses: protocolbuffers/protobuf-ci/bash@v3
+        uses: protocolbuffers/protobuf-ci/bash@v4
         env:
           CC: ${{ github.workspace }}/ci/clang_wrapper
           CXX: ${{ github.workspace }}/ci/clang_wrapper++
@@ -101,7 +101,7 @@ jobs:
     steps:
       - name: Checkout pending changes
         if: ${{ !matrix.continuous-only || inputs.continuous-run }}
-        uses: protocolbuffers/protobuf-ci/checkout@v3
+        uses: protocolbuffers/protobuf-ci/checkout@v4
         with:
           ref: ${{ inputs.safe-checkout }}
       - name: Xcode version
@@ -109,8 +109,9 @@ jobs:
         run: sudo xcode-select -switch /Applications/Xcode_${{ matrix.XCODE }}.app
       - name: Pod lib lint
         if: ${{ !matrix.continuous-only || inputs.continuous-run }}
-        uses: protocolbuffers/protobuf-ci/bazel@v3
+        uses: protocolbuffers/protobuf-ci/bazel@v4
         with:
+          version: 7.1.2 # Bazel version
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
           bazel-cache: cocoapods/${{ matrix.XCODE }}
           bash: |
@@ -151,13 +152,14 @@ jobs:
     steps:
       - name: Checkout pending changes
         if: ${{ !matrix.config.continuous-only || inputs.continuous-run }}
-        uses: protocolbuffers/protobuf-ci/checkout@v3
+        uses: protocolbuffers/protobuf-ci/checkout@v4
         with:
           ref: ${{ inputs.safe-checkout }}
       - name: bazel ${{ matrix.config.bazel_action }}
         if: ${{ !matrix.config.continuous-only || inputs.continuous-run }}
-        uses: protocolbuffers/protobuf-ci/bazel@v3
+        uses: protocolbuffers/protobuf-ci/bazel@v4
         with:
+          version: 7.1.2 # Bazel version
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
           bazel: ${{ matrix.config.bazel_action }} ${{ matrix.config.flags }} ${{ matrix.bazel_targets }}
           bazel-cache: objc_${{ matrix.platform }}_${{ matrix.config.name }}

third_party/protobuf/.github/workflows/test_php.yml

@@ -32,17 +32,17 @@ jobs:
           - name: 8.1 Optimized
             version: "8.1.14"
             version-short: "8.1"
-            command: composer test \&\& composer test_c
+            command: composer test && composer test_c
           - name: 8.1 Debug
             version: 8.1.14-dbg
             version-short: "8.1"
-            command: composer test \&\& composer test_c
+            command: composer test && composer test_c
             continuous-only: true
           - name: 8.1 Memory Leak
             version: 8.1.14-dbg
             version-short: "8.1"
             # Run specialized memory leak & multirequest tests.
-            command: composer test_c \&\& tests/multirequest.sh \&\& tests/memory_leak_test.sh
+            command: composer test_c && tests/multirequest.sh && tests/memory_leak_test.sh
             continuous-only: true
           - name: 8.1 Valgrind
             version: 8.1.14-dbg
@@ -52,30 +52,39 @@ jobs:
           - name: 8.3 Optimized
             version: "8.3.1"
             version-short: "8.3"
-            command: composer test \&\& composer test_c
+            command: composer test && composer test_c
 
     name: ${{ matrix.continuous-only && inputs.continuous-prefix || '' }} Linux ${{ matrix.name}}
     runs-on: ubuntu-22-4core
     steps:
       - name: Checkout pending changes
         if: ${{ !matrix.continuous-only || inputs.continuous-run }}
-        uses: protocolbuffers/protobuf-ci/checkout@v3
+        uses: protocolbuffers/protobuf-ci/checkout@v4
         with:
           ref: ${{ inputs.safe-checkout }}
       - name: Setup composer
         if: ${{ !matrix.continuous-only || inputs.continuous-run }}
-        uses: protocolbuffers/protobuf-ci/composer-setup@v3
+        uses: protocolbuffers/protobuf-ci/composer-setup@v4
         with:
           cache-prefix: php-${{ matrix.version-short }}
           directory: php
       - name: Run tests
         if: ${{ !matrix.continuous-only || inputs.continuous-run }}
-        uses: protocolbuffers/protobuf-ci/docker@v3
+        uses: protocolbuffers/protobuf-ci/bazel-docker@v4
         with:
-          image: us-docker.pkg.dev/protobuf-build/containers/test/linux/php:6.4.0-${{ matrix.version }}-27cf7b86212020d7e552bc13b1e084abb971da75
+          image: us-docker.pkg.dev/protobuf-build/containers/test/linux/php:7.1.2-${{ matrix.version }}-90d207f4e749b54c8792bbe974dfc70323b6566e
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
-          extra-flags: -e COMPOSER_HOME=/workspace/composer-cache
-          command: ${{ matrix.command }}
+          bazel-cache: php_linux/${{ matrix.version }}
+          bash: |
+            set -ex
+            COMPOSER_HOME=/workspace/composer-cache
+            export BAZEL_FLAGS='$BAZEL_FLAGS'
+            ./regenerate_stale_files.sh $BAZEL_FLAGS
+            pushd /workspace/php
+            composer update
+            ${{ matrix.command }}
+            popd
+            bazel test //php:conformance_test //php:conformance_test_c --action_env=PATH --test_env=PATH $BAZEL_FLAGS
 
   linux-32bit:
     strategy:
@@ -104,29 +113,29 @@ jobs:
     steps:
       - name: Checkout pending changes
         if: ${{ !matrix.continuous-only || inputs.continuous-run }}
-        uses: protocolbuffers/protobuf-ci/checkout@v3
+        uses: protocolbuffers/protobuf-ci/checkout@v4
         with:
           ref: ${{ inputs.safe-checkout }}
 
       - name: Cross compile protoc for i386
         if: ${{ !matrix.continuous-only || inputs.continuous-run }}
         id: cross-compile
-        uses: protocolbuffers/protobuf-ci/cross-compile-protoc@v3
+        uses: protocolbuffers/protobuf-ci/cross-compile-protoc@v4
         with:
-          image: us-docker.pkg.dev/protobuf-build/containers/common/linux/bazel:6.4.0-cf84e92285ca133b9c8104ad7b14d70e953cbb8e
+          image: us-docker.pkg.dev/protobuf-build/containers/common/linux/bazel:7.1.2-bec4e87effd62da1d4f9a13d377e37bcb80376c9
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
           architecture: linux-i386
 
       - name: Setup composer
         if: ${{ !matrix.continuous-only || inputs.continuous-run }}
-        uses: protocolbuffers/protobuf-ci/composer-setup@v3
+        uses: protocolbuffers/protobuf-ci/composer-setup@v4
         with:
           cache-prefix: php-${{ matrix.version }}
           directory: php
 
       - name: Run tests
         if: ${{ !matrix.continuous-only || inputs.continuous-run }}
-        uses: protocolbuffers/protobuf-ci/docker@v3
+        uses: protocolbuffers/protobuf-ci/docker@v4
         with:
           image: ${{ env.image }}
           platform: linux/386
@@ -139,50 +148,11 @@ jobs:
             composer update --ignore-platform-reqs;
             composer ${{ matrix.test }}'
 
-  linux-aarch64:
-    name: Linux aarch64
-    runs-on: ubuntu-22-4core
-    steps:
-      - name: Checkout pending changes
-        uses: protocolbuffers/protobuf-ci/checkout@v3
-        with:
-          ref: ${{ inputs.safe-checkout }}
-
-      - name: Cross compile protoc for aarch64
-        id: cross-compile
-        uses: protocolbuffers/protobuf-ci/cross-compile-protoc@v3
-        with:
-          image: us-docker.pkg.dev/protobuf-build/containers/common/linux/bazel:6.4.0-cf84e92285ca133b9c8104ad7b14d70e953cbb8e
-          credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
-          architecture: linux-aarch64
-
-      - name: Setup composer
-        uses: protocolbuffers/protobuf-ci/composer-setup@v3
-        with:
-          cache-prefix: php-8.1
-          directory: php
-
-      - name: Run tests
-        uses: protocolbuffers/protobuf-ci/docker@v3
-        with:
-          image: us-docker.pkg.dev/protobuf-build/containers/test/linux/php-aarch64@sha256:77ff9fdec867bbfb290ee0b10d8b7a3e5e434155daa5ec93de7341c7592b858d
-          platform: linux/arm64
-          credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
-          extra-flags: -e COMPOSER_HOME=/workspace/composer-cache -e PROTOC=/workspace/${{ steps.cross-compile.outputs.protoc }}
-          command: >-
-            -c '
-            cd php;
-            composer update --ignore-platform-reqs;
-            composer test;
-            composer test_c'
-
   macos:
     strategy:
       fail-fast: false   # Don't cancel all jobs if one fails.
       matrix:
         include:
-          - version: '8.2'
-            continuous-only: true
           - version: '8.3'
 
     name: ${{ matrix.continuous-only && inputs.continuous-prefix || '' }} MacOS PHP ${{ matrix.version }}
@@ -191,7 +161,7 @@ jobs:
     steps:
       - name: Checkout pending changes
         if: ${{ !matrix.continuous-only || inputs.continuous-run }}
-        uses: protocolbuffers/protobuf-ci/checkout@v3
+        uses: protocolbuffers/protobuf-ci/checkout@v4
         with:
           ref: ${{ inputs.safe-checkout }}
 
@@ -205,7 +175,7 @@ jobs:
 
       - name: Pin PHP version
         if: ${{ !matrix.continuous-only || inputs.continuous-run }}
-        uses: shivammathur/setup-php@8872c784b04a1420e81191df5d64fbd59d3d3033 # 2.30.2
+        uses: shivammathur/setup-php@c541c155eee45413f5b09a52248675b1a2575231 # 2.31.1
         with:
           php-version: ${{ matrix.version }}
 
@@ -215,14 +185,14 @@ jobs:
 
       - name: Setup composer
         if: ${{ !matrix.continuous-only || inputs.continuous-run }}
-        uses: protocolbuffers/protobuf-ci/composer-setup@v3
+        uses: protocolbuffers/protobuf-ci/composer-setup@v4
         with:
           cache-prefix: php-${{ matrix.version }}
           directory: php
 
       - name: Run tests
         if: ${{ !matrix.continuous-only || inputs.continuous-run }}
-        uses: protocolbuffers/protobuf-ci/bash@v3
+        uses: protocolbuffers/protobuf-ci/bash@v4
         with:
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
           command: |
@@ -235,8 +205,8 @@ jobs:
 
       - name: Run conformance tests
         if: ${{ !matrix.continuous-only || inputs.continuous-run }}
-        uses: protocolbuffers/protobuf-ci/bazel@v3
+        uses: protocolbuffers/protobuf-ci/bazel@v4
         with:
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
           bazel-cache: php_macos/${{ matrix.version }}
-          bazel: test //php:conformance_test_c --action_env=PATH --test_env=PATH
+          bazel: test //php:conformance_test //php:conformance_test_c --action_env=PATH --test_env=PATH

third_party/protobuf/.github/workflows/test_php_ext.yml

@@ -28,13 +28,14 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: protocolbuffers/protobuf-ci/checkout@v3
+        uses: protocolbuffers/protobuf-ci/checkout@v4
         with:
           ref: ${{ inputs.safe-checkout }}
 
       - name: Package extension
-        uses: protocolbuffers/protobuf-ci/bazel@v3
+        uses: protocolbuffers/protobuf-ci/bazel@v4
         with:
+          version: 7.1.2 # Bazel version
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
           bazel-cache: php_ext/${{ matrix.version }}
           bash: >
@@ -68,7 +69,7 @@ jobs:
 
       - name: Run tests
         if: ${{ !matrix.continuous-only || inputs.continuous-run }}
-        uses: protocolbuffers/protobuf-ci/docker@v3
+        uses: protocolbuffers/protobuf-ci/docker@v4
         with:
           image: us-docker.pkg.dev/protobuf-build/containers/test/linux/php-extension:${{ matrix.version }}-a48f26c08d9a803dd0177dda63563f6ea6f7b2d4
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}

third_party/protobuf/.github/workflows/test_python.yml

@@ -28,7 +28,9 @@ jobs:
       fail-fast: false   # Don't cancel all jobs if one fails.
       matrix:
         type: [ Pure, C++]
-        version: ["3.8", "3.9", "3.10", "3.11", "3.12"]
+        version: ["3.9", "3.10", "3.11", "3.12", "3.13"]
+        # TODO: Enable bzlmod once python headers are supported for python dist.
+        bzlmod: [--noenable_bzlmod]
         include:
           - type: Pure
             targets: //python/... //python:python_version_test
@@ -36,36 +38,38 @@ jobs:
           - type: C++
             targets: //python/... //python:python_version_test
             flags: --define=use_fast_cpp_protos=true
+          - version: "3.9"
+          - version: "3.10"
+            continuous-only: true
+          - version: "3.11"
+            continuous-only: true
+          - version: "3.12"
+            continuous-only: true
+          - version: "3.13"
           - type: C++
             version: aarch64
             targets: //python/... //python:aarch64_test
             # TODO Enable this once conformance tests are fixed.
             flags: --define=use_fast_cpp_protos=true --test_tag_filters=-conformance
-            image: us-docker.pkg.dev/protobuf-build/containers/test/linux/emulation:aarch64-63dd26c0c7a808d92673a3e52e848189d4ab0f17
-          - version: "3.8"
-          - version: "3.9"
-            continuous-only: true
-          - version: "3.10"
-            continuous-only: true
-          - version: "3.11"
+            bzlmod: --noenable_bzlmod
+            image: us-docker.pkg.dev/protobuf-build/containers/test/linux/emulation:7.1.2-aarch64-2920199ab0090ed427413a8e422e62695c8392a8
 
     name: ${{ matrix.continuous-only && inputs.continuous-prefix || '' }} Linux ${{ matrix.type }} ${{ matrix.version }}
     runs-on: ubuntu-latest
     steps:
       - name: Checkout pending changes
         if: ${{ !matrix.continuous-only || inputs.continuous-run }}
-        uses: protocolbuffers/protobuf-ci/checkout@v3
+        uses: protocolbuffers/protobuf-ci/checkout@v4
         with:
           ref: ${{ inputs.safe-checkout }}
       - name: Run tests
         if: ${{ !matrix.continuous-only || inputs.continuous-run }}
-        uses: protocolbuffers/protobuf-ci/bazel-docker@v3
+        uses: protocolbuffers/protobuf-ci/bazel-docker@v4
         with:
-          image: ${{ matrix.image || format('us-docker.pkg.dev/protobuf-build/containers/test/linux/python:6.4.0-{0}-27cf7b86212020d7e552bc13b1e084abb971da75', matrix.version) }}
+          image: ${{ matrix.image || format('us-docker.pkg.dev/protobuf-build/containers/test/linux/python:7.1.2-{0}-d9624f2aa83cba3eaf906f751d75b36aacb9aa82', matrix.version) }}
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
           bazel-cache: python_linux/${{ matrix.type }}_${{ matrix.version }}
-          bazel: test ${{ matrix.targets }} ${{ matrix.flags }} --test_env=KOKORO_PYTHON_VERSION
-          exclude-targets: -//python/pb_unit_tests/...
+          bazel: test ${{ matrix.targets }} ${{ matrix.flags }} ${{ matrix.bzlmod }} --test_env=KOKORO_PYTHON_VERSION
 
 
   macos:
@@ -73,25 +77,28 @@ jobs:
       fail-fast: false   # Don't cancel all jobs if one fails.
       matrix:
         type: [ Pure, C++]
-        # TODO Consider expanding this set of versions.
-        version: [ "3.12" ]
+        version: [ "3.12", "3.13" ]
+        # TODO: Enable bzlmod once python headers are supported for python dist.
+        bzlmod: [--noenable_bzlmod]
         include:
           - type: Pure
             targets: //python/... //python:python_version_test
           - type: C++
             targets: //python/... //python:python_version_test
             flags: --define=use_fast_cpp_protos=true
+          - version: "3.13"
+            continuous-only: true
 
     name: MacOS ${{ matrix.type }} ${{ matrix.version }}
     runs-on: macos-13
     steps:
       - name: Checkout pending changes
-        uses: protocolbuffers/protobuf-ci/checkout@v3
+        uses: protocolbuffers/protobuf-ci/checkout@v4
         with:
           ref: ${{ inputs.safe-checkout }}
 
       - name: Pin Python version
-        uses: actions/setup-python@61a6322f88396a6271a6ee3565807d608ecaddd1 # v4.7.0
+        uses: actions/setup-python@39cd14951b08e74b54015e9e001cdefcf80e669f #v5.1.1
         with:
           python-version: ${{ matrix.version }}
           cache: pip
@@ -106,14 +113,14 @@ jobs:
           source venv/bin/activate
 
       - name: Run tests
-        uses: protocolbuffers/protobuf-ci/bazel@v3
+        uses: protocolbuffers/protobuf-ci/bazel@v4
         env:
           KOKORO_PYTHON_VERSION: ${{ matrix.version }}
         with:
+          version: 7.1.2 # Bazel version
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
           bazel-cache: python_macos/${{ matrix.type }}_${{ matrix.version }}
           bazel: >-
-            test ${{ matrix.targets }} ${{ matrix.flags }}
+            test ${{ matrix.targets }} ${{ matrix.flags }} ${{ matrix.bzlmod }}
             --test_env=KOKORO_PYTHON_VERSION=${{ matrix.version }}
-            --macos_minimum_os=10.9
-          exclude-targets: -//python/pb_unit_tests/...
+            --macos_minimum_os=11.0

third_party/protobuf/.github/workflows/test_release_branches.yml

@@ -13,7 +13,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        branch: [25.x, 27.x, 28.x]
+        branch: [25.x, 29.x]
     runs-on: ubuntu-latest
     permissions:
       actions: write

third_party/protobuf/.github/workflows/test_ruby.yml

@@ -29,31 +29,32 @@ jobs:
       matrix:
         include:
           # Test both FFI and Native implementations on the highest and lowest
-          # Ruby versions for CRuby and JRuby, but only on Bazel 5.x.
-          - { name: Ruby 3.0, ruby: ruby-3.0.2, ffi: NATIVE }
-          - { name: Ruby 3.0, ruby: ruby-3.0.2, ffi: FFI, continuous-only: true }
-          - { name: Ruby 3.1, ruby: ruby-3.1.0, continuous-only: true }
-          - { name: Ruby 3.2, ruby: ruby-3.2.0, continuous-only: true }
-          - { name: Ruby 3.3, ruby: ruby-3.3.0, ffi: NATIVE }
-          - { name: Ruby 3.3, ruby: ruby-3.3.0, ffi: FFI }
-          - { name: JRuby 9.4, ruby: jruby-9.4.6.0, ffi: NATIVE }
-          - { name: JRuby 9.4, ruby: jruby-9.4.6.0, ffi: FFI }
+          # Ruby versions for CRuby and JRuby
+          - { name: Ruby 3.0, ruby: ruby-3.0.2, ffi: NATIVE, image: 'us-docker.pkg.dev/protobuf-build/containers/test/linux/ruby:7.1.2-ruby-3.0.2-d9624f2aa83cba3eaf906f751d75b36aacb9aa82' }
+          - { name: Ruby 3.0, ruby: ruby-3.0.2, ffi: FFI, continuous-only: true, image: 'us-docker.pkg.dev/protobuf-build/containers/test/linux/ruby:7.1.2-ruby-3.0.2-d9624f2aa83cba3eaf906f751d75b36aacb9aa82' }
+          - { name: Ruby 3.1, ruby: ruby-3.1.6, continuous-only: true }
+          - { name: Ruby 3.2, ruby: ruby-3.2.6, continuous-only: true }
+          - { name: Ruby 3.3, ruby: ruby-3.3.6, continuous-only: true }
+          - { name: Ruby 3.4, ruby: ruby-3.4.1, ffi: NATIVE }
+          - { name: Ruby 3.4, ruby: ruby-3.4.1, ffi: FFI }
+          - { name: JRuby 9.4, ruby: jruby-9.4.9.0, ffi: NATIVE }
+          - { name: JRuby 9.4, ruby: jruby-9.4.9.0, ffi: FFI }
 
     name: ${{ matrix.continuous-only && inputs.continuous-prefix || '' }} Linux ${{ matrix.name }} ${{ matrix.ffi == 'FFI' && ' FFI' || '' }}
     runs-on: ubuntu-latest
     steps:
       - name: Checkout pending changes
         if: ${{ !matrix.continuous-only || inputs.continuous-run }}
-        uses: protocolbuffers/protobuf-ci/checkout@v3
+        uses: protocolbuffers/protobuf-ci/checkout@v4
         with:
           ref: ${{ inputs.safe-checkout }}
       - name: Run tests
         if: ${{ !matrix.continuous-only || inputs.continuous-run }}
-        uses: protocolbuffers/protobuf-ci/bazel-docker@v3
+        uses: protocolbuffers/protobuf-ci/bazel-docker@v4
         with:
-          image: ${{ matrix.image || format('us-docker.pkg.dev/protobuf-build/containers/test/linux/ruby:6.4.0-{0}-27cf7b86212020d7e552bc13b1e084abb971da75', matrix.ruby) }}
+          image: ${{ matrix.image || format('us-docker.pkg.dev/protobuf-build/containers/test/linux/ruby:7.1.2-{0}-90d207f4e749b54c8792bbe974dfc70323b6566e', matrix.ruby) }}
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
-          bazel-cache: ruby_linux/${{ matrix.ruby }}_${{ matrix.bazel }}
+          bazel-cache: ruby_linux/${{ matrix.ruby }}
           bazel: test //ruby/... //ruby/tests:ruby_version --test_env=KOKORO_RUBY_VERSION --test_env=BAZEL=true ${{ matrix.ffi == 'FFI' && '--//ruby:ffi=enabled --test_env=PROTOCOL_BUFFERS_RUBY_IMPLEMENTATION=FFI' || '' }}
 # Useful tool for troubleshooting, but the action introduces flakes as well,
 # e.g. https://github.com/actions/upload-artifact/issues/569
@@ -69,20 +70,20 @@ jobs:
     runs-on: ubuntu-20-4core
     steps:
       - name: Checkout pending changes
-        uses: protocolbuffers/protobuf-ci/checkout@v3
+        uses: protocolbuffers/protobuf-ci/checkout@v4
         with:
           ref: ${{ inputs.safe-checkout }}
 
       - name: Cross compile protoc for i386
         id: cross-compile
-        uses: protocolbuffers/protobuf-ci/cross-compile-protoc@v3
+        uses: protocolbuffers/protobuf-ci/cross-compile-protoc@v4
         with:
-          image: us-docker.pkg.dev/protobuf-build/containers/common/linux/bazel:6.4.0-cf84e92285ca133b9c8104ad7b14d70e953cbb8e
+          image: us-docker.pkg.dev/protobuf-build/containers/common/linux/bazel:7.1.2-27cf7b86212020d7e552bc13b1e084abb971da75
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
           architecture: linux-i386
 
       - name: Run tests
-        uses: protocolbuffers/protobuf-ci/docker@v3
+        uses: protocolbuffers/protobuf-ci/docker@v4
         with:
           image: i386/ruby:3.0.2-buster
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
@@ -95,64 +96,34 @@ jobs:
             rake clobber_package gem;
             PROTOC=/workspace/${{ steps.cross-compile.outputs.protoc }} rake test'
 
-  linux-aarch64:
-    name: Linux aarch64
-    runs-on: ubuntu-20-4core
-    steps:
-      - name: Checkout pending changes
-        uses: protocolbuffers/protobuf-ci/checkout@v3
-        with:
-          ref: ${{ inputs.safe-checkout }}
-
-      - name: Cross compile protoc for aarch64
-        id: cross-compile
-        uses: protocolbuffers/protobuf-ci/cross-compile-protoc@v3
-        with:
-          image: us-docker.pkg.dev/protobuf-build/containers/common/linux/bazel:6.4.0-cf84e92285ca133b9c8104ad7b14d70e953cbb8e
-          credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
-          architecture: linux-aarch64
-
-      - name: Run tests
-        uses: protocolbuffers/protobuf-ci/docker@v3
-        with:
-          image: arm64v8/ruby:3.0.2-buster
-          credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
-          command: >-
-            /bin/bash -cex '
-            gem install bundler -v 2.5.13;
-            cd /workspace/ruby;
-            bundle;
-            PROTOC=/workspace/${{ steps.cross-compile.outputs.protoc }} rake;
-            rake clobber_package gem;
-            PROTOC=/workspace/${{ steps.cross-compile.outputs.protoc }} rake test'
-
   macos:
     strategy:
       fail-fast: false   # Don't cancel all jobs if one fails.
       matrix:
         include:
         # Test both FFI and Native implementations on the highest and lowest
-        # Ruby versions for CRuby, but only on Bazel 5.x.
+        # Ruby versions for CRuby.
         # Quote versions numbers otherwise 3.0 will render as 3
         - { version: "3.0", ffi: NATIVE }
         - { version: "3.0", ffi: FFI, continuous-only: true }
         - { version: "3.1", continuous-only: true }
         - { version: "3.2", continuous-only: true }
-        - { version: "3.3", ffi: NATIVE }
-        - { version: "3.3", ffi: FFI }
+        - { version: "3.3", continuous-only: true }
+        - { version: "3.4", ffi: NATIVE }
+        - { version: "3.4", ffi: FFI }
 
     name: ${{ matrix.continuous-only && inputs.continuous-prefix || '' }} MacOS Ruby ${{ matrix.version }}${{ matrix.ffi == 'FFI' && ' FFI' || '' }}
     runs-on: macos-13
     steps:
       - name: Checkout pending changes
         if: ${{ !matrix.continuous-only || inputs.continuous-run }}
-        uses: protocolbuffers/protobuf-ci/checkout@v3
+        uses: protocolbuffers/protobuf-ci/checkout@v4
         with:
           ref: ${{ inputs.safe-checkout }}
 
       - name: Pin Ruby version
         if: ${{ !matrix.continuous-only || inputs.continuous-run }}
-        uses: ruby/setup-ruby@961f85197f92e4842e3cb92a4f97bd8e010cdbaf # v1.165.0
+        uses: ruby/setup-ruby@4a9ddd6f338a97768b8006bf671dfbad383215f4 # v1.207.0
         with:
           ruby-version: ${{ matrix.version }}
 
@@ -162,8 +133,9 @@ jobs:
 
       - name: Run tests
         if: ${{ !matrix.continuous-only || inputs.continuous-run }}
-        uses: protocolbuffers/protobuf-ci/bazel@v3
+        uses: protocolbuffers/protobuf-ci/bazel@v4
         with:
+          version: 7.1.2 # Bazel version
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
           bazel-cache: ruby_macos/${{ matrix.version }}
           bazel: test //ruby/... --test_env=KOKORO_RUBY_VERSION=${{ matrix.version }} --test_env=BAZEL=true ${{ matrix.ffi == 'FFI' && '--//ruby:ffi=enabled --test_env=PROTOCOL_BUFFERS_RUBY_IMPLEMENTATION=FFI' || '' }}
@@ -175,28 +147,29 @@ jobs:
       matrix:
         include:
           # Test both FFI and Native implementations on the highest and lowest
-          # Ruby versions for CRuby and JRuby, but only on Bazel 5.x.
-          - { name: Ruby 3.0, ruby: ruby-3.0.2, ffi: NATIVE}
-          - { name: Ruby 3.0, ruby: ruby-3.0.2, ffi: FFI}
-          - { name: Ruby 3.1, ruby: ruby-3.1.0}
-          - { name: Ruby 3.2, ruby: ruby-3.2.0}
-          - { name: Ruby 3.3, ruby: ruby-3.3.0, ffi: NATIVE }
-          - { name: Ruby 3.3, ruby: ruby-3.3.0, ffi: FFI }
-          - { name: JRuby 9.4, ruby: jruby-9.4.6.0, ffi: NATIVE }
-          - { name: JRuby 9.4, ruby: jruby-9.4.6.0, ffi: FFI }
+          # Ruby versions for CRuby and JRuby.
+          - { name: Ruby 3.0, ruby: ruby-3.0.2, ffi: NATIVE, image: 'us-docker.pkg.dev/protobuf-build/containers/test/linux/ruby:7.1.2-ruby-3.0.2-d9624f2aa83cba3eaf906f751d75b36aacb9aa82'}
+          - { name: Ruby 3.0, ruby: ruby-3.0.2, ffi: FFI, image: 'us-docker.pkg.dev/protobuf-build/containers/test/linux/ruby:7.1.2-ruby-3.0.2-d9624f2aa83cba3eaf906f751d75b36aacb9aa82'}
+          - { name: Ruby 3.1, ruby: ruby-3.1.6}
+          - { name: Ruby 3.2, ruby: ruby-3.2.6}
+          - { name: Ruby 3.3, ruby: ruby-3.3.6}
+          - { name: Ruby 3.4, ruby: ruby-3.4.1, ffi: NATIVE }
+          - { name: Ruby 3.4, ruby: ruby-3.4.1, ffi: FFI }
+          - { name: JRuby 9.4, ruby: jruby-9.4.9.0, ffi: NATIVE }
+          - { name: JRuby 9.4, ruby: jruby-9.4.9.0, ffi: FFI }
     name: ${{ inputs.continuous-prefix }} Install ${{ matrix.name }}${{ matrix.ffi == 'FFI' && ' FFI' || '' }}
     runs-on: ubuntu-latest
     steps:
       - name: Checkout pending changes
         if: ${{ inputs.continuous-run }}
-        uses: protocolbuffers/protobuf-ci/checkout@v3
+        uses: protocolbuffers/protobuf-ci/checkout@v4
         with:
           ref: ${{ inputs.safe-checkout }}
       - name: Run tests
         if: ${{ inputs.continuous-run }}
-        uses: protocolbuffers/protobuf-ci/bazel-docker@v3
+        uses: protocolbuffers/protobuf-ci/bazel-docker@v4
         with:
-          image: us-docker.pkg.dev/protobuf-build/containers/test/linux/ruby:6.4.0-${{ matrix.ruby }}-27cf7b86212020d7e552bc13b1e084abb971da75
+          image: ${{ matrix.image || format('us-docker.pkg.dev/protobuf-build/containers/test/linux/ruby:7.1.2-{0}-90d207f4e749b54c8792bbe974dfc70323b6566e', matrix.ruby) }}
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
           bazel-cache: ruby_install/${{ matrix.ruby }}_${{ matrix.bazel }}
           bash: >

third_party/protobuf/.github/workflows/test_runner.yml

@@ -20,8 +20,6 @@ on:
     branches:
       - main
       - '[0-9]+.x'
-      # The 21.x and 22.x branches still use Kokoro
-      - '!2[12].x'
       # For testing purposes so we can stage this on the `gha` branch.
       - gha
 
@@ -30,8 +28,6 @@ on:
     branches:
       - main
       - '[0-9]+.x'
-      # The 21.x and 22.x branches still use Kokoro
-      - '!2[12].x'
       # For testing purposes so we can stage this on the `gha` branch.
       - gha
 
@@ -40,8 +36,6 @@ on:
     branches:
       - main
       - '[0-9]+.x'
-      # The 21.x branch still use Kokoro
-      - '!21.x'
       # For testing purposes so we can stage this on the `gha` branch.
       - gha
     types: [labeled, opened, reopened, synchronize]
@@ -54,7 +48,7 @@ permissions:
 
 concurrency:
   group: ${{ github.event_name }}-${{ github.workflow }}-${{ github.head_ref || github.ref }}
-  cancel-in-progress: ${{ contains(fromJSON('["pull_request", "pull_request_target", "workflow_dispatch"]'), github.event_name) }}
+  cancel-in-progress: ${{ contains(fromJSON('["pull_request", "pull_request_target", "workflow_dispatch", "schedule"]'), github.event_name) }}
 
 jobs:
   set-vars:
@@ -105,7 +99,7 @@ jobs:
       - name: Set Test Type Variables
         id: set-test-type-vars
         run: |
-          if ([ "${{ github.event_name }}" == 'pull_request' ] || [ "${{ github.event_name }}" == 'pull_request_target' ]) && ${{ !contains(toJson(github.event.pull_request.body), '\n#test-continuous') }}; then
+          if ([ "${{ github.event_name }}" == 'pull_request' ] || [ "${{ github.event_name }}" == 'pull_request_target' ]) && ${{ !contains(toJson(github.event.pull_request.body), '#test-continuous') }}; then
             echo "continuous-run=" >> "$GITHUB_OUTPUT"
             echo "continuous-prefix=[SKIPPED] (Continuous)" >> "$GITHUB_OUTPUT"
           else

third_party/protobuf/.github/workflows/test_rust.yml

@@ -14,29 +14,38 @@ permissions:
 jobs:
   # This job should be run on presubmit, if any continuous-only tests are added we will need to input test-type above
   linux:
-    name: Linux
+    strategy:
+      fail-fast: false   # Don't cancel all jobs if one fails.
+      matrix:
+        config:
+          - { name: Fastbuild, flags: --noenable_bzlmod }
+          - { name: Optimized, flags: --noenable_bzlmod --config=opt }
+          - { name: ASAN, flags: --noenable_bzlmod --config=asan }
+
+        include:
+          - targets: "//rust/... //src/google/protobuf/compiler/rust/..."
+          - image: "us-docker.pkg.dev/protobuf-build/containers/common/linux/bazel:7.1.2-27cf7b86212020d7e552bc13b1e084abb971da75"
+          - bazel_cmd: "test"
+
+          # Override cases with custom images
+          - config: { name: Cargo, flags: --noenable_bzlmod }
+            image: "us-docker.pkg.dev/protobuf-build/containers/release/linux/rust:7.1.2-1.74.0-d9624f2aa83cba3eaf906f751d75b36aacb9aa82"
+            bazel_cmd: "run"
+            targets: "//rust/release_crates:cargo_test"
+    name: Linux ${{ matrix.config.name }}
     runs-on: ubuntu-22-4core
     steps:
       - name: Checkout pending changes
-        uses: protocolbuffers/protobuf-ci/checkout@v3
+        uses: protocolbuffers/protobuf-ci/checkout@v4
         with:
           ref: ${{ inputs.safe-checkout }}
       - name: Run tests
-        uses: protocolbuffers/protobuf-ci/bazel-docker@v3
+        uses: protocolbuffers/protobuf-ci/bazel-docker@v4
         with:
-          image: "us-docker.pkg.dev/protobuf-build/containers/common/linux/bazel:7.1.1-97f82260fd504923d8af642d567afb2d83a1959d"
+          image: ${{ matrix.image }}
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
           bazel-cache: rust_linux
           bazel: >-
-            test --cxxopt=-std=c++17 --host_cxxopt=-std=c++17
-            //rust:all
-            //rust/test/rust_proto_library_unit_test:rust_upb_aspect_test
-            //src/google/protobuf/compiler/rust/...
-      - name: Run Cargo tests
-        uses: protocolbuffers/protobuf-ci/bazel-docker@v3
-        with:
-          image: "us-docker.pkg.dev/protobuf-build/containers/release/linux/rust:6.3.0-1.74.0-8858126dd9480abf91e6ce8d6e41a5cd3c03882c"
-          credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
-          bazel-cache: rust_linux
-          bazel: >-
-            run //rust:cargo_test
+            ${{ matrix.bazel_cmd }} --crosstool_top=//toolchain:clang_suite  --cxxopt=-std=c++17 --host_cxxopt=-std=c++17 --@rules_rust//rust/settings:experimental_use_cc_common_link=True
+            ${{ matrix.targets }} ${{ matrix.config.flags }}
+

third_party/protobuf/.github/workflows/test_upb.yml

@@ -28,7 +28,6 @@ jobs:
       fail-fast: false   # Don't cancel all jobs if one fails.
       matrix:
         config:
-          - { name: "Bazel 7", bazel_version: "7.1.1", continuous-only: true }
           - { name: "Fastbuild" }
           - { name: "Optimized", flags: "-c opt", continuous-only: true }
           - { name: "ASAN", flags: "--config=asan -c dbg", exclude-targets: "-//benchmarks:benchmark -//python/...", runner: ubuntu-22-4core }
@@ -43,17 +42,18 @@ jobs:
     steps:
       - name: Checkout pending changes
         if: ${{ !matrix.config.continuous-only || inputs.continuous-run }}
-        uses: protocolbuffers/protobuf-ci/checkout@v3
+        uses: protocolbuffers/protobuf-ci/checkout@v4
         with:
           ref: ${{ inputs.safe-checkout }}
       - name: Run tests
         if: ${{ !matrix.config.continuous-only || inputs.continuous-run }}
-        uses: protocolbuffers/protobuf-ci/bazel-docker@v3
+        uses: protocolbuffers/protobuf-ci/bazel-docker@v4
         with:
-          image: us-docker.pkg.dev/protobuf-build/containers/test/linux/sanitize:${{ matrix.config.bazel_version || '6.4.0' }}-27cf7b86212020d7e552bc13b1e084abb971da75
+          image: us-docker.pkg.dev/protobuf-build/containers/test/linux/sanitize:${{ matrix.config.bazel_version || '7.1.2' }}-2c05f44c25a209933743ddf0296ef0c1e583d2c3
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
           bazel-cache: upb-bazel
-          bazel: test --cxxopt=-std=c++17 --host_cxxopt=-std=c++17 //bazel/... //benchmarks/... //lua/... //python/... //upb/... //upb_generator/... ${{ matrix.config.flags }}
+          # TODO: Enable bzlmod once python headers are supported for python dist.
+          bazel: test --noenable_bzlmod --cxxopt=-std=c++17 --host_cxxopt=-std=c++17 //bazel/... //benchmarks/... //lua/... //python/... //upb/... //upb_generator/... ${{ matrix.config.flags }}
           exclude-targets: ${{ matrix.config.exclude-targets }}
 
   linux-gcc:
@@ -63,17 +63,17 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout pending changes
-        uses: protocolbuffers/protobuf-ci/checkout@v3
+        uses: protocolbuffers/protobuf-ci/checkout@v4
         with:
           ref: ${{ inputs.safe-checkout }}
       - name: Run tests
-        uses: protocolbuffers/protobuf-ci/bazel-docker@v3
+        uses: protocolbuffers/protobuf-ci/bazel-docker@v4
         with:
-          image: "us-docker.pkg.dev/protobuf-build/containers/test/linux/gcc:6.4.0-12.2-27cf7b86212020d7e552bc13b1e084abb971da75"
+          image: "us-docker.pkg.dev/protobuf-build/containers/test/linux/gcc:7.1.2-12.2-e78301df86b3e4c46ec9ac4d98be00e19305d8f3"
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
           bazel-cache: "upb-bazel-gcc"
           bazel: >-
-            test --cxxopt=-std=c++17 --host_cxxopt=-std=c++17 -c opt
+            test --noenable_bzlmod --cxxopt=-std=c++17 --host_cxxopt=-std=c++17 -c opt
             --copt="-Wno-error=maybe-uninitialized" --copt="-Wno-error=attributes"
             //bazel/... //benchmarks/... //lua/... //python/... //upb/... //upb_generator/...
 
@@ -84,20 +84,16 @@ jobs:
     runs-on: windows-2022
     steps:
       - name: Checkout pending changes
-        uses: protocolbuffers/protobuf-ci/checkout@v3
+        uses: protocolbuffers/protobuf-ci/checkout@v4
         with:
           ref: ${{ inputs.safe-checkout }}
-      - uses: actions/setup-python@61a6322f88396a6271a6ee3565807d608ecaddd1 # v4.7.0
-        with:
-          cache: pip
-          cache-dependency-path: 'python/requirements.txt'
       - name: Run tests
-        uses: protocolbuffers/protobuf-ci/bazel@v3
+        uses: protocolbuffers/protobuf-ci/bazel@v4
         with:
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
           bazel-cache: "upb-bazel-windows"
-          bazel: test --cxxopt=/std:c++17 --host_cxxopt=/std:c++17 //upb/... //upb_generator/... //python/...
-          version: 6.4.0
+          bazel: test --noenable_bzlmod --cxxopt=/std:c++17 --host_cxxopt=/std:c++17 //upb/... //upb_generator/... //python/...
+          version: 7.1.2
           exclude-targets: -//python:conformance_test -//upb/reflection:def_builder_test
 
   macos:
@@ -111,21 +107,22 @@ jobs:
     runs-on: macos-13
     steps:
       - name: Checkout pending changes
-        uses: protocolbuffers/protobuf-ci/checkout@v3
+        uses: protocolbuffers/protobuf-ci/checkout@v4
         with:
           ref: ${{ inputs.safe-checkout }}
-      - uses: actions/setup-python@61a6322f88396a6271a6ee3565807d608ecaddd1 # v4.7.0
+      - name: Setup Python
+        uses: actions/setup-python@61a6322f88396a6271a6ee3565807d608ecaddd1 # v4.7.0
         with:
           python-version: 3.12
           cache: pip
           cache-dependency-path: 'python/requirements.txt'
       - name: Run tests
-        uses: protocolbuffers/protobuf-ci/bazel@v3
+        uses: protocolbuffers/protobuf-ci/bazel@v4
         with:
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
           bazel-cache: "upb-bazel-macos"
-          bazel: ${{ matrix.config.bazel-command }} --cxxopt=-std=c++17 --host_cxxopt=-std=c++17 ${{ matrix.config.flags }} //bazel/... //benchmarks/... //lua/... //python/... //upb/... //upb_generator/...
-          version: 6.4.0
+          bazel: ${{ matrix.config.bazel-command }} --noenable_bzlmod --cxxopt=-std=c++17 --host_cxxopt=-std=c++17 ${{ matrix.config.flags }} //bazel/... //benchmarks/... //lua/... //python/... //upb/... //upb_generator/...
+          version: 7.1.2
 
   no-python:
     strategy:
@@ -134,20 +131,20 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout pending changes
-        uses: protocolbuffers/protobuf-ci/checkout@v3
+        uses: protocolbuffers/protobuf-ci/checkout@v4
         with:
           ref: ${{ inputs.safe-checkout }}
       - name: Run tests
-        uses: protocolbuffers/protobuf-ci/bazel-docker@v3
+        uses: protocolbuffers/protobuf-ci/bazel-docker@v4
         with:
-          image: us-docker.pkg.dev/protobuf-build/containers/common/linux/bazel:6.4.0-cf84e92285ca133b9c8104ad7b14d70e953cbb8e
+          image: us-docker.pkg.dev/protobuf-build/containers/common/linux/bazel:7.1.2-27cf7b86212020d7e552bc13b1e084abb971da75
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
           bazel-cache: "upb-bazel-no-python"
           bash: >-
             which python3 &&
             mv `which python3` /tmp &&
             ! which python3 &&
-            bazel test $BAZEL_FLAGS --cxxopt=-std=c++17 --host_cxxopt=-std=c++17 //python/... -- -//python/dist:source_wheel
+            bazel test $BAZEL_FLAGS --noenable_bzlmod --cxxopt=-std=c++17 --host_cxxopt=-std=c++17 //python/... -- -//python/dist:source_wheel -//python:aarch64_test -//python:x86_64_test -//python:google/protobuf/pyext/_message.so -//python:proto_api
 
   build_wheels:
     name: Build Wheels
@@ -155,16 +152,16 @@ jobs:
     if: ${{ github.event_name != 'pull_request_target' }}
     steps:
       - name: Checkout pending changes
-        uses: protocolbuffers/protobuf-ci/checkout@v3
+        uses: protocolbuffers/protobuf-ci/checkout@v4
         with:
           ref: ${{ inputs.safe-checkout }}
       - name: Build Wheels
-        uses: protocolbuffers/protobuf-ci/bazel-docker@v3
+        uses: protocolbuffers/protobuf-ci/bazel-docker@v4
         with:
-          image: us-docker.pkg.dev/protobuf-build/release-containers/linux/apple:6.4.0-5be0f4fde927ca702ed4cebe096bfb632d6d9a36
+          image: us-docker.pkg.dev/protobuf-build/release-containers/linux/apple:7.1.2-d9624f2aa83cba3eaf906f751d75b36aacb9aa82
           credentials: ${{ secrets.GAR_SERVICE_ACCOUNT }}
           bazel-cache: upb-bazel-python
-          bazel: build --crosstool_top=//toolchain:clang_suite --//toolchain:release=true --symlink_prefix=/ -c dbg //python/dist //python/dist:test_wheel //python/dist:source_wheel
+          bazel: build --noenable_bzlmod --crosstool_top=//toolchain:clang_suite --//toolchain:release=true --symlink_prefix=/ -c dbg --incompatible_enable_cc_toolchain_resolution=false //python/dist //python/dist:test_wheel //python/dist:source_wheel
       - name: Move Wheels
         run: mkdir wheels && find _build/out \( -name 'protobuf*.whl' -o -name 'protobuf-*.tar.gz' \) -exec mv '{}' wheels ';'
       - uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
@@ -186,26 +183,26 @@ jobs:
           # a single wheel. As a result we can just test the oldest and newest
           # supported Python versions and assume this gives us sufficient test
           # coverage.
-          - { os: ubuntu-latest, python-version: "3.8", architecture: x64, type: 'binary' }
-          - { os: macos-13, python-version: "3.8", architecture: x64, type: 'binary' }
+          - { os: ubuntu-latest, python-version: "3.9", architecture: x64, type: 'binary' }
+          - { os: macos-13, python-version: "3.9", architecture: x64, type: 'binary' }
           - { os: ubuntu-latest, python-version: "3.12", architecture: x64, type: 'binary' }
           - { os: macos-13, python-version: "3.12", architecture: x64, type: 'binary' }
-          - { os: ubuntu-latest, python-version: "3.8", architecture: x64, type: 'source', continuous-only: true }
-          - { os: macos-13, python-version: "3.8", architecture: x64, type: 'source', continuous-only: true }
           - { os: ubuntu-latest, python-version: "3.12", architecture: x64, type: 'source', continuous-only: true }
           - { os: macos-13, python-version: "3.12", architecture: x64, type: 'source', continuous-only: true }
+          - { os: ubuntu-latest, python-version: "3.13", architecture: x64, type: 'source', continuous-only: true }
+          - { os: macos-13, python-version: "3.13", architecture: x64, type: 'source', continuous-only: true }
 
           # Windows uses the full API up until Python 3.10.
-          - { os: windows-2019, python-version: "3.8", architecture: x86, type: 'binary', continuous-only: true }
           - { os: windows-2019, python-version: "3.9", architecture: x86, type: 'binary', continuous-only: true }
           - { os: windows-2019, python-version: "3.10", architecture: x86, type: 'binary', continuous-only: true }
           - { os: windows-2019, python-version: "3.11", architecture: x86, type: 'binary', continuous-only: true }
           - { os: windows-2019, python-version: "3.12", architecture: x86, type: 'binary', continuous-only: true }
-          - { os: windows-2019, python-version: "3.8", architecture: x64, type: 'binary' }
-          - { os: windows-2019, python-version: "3.9", architecture: x64, type: 'binary', continuous-only: true }
+          - { os: windows-2019, python-version: "3.13", architecture: x86, type: 'binary', continuous-only: true }
+          - { os: windows-2019, python-version: "3.9", architecture: x64, type: 'binary' }
           - { os: windows-2019, python-version: "3.10", architecture: x64, type: 'binary', continuous-only: true }
           - { os: windows-2019, python-version: "3.11", architecture: x64, type: 'binary', continuous-only: true }
-          - { os: windows-2019, python-version: "3.12", architecture: x64, type: 'binary' }
+          - { os: windows-2019, python-version: "3.12", architecture: x64, type: 'binary', continuous-only: true }
+          - { os: windows-2019, python-version: "3.13", architecture: x64, type: 'binary' }
     name: ${{ matrix.continuous-only && inputs.continuous-prefix || '' }} Test Wheels Python ${{ matrix.python-version }} ${{ matrix.os }} ${{ matrix.architecture }} ${{ matrix.type }}
     needs: build_wheels
     runs-on: ${{ matrix.os }}
@@ -226,7 +223,8 @@ jobs:
         with:
           name: requirements
           path: requirements
-      - uses: actions/setup-python@61a6322f88396a6271a6ee3565807d608ecaddd1 # v4.7.0
+      - name: Setup Python
+        uses: actions/setup-python@61a6322f88396a6271a6ee3565807d608ecaddd1 # v4.7.0
         if: ${{ !matrix.continuous-only || inputs.continuous-run }}
         with:
           python-version: ${{ matrix.python-version }}
@@ -262,12 +260,17 @@ jobs:
       - name: Install Protobuf Test Wheel
         if: ${{ !matrix.continuous-only || inputs.continuous-run }}
         run: pip install -vvv --no-index --find-links wheels protobuftests
-      - name: Run the unit tests
+      - name: Run unit tests
         if: ${{ !matrix.continuous-only || inputs.continuous-run }}
+        # Newer upb tests are in the standard google.protobuf.internal path.
+        # We will eventually make this into a wildcard rule once all tests
+        # have been migrated to be compatible with upb.
+        # TODO: b/378725969 - Use wildcard expansion to ensure that we don't
+        # accidentally miss test coverage.
         run: |
-          TESTS=$(pip show -f protobuftests | grep pb_unit_tests.*py$ | sed 's,/,.,g' | sed 's,\\,.,g' | sed -E 's,.py$,,g')
-          for test in $TESTS; do
-            python -m unittest -v $test
+          TESTS=(message_test message_factory_test descriptor_test proto_builder_test descriptor_pool_test generator_test reflection_test reflection_cpp_test)
+          for test in ${TESTS[@]}; do
+            python -m unittest -v google.protobuf.internal.${test}
           done
 
   test_pure_python_wheels:
@@ -276,7 +279,7 @@ jobs:
     strategy:
       fail-fast: false   # Don't cancel all jobs if one fails.
       matrix:
-        python-version: ["3.8", "3.12"]
+        python-version: ["3.9", "3.13"]
     runs-on: ubuntu-latest
     if: ${{ github.event_name != 'pull_request_target' }}
     steps:
@@ -287,7 +290,8 @@ jobs:
           path: wheels
       - name: Delete Binary Wheels
         run: find wheels -type f | grep -v none-any | xargs rm
-      - uses: actions/setup-python@61a6322f88396a6271a6ee3565807d608ecaddd1 # v4.7.0
+      - name: Setup Python
+        uses: actions/setup-python@61a6322f88396a6271a6ee3565807d608ecaddd1 # v4.7.0
         with:
           python-version: ${{ matrix.python-version }}
       - name: Setup Python venv
@@ -296,8 +300,13 @@ jobs:
           python -m venv env
           source env/bin/activate
           echo "VIRTUAL ENV:" $VIRTUAL_ENV
-      - name: Install numpy
-        run: pip install numpy
+      - name: Download Requirements
+        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 #4.1.8
+        with:
+          name: requirements
+          path: requirements
+      - name: Install requirements
+        run: pip install -r requirements/requirements.txt
       - name: Install Protobuf Wheels
         run: pip install -vvv --no-index --find-links wheels protobuf protobuftests
       - name: Run the unit tests

third_party/protobuf/.github/workflows/test_yaml.yml

@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout pending changes
-        uses: protocolbuffers/protobuf-ci/checkout@v3
+        uses: protocolbuffers/protobuf-ci/checkout@v4
         with:
           ref: ${{ inputs.safe-checkout }}
       - name: Run python validation script

third_party/protobuf/.gitignore

@@ -176,10 +176,14 @@ ruby/tests/multi_level_nesting_test_pb.rb
 ruby/tests/service_test_pb.rb
 ruby/tests/test_import_proto2_pb.rb
 ruby/tests/test_ruby_package_proto2_pb.rb
+ruby/tests/basic_test_features_pb.rb
+ruby/tests/generated_code_editions_pb.rb
+ruby/tests/repeated_field_test_pb.rb
+ruby/tests/stress_pb.rb
+ruby/tests/utf8_pb.rb
 ruby/compatibility_tests/v3.0.0/protoc
 ruby/compatibility_tests/v3.0.0/tests/generated_code_pb.rb
 ruby/compatibility_tests/v3.0.0/tests/test_import_pb.rb
-ruby/Gemfile.lock
 
 # IntelliJ CLion Config files and build output
 cmake/.idea

third_party/protobuf/.gitmodules

@@ -1,11 +0,0 @@
-[submodule "third_party/googletest"]
-	path = third_party/googletest
-	url = https://github.com/google/googletest.git
-	ignore = dirty
-[submodule "third_party/abseil-cpp"]
-	path = third_party/abseil-cpp
-	url = https://github.com/abseil/abseil-cpp.git
-	branch = lts_2023_08_02
-[submodule "third_party/jsoncpp"]
-	path = third_party/jsoncpp
-	url = https://github.com/open-source-parsers/jsoncpp.git

third_party/protobuf/BUILD.bazel

@@ -2,7 +2,6 @@
 
 load("@rules_cc//cc:defs.bzl", "cc_binary", "cc_library")
 load("@rules_license//rules:license.bzl", "license")
-load("@rules_pkg//pkg:mappings.bzl", "pkg_files", "strip_prefix")
 load("//bazel:cc_proto_library.bzl", "cc_proto_library")
 load("//bazel:java_lite_proto_library.bzl", "java_lite_proto_library")
 load("//bazel:java_proto_library.bzl", "java_proto_library")
@@ -24,6 +23,11 @@ license(
     license_text = ":LICENSE",
 )
 
+exports_files(
+    ["MODULE.bazel"],
+    visibility = ["//cmake:__pkg__"],
+)
+
 ################################################################################
 # Well Known Types Proto Library Rules
 #
@@ -464,6 +468,16 @@ alias(
     visibility = ["//visibility:public"],
 )
 
+################################################################################
+# Go support
+################################################################################
+
+alias(
+    name = "go_features_proto",
+    actual = "//go:go_features_proto",  # proto_library
+    visibility = ["//visibility:public"],
+)
+
 ################################################################################
 # Test protos
 ################################################################################
@@ -642,53 +656,3 @@ filegroup(
     srcs = glob(["**/*.bzl"]),
     visibility = ["//visibility:public"],
 )
-
-################################################################################
-# Packaging rules
-################################################################################
-
-# Files included in all source distributions
-pkg_files(
-    name = "common_dist_files",
-    srcs = glob(
-        [
-            "*.bzl",
-            "cmake/*.cmake",
-            "cmake/*.in",
-            "editors/*",
-        ],
-        allow_empty = True,
-    ) + [
-        "BUILD.bazel",
-        "CMakeLists.txt",
-        "CONTRIBUTORS.txt",
-        "LICENSE",
-        "README.md",
-        "WORKSPACE",
-        "cmake/README.md",
-        "generate_descriptor_proto.sh",
-        "maven_install.json",
-        "//third_party:BUILD.bazel",
-        "//third_party:zlib.BUILD",
-    ],
-    strip_prefix = strip_prefix.from_root(""),
-    visibility = ["//pkg:__pkg__"],
-)
-
-# Additional files for C#
-pkg_files(
-    name = "csharp_dist_files",
-    srcs = [
-        "global.json",
-    ],
-    visibility = ["//pkg:__pkg__"],
-)
-
-# Additional files for ObjC
-pkg_files(
-    name = "objectivec_dist_files",
-    srcs = [
-        "Protobuf.podspec",
-    ],
-    visibility = ["//pkg:__pkg__"],
-)

third_party/protobuf/CMakeLists.txt

@@ -1,6 +1,6 @@
 # Minimum CMake required. If available, accept the policy-controlled behavior up
 # to 3.26.
-cmake_minimum_required(VERSION 3.10...3.26)
+cmake_minimum_required(VERSION 3.16...3.26)
 
 # Revert to old behavior for MSVC debug symbols.
 if(POLICY CMP0141)
@@ -35,6 +35,8 @@ option(protobuf_BUILD_LIBUPB "Build libupb" ON)
 option(protobuf_DISABLE_RTTI "Remove runtime type information in the binaries" OFF)
 option(protobuf_TEST_XML_OUTDIR "Output directory for XML logs from tests." "")
 option(protobuf_ALLOW_CCACHE "Adjust build flags to allow for ccache support." OFF)
+option(protobuf_FORCE_FETCH_DEPENDENCIES "Force all dependencies to be downloaded from GitHub.  Local installations will be ignored." OFF)
+option(protobuf_LOCAL_DEPENDENCIES_ONLY "Prevent downloading any dependencies from GitHub. If this option is set, the dependency must be available locally as an installed package." OFF)
 
 # We support Unity (Jumbo) builds best-effort.
 option(protobuf_USE_UNITY_BUILD "Enable Unity (Jumbo) build for" OFF)
@@ -84,7 +86,7 @@ if (protobuf_BUILD_SHARED_LIBS)
 endif ()
 
 # Version metadata
-set(protobuf_VERSION_STRING "5.29.3")
+set(protobuf_VERSION_STRING "6.30.1")
 set(protobuf_DESCRIPTION "Protocol Buffers")
 set(protobuf_CONTACT "protobuf@googlegroups.com")
 
@@ -106,18 +108,21 @@ string(REGEX REPLACE     "${protobuf_VERSION_REGEX}" "\\3"
 string(REGEX REPLACE     "${protobuf_VERSION_REGEX}" "\\5"
   protobuf_VERSION_PRERELEASE "${protobuf_VERSION_STRING}")
 
-message(STATUS "${protobuf_VERSION_PRERELEASE}")
+if (protobuf_FORCE_FETCH_DEPENDENCIES AND protobuf_LOCAL_DEPENDENCIES_ONLY)
+  message(FATAL_ERROR "Conflicting options protobuf_FORCE_FETCH_DEPENDENCIES and protobuf_LOCAL_DEPENDENCIES_ONLY both set")
+endif()
 
 # Package version
 set(protobuf_VERSION
   "${protobuf_VERSION_MINOR}.${protobuf_VERSION_PATCH}")
 
 if(protobuf_VERSION_PRERELEASE)
+  message(STATUS "${protobuf_VERSION_PRERELEASE}")
   set(protobuf_VERSION "${protobuf_VERSION}.${protobuf_VERSION_PRERELEASE}")
 else()
   set(protobuf_VERSION "${protobuf_VERSION}.0")
 endif()
-message(STATUS "${protobuf_VERSION}")
+message(STATUS "protobuf version: ${protobuf_VERSION}")
 
 if(protobuf_VERBOSE)
   message(STATUS "Configuration script parsing status [")
@@ -153,14 +158,6 @@ file(REMOVE ${CMAKE_CURRENT_BINARY_DIR}/cmaketest.map)
 
 find_package(Threads REQUIRED)
 
-# We can install dependencies from submodules if we're running
-# CMake v3.13 or newer.
-if(CMAKE_VERSION VERSION_LESS 3.13)
-  set(_protobuf_INSTALL_SUPPORTED_FROM_MODULE OFF)
-else()
-  set(_protobuf_INSTALL_SUPPORTED_FROM_MODULE ON)
-endif()
-
 set(_protobuf_FIND_ZLIB)
 if (protobuf_WITH_ZLIB)
   find_package(ZLIB)
@@ -189,7 +186,7 @@ set(protobuf_LINK_LIBATOMIC false)
 if (NOT MSVC)
   include(CheckCXXSourceCompiles)
   set(OLD_CMAKE_REQUIRED_FLAGS ${CMAKE_REQUIRED_FLAGS})
-  set(CMAKE_REQUIRED_FLAGS ${CMAKE_REQUIRED_FLAGS} -std=c++14)
+  set(CMAKE_REQUIRED_FLAGS ${CMAKE_REQUIRED_FLAGS} -std=c++17)
   check_cxx_source_compiles("
     #include <atomic>
     int main() {
@@ -206,31 +203,11 @@ if (protobuf_BUILD_SHARED_LIBS)
   set(protobuf_SHARED_OR_STATIC "SHARED")
 else (protobuf_BUILD_SHARED_LIBS)
   set(protobuf_SHARED_OR_STATIC "STATIC")
-  # The CMAKE_<LANG>_FLAGS(_<BUILD_TYPE>)? is meant to be user controlled.
-  # Prior to CMake 3.15, the MSVC runtime library was pushed into the same flags
-  # making programmatic control difficult.  Prefer the functionality in newer
-  # CMake versions when available.
-  if(${CMAKE_VERSION} VERSION_GREATER 3.15 OR ${CMAKE_VERSION} VERSION_EQUAL 3.15)
-    if (protobuf_MSVC_STATIC_RUNTIME)
-        set(CMAKE_MSVC_RUNTIME_LIBRARY MultiThreaded$<$<CONFIG:Debug>:Debug>)
-    else()
-        set(CMAKE_MSVC_RUNTIME_LIBRARY MultiThreaded$<$<CONFIG:Debug>:Debug>DLL)
-    endif()
+  set(ABSL_MSVC_STATIC_RUNTIME ON)
+  if (protobuf_MSVC_STATIC_RUNTIME)
+      set(CMAKE_MSVC_RUNTIME_LIBRARY MultiThreaded$<$<CONFIG:Debug>:Debug>)
   else()
-    # In case we are building static libraries, link also the runtime library statically
-    # so that MSVCR*.DLL is not required at runtime.
-    # https://msdn.microsoft.com/en-us/library/2kzt1wy3.aspx
-    # This is achieved by replacing msvc option /MD with /MT and /MDd with /MTd
-    # http://www.cmake.org/Wiki/CMake_FAQ#How_can_I_build_my_MSVC_application_with_a_static_runtime.3F
-    if (MSVC AND protobuf_MSVC_STATIC_RUNTIME)
-      foreach(flag_var
-          CMAKE_CXX_FLAGS CMAKE_CXX_FLAGS_DEBUG CMAKE_CXX_FLAGS_RELEASE
-          CMAKE_CXX_FLAGS_MINSIZEREL CMAKE_CXX_FLAGS_RELWITHDEBINFO)
-        if(${flag_var} MATCHES "/MD")
-          string(REGEX REPLACE "/MD" "/MT" ${flag_var} "${${flag_var}}")
-        endif(${flag_var} MATCHES "/MD")
-      endforeach(flag_var)
-    endif (MSVC AND protobuf_MSVC_STATIC_RUNTIME)
+      set(CMAKE_MSVC_RUNTIME_LIBRARY MultiThreaded$<$<CONFIG:Debug>:Debug>DLL)
   endif()
 endif (protobuf_BUILD_SHARED_LIBS)
 
@@ -289,12 +266,6 @@ include_directories(
   ${protobuf_BINARY_DIR}/src
   ${protobuf_SOURCE_DIR}/src)
 
-set(protobuf_ABSL_PROVIDER "module" CACHE STRING "Provider of absl library")
-set_property(CACHE protobuf_ABSL_PROVIDER PROPERTY STRINGS "module" "package")
-
-set(protobuf_JSONCPP_PROVIDER "module" CACHE STRING "Provider of jsoncpp library")
-set_property(CACHE protobuf_JSONCPP_PROVIDER PROPERTY STRINGS "module" "package")
-
 if (protobuf_BUILD_TESTS)
   include(${protobuf_SOURCE_DIR}/cmake/gtest.cmake)
 endif (protobuf_BUILD_TESTS)

third_party/protobuf/Cargo.bazel.lock

@@ -1,5 +1,5 @@
 {
-  "checksum": "ca8913cc78d0ec771c537fae8d8e7b4505ab91bd61ddc886cc66dbeb264ff626",
+  "checksum": "422d164988d36886ae9aef8b60e233d67aac121356b66f1452c469f912cc0148",
   "crates": {
     "aho-corasick 1.1.2": {
       "name": "aho-corasick",
@@ -17,7 +17,7 @@
             "crate_name": "aho_corasick",
             "crate_root": "src/lib.rs",
             "srcs": {
-              "allow_empty": false,
+              "allow_empty": true,
               "include": [
                 "**/*.rs"
               ]
@@ -73,7 +73,7 @@
             "crate_name": "autocfg",
             "crate_root": "src/lib.rs",
             "srcs": {
-              "allow_empty": false,
+              "allow_empty": true,
               "include": [
                 "**/*.rs"
               ]
@@ -107,7 +107,7 @@
             "crate_name": "direct_cargo_bazel_deps",
             "crate_root": ".direct_cargo_bazel_deps.rs",
             "srcs": {
-              "allow_empty": false,
+              "allow_empty": true,
               "include": [
                 "**/*.rs"
               ]
@@ -164,7 +164,7 @@
             "crate_name": "googletest",
             "crate_root": "src/lib.rs",
             "srcs": {
-              "allow_empty": false,
+              "allow_empty": true,
               "include": [
                 "**/*.rs"
               ]
@@ -231,7 +231,7 @@
             "crate_name": "googletest_macro",
             "crate_root": "src/lib.rs",
             "srcs": {
-              "allow_empty": false,
+              "allow_empty": true,
               "include": [
                 "**/*.rs"
               ]
@@ -282,7 +282,7 @@
             "crate_name": "memchr",
             "crate_root": "src/lib.rs",
             "srcs": {
-              "allow_empty": false,
+              "allow_empty": true,
               "include": [
                 "**/*.rs"
               ]
@@ -329,7 +329,7 @@
             "crate_name": "num_traits",
             "crate_root": "src/lib.rs",
             "srcs": {
-              "allow_empty": false,
+              "allow_empty": true,
               "include": [
                 "**/*.rs"
               ]
@@ -341,7 +341,7 @@
             "crate_name": "build_script_build",
             "crate_root": "build.rs",
             "srcs": {
-              "allow_empty": false,
+              "allow_empty": true,
               "include": [
                 "**/*.rs"
               ]
@@ -374,6 +374,9 @@
         "version": "0.2.17"
       },
       "build_script_attrs": {
+        "compile_data_glob": [
+          "**"
+        ],
         "data_glob": [
           "**"
         ],
@@ -410,7 +413,7 @@
             "crate_name": "paste",
             "crate_root": "src/lib.rs",
             "srcs": {
-              "allow_empty": false,
+              "allow_empty": true,
               "include": [
                 "**/*.rs"
               ]
@@ -422,7 +425,7 @@
             "crate_name": "build_script_build",
             "crate_root": "build.rs",
             "srcs": {
-              "allow_empty": false,
+              "allow_empty": true,
               "include": [
                 "**/*.rs"
               ]
@@ -448,6 +451,9 @@
         "version": "1.0.14"
       },
       "build_script_attrs": {
+        "compile_data_glob": [
+          "**"
+        ],
         "data_glob": [
           "**"
         ]
@@ -475,7 +481,7 @@
             "crate_name": "proc_macro2",
             "crate_root": "src/lib.rs",
             "srcs": {
-              "allow_empty": false,
+              "allow_empty": true,
               "include": [
                 "**/*.rs"
               ]
@@ -487,7 +493,7 @@
             "crate_name": "build_script_build",
             "crate_root": "build.rs",
             "srcs": {
-              "allow_empty": false,
+              "allow_empty": true,
               "include": [
                 "**/*.rs"
               ]
@@ -523,6 +529,9 @@
         "version": "1.0.69"
       },
       "build_script_attrs": {
+        "compile_data_glob": [
+          "**"
+        ],
         "data_glob": [
           "**"
         ]
@@ -550,7 +559,7 @@
             "crate_name": "quote",
             "crate_root": "src/lib.rs",
             "srcs": {
-              "allow_empty": false,
+              "allow_empty": true,
               "include": [
                 "**/*.rs"
               ]
@@ -605,7 +614,7 @@
             "crate_name": "regex",
             "crate_root": "src/lib.rs",
             "srcs": {
-              "allow_empty": false,
+              "allow_empty": true,
               "include": [
                 "**/*.rs"
               ]
@@ -687,7 +696,7 @@
             "crate_name": "regex_automata",
             "crate_root": "src/lib.rs",
             "srcs": {
-              "allow_empty": false,
+              "allow_empty": true,
               "include": [
                 "**/*.rs"
               ]
@@ -770,7 +779,7 @@
             "crate_name": "regex_syntax",
             "crate_root": "src/lib.rs",
             "srcs": {
-              "allow_empty": false,
+              "allow_empty": true,
               "include": [
                 "**/*.rs"
               ]
@@ -824,7 +833,7 @@
             "crate_name": "rustversion",
             "crate_root": "src/lib.rs",
             "srcs": {
-              "allow_empty": false,
+              "allow_empty": true,
               "include": [
                 "**/*.rs"
               ]
@@ -836,7 +845,7 @@
             "crate_name": "build_script_build",
             "crate_root": "build/build.rs",
             "srcs": {
-              "allow_empty": false,
+              "allow_empty": true,
               "include": [
                 "**/*.rs"
               ]
@@ -862,6 +871,9 @@
         "version": "1.0.14"
       },
       "build_script_attrs": {
+        "compile_data_glob": [
+          "**"
+        ],
         "data_glob": [
           "**"
         ]
@@ -889,7 +901,7 @@
             "crate_name": "syn",
             "crate_root": "src/lib.rs",
             "srcs": {
-              "allow_empty": false,
+              "allow_empty": true,
               "include": [
                 "**/*.rs"
               ]
@@ -958,7 +970,7 @@
             "crate_name": "unicode_ident",
             "crate_root": "src/lib.rs",
             "srcs": {
-              "allow_empty": false,
+              "allow_empty": true,
               "include": [
                 "**/*.rs"
               ]
@@ -997,15 +1009,15 @@
     "aarch64-apple-ios-sim": [
       "aarch64-apple-ios-sim"
     ],
-    "aarch64-fuchsia": [
-      "aarch64-fuchsia"
-    ],
     "aarch64-linux-android": [
       "aarch64-linux-android"
     ],
     "aarch64-pc-windows-msvc": [
       "aarch64-pc-windows-msvc"
     ],
+    "aarch64-unknown-fuchsia": [
+      "aarch64-unknown-fuchsia"
+    ],
     "aarch64-unknown-linux-gnu": [
       "aarch64-unknown-linux-gnu"
     ],
@@ -1063,15 +1075,15 @@
     "wasm32-wasi": [
       "wasm32-wasi"
     ],
+    "wasm32-wasip1": [
+      "wasm32-wasip1"
+    ],
     "x86_64-apple-darwin": [
       "x86_64-apple-darwin"
     ],
     "x86_64-apple-ios": [
       "x86_64-apple-ios"
     ],
-    "x86_64-fuchsia": [
-      "x86_64-fuchsia"
-    ],
     "x86_64-linux-android": [
       "x86_64-linux-android"
     ],
@@ -1081,6 +1093,9 @@
     "x86_64-unknown-freebsd": [
       "x86_64-unknown-freebsd"
     ],
+    "x86_64-unknown-fuchsia": [
+      "x86_64-unknown-fuchsia"
+    ],
     "x86_64-unknown-linux-gnu": [
       "x86_64-unknown-linux-gnu"
     ],

third_party/protobuf/DIR_METADATA

@@ -1,6 +0,0 @@
-monorail: {
-  component: "Internals>Core"
-}
-buganizer_public: {
-  component_id: 1456128
-}

third_party/protobuf/MODULE.bazel

@@ -3,7 +3,7 @@
 
 module(
     name = "protobuf",
-    version = "29.3",  # Automatically updated on release
+    version = "30.1",  # Automatically updated on release
     compatibility_level = 1,
     repo_name = "com_google_protobuf",
 )
@@ -12,98 +12,55 @@ module(
 # Bzlmod follows MVS:
 # https://bazel.build/versions/6.0.0/build/bzlmod#version-resolution
 # Thus the highest version in their module graph is resolved.
-bazel_dep(
-    name = "abseil-cpp",
-    version = "20230802.0.bcr.1",
-    repo_name = "com_google_absl",
-)
 
-bazel_dep(
-    name = "bazel_skylib",
-    version = "1.7.0",
-)
+# These dependencies must be declared before the other rules dependencies.
+bazel_dep(name = "rules_apple", version = "3.13.0", repo_name = "build_bazel_rules_apple")
+bazel_dep(name = "apple_support", version = "1.15.1", repo_name = "build_bazel_apple_support")
 
-bazel_dep(
-    name = "jsoncpp",
-    version = "1.9.5",
-)
+#ifndef PROTO2_OPENSOURCE
+# LINT.IfChange
+#endif // PROTO2_OPENSOURCE
+# protoc dependencies
+bazel_dep(name = "abseil-cpp", version = "20250127.0")
+bazel_dep(name = "rules_cc", version = "0.0.17")
+bazel_dep(name = "zlib", version = "1.3.1.bcr.5")
+#ifndef PROTO2_OPENSOURCE
+# LINT.ThenChange(//depot/google3/third_party/protobuf/compiler/notices.h)
+#endif // PROTO2_OPENSOURCE
 
-bazel_dep(
-    name = "rules_cc",
-    version = "0.0.16",
-)
-
-bazel_dep(
-    name = "rules_fuzzing",
-    version = "0.5.2",
-)
-
-bazel_dep(
-    name = "rules_java",
-    version = "7.12.2",
-)
-
-bazel_dep(
-    name = "rules_jvm_external",
-    version = "6.3",
-)
-
-bazel_dep(
-    name = "rules_kotlin",
-    version = "1.9.6",
-)
-
-bazel_dep(
-    name = "rules_license",
-    version = "1.0.0",
-)
-
-bazel_dep(
-    name = "rules_pkg",
-    version = "1.0.1",
-)
-
-bazel_dep(
-    name = "rules_python",
-    version = "0.28.0",
-)
-
-bazel_dep(
-    name = "platforms",
-    version = "0.0.8",
-)
-
-bazel_dep(
-    name = "zlib",
-    version = "1.3.1",
-)
-
-bazel_dep(
-    name = "bazel_features",
-    version = "1.17.0",
-    repo_name = "proto_bazel_features",
-)
-
-bazel_dep(
-    name = "rules_shell",
-    version = "0.2.0"
-)
+# other dependencies
+bazel_dep(name = "bazel_features", version = "1.23.0", repo_name = "proto_bazel_features")
+bazel_dep(name = "bazel_skylib", version = "1.7.1")
+bazel_dep(name = "jsoncpp", version = "1.9.6")
+bazel_dep(name = "rules_fuzzing", version = "0.5.2")
+bazel_dep(name = "rules_java", version = "8.6.1")
+bazel_dep(name = "rules_jvm_external", version = "6.3")
+bazel_dep(name = "rules_kotlin", version = "1.9.6")
+bazel_dep(name = "rules_license", version = "1.0.0")
+bazel_dep(name = "rules_pkg", version = "1.0.1")
+bazel_dep(name = "rules_python", version = "1.0.0")
+bazel_dep(name = "rules_rust", version = "0.51.0")
+bazel_dep(name = "rules_shell", version = "0.2.0")
+bazel_dep(name = "platforms", version = "0.0.10")
 
 # Proto toolchains
 register_toolchains("//bazel/private/toolchains:all")
 
 SUPPORTED_PYTHON_VERSIONS = [
-    "3.8",
     "3.9",
     "3.10",
     "3.11",
     "3.12",
 ]
 
+# TODO: Support hermetic / system python in bzlmod.
 python = use_extension("@rules_python//python/extensions:python.bzl", "python")
 
 [
     python.toolchain(
+        # Disable root warning for .pyc cache misses since CI runs as root.
+        # See https://github.com/bazelbuild/rules_python/pull/713
+        ignore_root_user_error = True,
         is_default = python_version == SUPPORTED_PYTHON_VERSIONS[-1],
         python_version = python_version,
     )
@@ -115,31 +72,26 @@ use_repo(
     system_python = "python_{}".format(SUPPORTED_PYTHON_VERSIONS[-1].replace(".", "_")),
 )
 
-pip = use_extension("@rules_python//python/extensions:pip.bzl", "pip")
+pip = use_extension("@rules_python//python/extensions:pip.bzl", "pip", dev_dependency = True)
 
 [
     pip.parse(
-        hub_name = "pip_deps",
+        hub_name = "protobuf_pip_deps",
         python_version = python_version,
         requirements_lock = "//python:requirements.txt",
     )
     for python_version in SUPPORTED_PYTHON_VERSIONS
 ]
 
-use_repo(pip, "pip_deps")
+use_repo(pip, "protobuf_pip_deps")
 
-maven = use_extension("@rules_jvm_external//:extensions.bzl", "maven")
-
-maven.install(
+protobuf_maven = use_extension("@rules_jvm_external//:extensions.bzl", "maven", dev_dependency = True)
+protobuf_maven.install(
     name = "protobuf_maven",
     artifacts = [
         "com.google.caliper:caliper:1.0-beta-3",
-        "com.google.code.findbugs:jsr305:3.0.2",
-        "com.google.code.gson:gson:2.8.9",
-        "com.google.errorprone:error_prone_annotations:2.5.1",
-        "com.google.j2objc:j2objc-annotations:2.8",
-        "com.google.guava:guava:32.0.1-jre",
         "com.google.guava:guava-testlib:32.0.1-jre",
+        "com.google.testparameterinjector:test-parameter-injector:1.18",
         "com.google.truth:truth:1.1.2",
         "junit:junit:4.13.2",
         "org.mockito:mockito-core:4.3.1",
@@ -151,32 +103,39 @@ maven.install(
         "https://repo.maven.apache.org/maven2",
     ],
 )
+use_repo(protobuf_maven, "protobuf_maven")
 
-use_repo(maven, "protobuf_maven")
+maven = use_extension("@rules_jvm_external//:extensions.bzl", "maven")
+maven.install(
+    name = "maven",
+    artifacts = [
+        "com.google.code.findbugs:jsr305:3.0.2",
+        "com.google.code.gson:gson:2.8.9",
+        "com.google.errorprone:error_prone_annotations:2.5.1",
+        "com.google.j2objc:j2objc-annotations:2.8",
+        "com.google.guava:guava:32.0.1-jre",
+    ],
+    repositories = [
+        "https://repo1.maven.org/maven2",
+        "https://repo.maven.apache.org/maven2",
+    ],
+)
+use_repo(maven, "maven")
 
 # Development dependencies
+bazel_dep(name = "googletest", version = "1.14.0", dev_dependency = True)
+bazel_dep(name = "rules_buf", version = "0.3.0", dev_dependency = True)
+bazel_dep(name = "rules_testing", version = "0.6.0", dev_dependency = True)
 bazel_dep(
-    name = "googletest",
-    version = "1.14.0",
+    name = "abseil-py",
+    version = "2.1.0",
     dev_dependency = True,
-    repo_name = "com_google_googletest",
+    repo_name = "com_google_absl_py",
 )
 
-bazel_dep(
-    name = "rules_buf",
-    version = "0.3.0",
-    dev_dependency = True,
-)
-
-bazel_dep(
-    name = "rules_testing",
-    version = "0.6.0",
-    dev_dependency = True,
-)
+# For clang-cl configuration
+cc_configure = use_extension("@rules_cc//cc:extensions.bzl", "cc_configure_extension")
+use_repo(cc_configure, "local_config_cc")
 
 # rules_proto are needed for @com_google_protobuf_v25.0 used in //compatibility/... tests
-bazel_dep(
-    name = "rules_proto",
-    version = "4.0.0",
-    dev_dependency = True,
-)
+bazel_dep(name = "rules_proto", version = "4.0.0", dev_dependency = True)

third_party/protobuf/OWNERS

@@ -1,5 +0,0 @@
-holte@chromium.org
-sophiechang@chromium.org
-wittman@chromium.org
-
-evanstade@microsoft.com #{LAST_RESORT_SUGGESTION}

third_party/protobuf/Protobuf-C++.podspec

@@ -1,48 +0,0 @@
-Pod::Spec.new do |s|
-  s.name     = 'Protobuf-C++'
-  s.version  = '5.29.3'
-  s.summary  = 'Protocol Buffers v3 runtime library for C++.'
-  s.homepage = 'https://github.com/google/protobuf'
-  s.license  = 'BSD-3-Clause'
-  s.authors  = { 'The Protocol Buffers contributors' => 'protobuf@googlegroups.com' }
-
-  # Ensure developers won't hit CocoaPods/CocoaPods#11402 with the resource
-  # bundle for the privacy manifest.
-  s.cocoapods_version = '>= 1.12.0'
-
-  s.source = { :git => 'https://github.com/google/protobuf.git',
-               :tag => "v#{s.version}" }
-
-  s.source_files = 'src/google/protobuf/*.{h,cc,inc}',
-                   'src/google/protobuf/stubs/*.{h,cc}',
-                   'src/google/protobuf/io/*.{h,cc}',
-                   'src/google/protobuf/util/*.{h,cc}'
-
-  # Excluding all the tests in the directories above
-  s.exclude_files = 'src/google/**/*_test.{h,cc,inc}',
-                    'src/google/**/*_unittest.{h,cc}',
-                    'src/google/protobuf/test_util*.{h,cc}',
-                    'src/google/protobuf/map_lite_test_util.{h,cc}',
-                    'src/google/protobuf/map_test_util*.{h,cc,inc}',
-                    'src/google/protobuf/reflection_tester.{h,cc}'
-
-  s.resource_bundle = {
-    "Protobuf-C++_Privacy" => "PrivacyInfo.xcprivacy"
-  }
-
-  s.header_mappings_dir = 'src'
-
-  s.ios.deployment_target = '12.0'
-  s.osx.deployment_target = '10.13'
-  s.tvos.deployment_target = '12.0'
-  s.watchos.deployment_target = '6.0'
-  s.visionos.deployment_target = '1.0'
-
-  s.pod_target_xcconfig = {
-    # Do not let src/google/protobuf/stubs/time.h override system API
-    'USE_HEADERMAP' => 'NO',
-    'ALWAYS_SEARCH_USER_PATHS' => 'NO',
-    'HEADER_SEARCH_PATHS' => '"$(PODS_TARGET_SRCROOT)/src"'
-  }
-
-end

third_party/protobuf/Protobuf.podspec

@@ -5,7 +5,7 @@
 # dependent projects use the :git notation to refer to the library.
 Pod::Spec.new do |s|
   s.name     = 'Protobuf'
-  s.version  = '3.29.3'
+  s.version  = '4.30.1'
   s.summary  = 'Protocol Buffers v.3 runtime library for Objective-C.'
   s.homepage = 'https://github.com/protocolbuffers/protobuf'
   s.license  = 'BSD-3-Clause'
@@ -18,17 +18,7 @@ Pod::Spec.new do |s|
   s.source = { :git => 'https://github.com/protocolbuffers/protobuf.git',
                :tag => "v#{s.version}" }
 
-  s.source_files = 'objectivec/*.{h,m,swift}',
-                   'objectivec/google/protobuf/Any.pbobjc.h',
-                   'objectivec/google/protobuf/Api.pbobjc.h',
-                   'objectivec/google/protobuf/Duration.pbobjc.h',
-                   'objectivec/google/protobuf/Empty.pbobjc.h',
-                   'objectivec/google/protobuf/FieldMask.pbobjc.h',
-                   'objectivec/google/protobuf/SourceContext.pbobjc.h',
-                   'objectivec/google/protobuf/Struct.pbobjc.h',
-                   'objectivec/google/protobuf/Timestamp.pbobjc.h',
-                   'objectivec/google/protobuf/Type.pbobjc.h',
-                   'objectivec/google/protobuf/Wrappers.pbobjc.h'
+  s.source_files = 'objectivec/*.{h,m,swift}'
   # The following would cause duplicate symbol definitions. GPBProtocolBuffers is expected to be
   # left out, as it's an umbrella implementation file.
   s.exclude_files = 'objectivec/GPBProtocolBuffers.m'
@@ -44,8 +34,10 @@ Pod::Spec.new do |s|
   s.user_target_xcconfig = { 'GCC_PREPROCESSOR_DEFINITIONS' => '$(inherited) GPB_USE_PROTOBUF_FRAMEWORK_IMPORTS=1' }
   s.pod_target_xcconfig = { 'GCC_PREPROCESSOR_DEFINITIONS' => '$(inherited) GPB_USE_PROTOBUF_FRAMEWORK_IMPORTS=1' }
 
-  s.ios.deployment_target = '10.0'
-  s.osx.deployment_target = '10.13'
+  s.ios.deployment_target = '15.0'
+  s.osx.deployment_target = '11.0'
+  # The following are best-effort / community supported, and are not covered by
+  # our official support policies: https://protobuf.dev/support/version-support/
   s.tvos.deployment_target = '12.0'
   s.watchos.deployment_target = '6.0'
   s.visionos.deployment_target = '1.0'

third_party/protobuf/README.chromium

@@ -3,9 +3,9 @@ Short Name: protobuf
 URL: https://github.com/google/protobuf
 License: BSD-3-Clause
 License File: LICENSE
-Version: 29.3
-CPEPrefix: cpe:/a:google:protobuf:29.3
-Revision: b407e8416e3893036aee5af9a12bd9b6a0e2b2e6
+Version: 30.1
+CPEPrefix: cpe:/a:google:protobuf:30.1
+Revision: 0d815c5b74281f081c1ee4b431a4d5bbb1615c97
 Security Critical: yes
 Shipped: yes
 
@@ -203,11 +203,6 @@ Description of the patches:
 
   Replaces usage of absl internal string routines with std::string::resize().
 
-- 0046-absl-log.patch
-
-  Remove unused includes of absl/log.h (usages have already been updated to
-  absl_log.h i.e. ABSL_LOG). Note this is already fixed on trunk protobuf.
-
 - 0047-perfetto-backcompat.patch
 
   Undoes protobuf breaking change to support Perfetto's use of
@@ -246,7 +241,3 @@ Description of the patches:
   Add the compatability dir to .gitignore as it's unnecessary and contains files
   that trip CheckForTooLargeFiles presubmit.
 
-- 0054-remove-usage-if-absl-internal-if_constexpr.patch
-
-  Remove usage of absl internal if_constexpr. This has been upstreamed in
-  02/19/2025, so this patch can be removed on the roll in v31.

third_party/protobuf/README.md

@@ -33,6 +33,57 @@ of your project, you should pin to a release commit on a release branch.
 This is because even release branches can experience some instability in between
 release commits.
 
+### Bazel with Bzlmod
+
+Protobuf supports
+[Bzlmod](https://bazel.build/external/module) with Bazel 7 +.
+Users should specify a dependency on protobuf in their MODULE.bazel file as
+follows.
+
+```
+bazel_dep(name = "protobuf", version = <VERSION>)
+```
+
+Users can optionally override the repo name, such as for compatibility with
+WORKSPACE.
+
+```
+bazel_dep(name = "protobuf", version = <VERSION>, repo_name = "com_google_protobuf")
+```
+
+### Bazel with WORKSPACE
+
+Users can also add the following to their legacy
+[WORKSPACE](https://bazel.build/external/overview#workspace-system) file.
+
+Note that with the release of 30.x there are a few more load statements to
+properly set up rules_java and rules_python.
+
+```
+http_archive(
+    name = "com_google_protobuf",
+    strip_prefix = "protobuf-VERSION",
+    sha256 = ...,
+    url = ...,
+)
+
+load("@com_google_protobuf//:protobuf_deps.bzl", "protobuf_deps")
+
+protobuf_deps()
+
+load("@rules_java//java:rules_java_deps.bzl", "rules_java_dependencies")
+
+rules_java_dependencies()
+
+load("@rules_java//java:repositories.bzl", "rules_java_toolchains")
+
+rules_java_toolchains()
+
+load("@rules_python//python:repositories.bzl", "py_repositories")
+
+py_repositories()
+```
+
 Protobuf Compiler Installation
 ------------------------------
 

third_party/protobuf/WORKSPACE

@@ -3,48 +3,54 @@ workspace(name = "com_google_protobuf")
 # An explicit self-reference to work around changes in Bazel 7.0
 # See https://github.com/bazelbuild/bazel/issues/19973#issuecomment-1787814450
 # buildifier: disable=duplicated-name
-local_repository(name = "com_google_protobuf", path = ".")
+local_repository(
+    name = "com_google_protobuf",
+    path = ".",
+)
 
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 
-local_repository(
-    name = "com_google_protobuf_examples",
-    path = "examples",
-)
-
 # Load common dependencies first to ensure we use the correct version
 load("//:protobuf_deps.bzl", "PROTOBUF_MAVEN_ARTIFACTS", "protobuf_deps")
 
 protobuf_deps()
 
+load("@rules_java//java:rules_java_deps.bzl", "rules_java_dependencies")
+
+rules_java_dependencies()
+
+load("@rules_java//java:repositories.bzl", "rules_java_toolchains")
+
+rules_java_toolchains()
+
+load("@bazel_features//:deps.bzl", "bazel_features_deps")
+
+bazel_features_deps()
+
 load("@rules_python//python:repositories.bzl", "py_repositories")
 
 py_repositories()
 
-load("@rules_python//python/pip_install:repositories.bzl", "pip_install_dependencies")
-
-pip_install_dependencies()
-
 # Bazel platform rules.
 http_archive(
     name = "platforms",
+    sha256 = "218efe8ee736d26a3572663b374a253c012b716d8af0c07e842e82f238a0a7ee",
     urls = [
-        "https://mirror.bazel.build/github.com/bazelbuild/platforms/releases/download/0.0.7/platforms-0.0.7.tar.gz",
-        "https://github.com/bazelbuild/platforms/releases/download/0.0.7/platforms-0.0.7.tar.gz",
+        "https://mirror.bazel.build/github.com/bazelbuild/platforms/releases/download/0.0.10/platforms-0.0.10.tar.gz",
+        "https://github.com/bazelbuild/platforms/releases/download/0.0.10/platforms-0.0.10.tar.gz",
     ],
-    sha256 = "3a561c99e7bdbe9173aa653fd579fe849f1d8d67395780ab4770b1f381431d51",
 )
 
 http_archive(
-    name = "com_google_googletest",
+    name = "googletest",
     sha256 = "7315acb6bf10e99f332c8a43f00d5fbb1ee6ca48c52f6b936991b216c586aaad",
     strip_prefix = "googletest-1.15.0",
     urls = [
-        "https://github.com/google/googletest/releases/download/v1.15.0/googletest-1.15.0.tar.gz" # 2024-07-15
+        "https://github.com/google/googletest/releases/download/v1.15.0/googletest-1.15.0.tar.gz",  # 2024-07-15
     ],
 )
 
-load("@com_google_googletest//:googletest_deps.bzl", "googletest_deps")
+load("@googletest//:googletest_deps.bzl", "googletest_deps")
 
 googletest_deps()
 
@@ -59,7 +65,7 @@ rules_jvm_external_setup()
 load("@rules_jvm_external//:defs.bzl", "maven_install")
 
 maven_install(
-    name = "protobuf_maven",
+    name = "maven",
     artifacts = PROTOBUF_MAVEN_ARTIFACTS,
     # For updating instructions, see:
     # https://github.com/bazelbuild/rules_jvm_external#updating-maven_installjson
@@ -70,10 +76,34 @@ maven_install(
     ],
 )
 
-load("@protobuf_maven//:defs.bzl", "pinned_maven_install")
-
+load("@maven//:defs.bzl", "pinned_maven_install")
 pinned_maven_install()
 
+maven_install(
+    name = "protobuf_maven",
+    artifacts = [
+        "com.google.caliper:caliper:1.0-beta-3",
+        "com.google.guava:guava-testlib:32.0.1-jre",
+        "com.google.testparameterinjector:test-parameter-injector:1.18",
+        "com.google.truth:truth:1.1.2",
+        "junit:junit:4.13.2",
+        "org.mockito:mockito-core:4.3.1",
+        "biz.aQute.bnd:biz.aQute.bndlib:6.4.0",
+        "info.picocli:picocli:4.6.3",
+    ],
+    # For updating instructions, see:
+    # https://github.com/bazelbuild/rules_jvm_external#updating-maven_installjson
+    maven_install_json = "//:maven_dev_install.json",
+    repositories = [
+        "https://repo1.maven.org/maven2",
+        "https://repo.maven.apache.org/maven2",
+    ],
+)
+
+load("@protobuf_maven//:defs.bzl", pinned_protobuf_maven_install = "pinned_maven_install")
+pinned_protobuf_maven_install()
+
+
 # For `cc_proto_blacklist_test` and `build_test`.
 load("@bazel_skylib//:workspace.bzl", "bazel_skylib_workspace")
 
@@ -91,16 +121,12 @@ load("@build_bazel_apple_support//lib:repositories.bzl", "apple_support_dependen
 
 apple_support_dependencies()
 
-load("@rules_java//java:repositories.bzl", "rules_java_dependencies", "rules_java_toolchains")
-
-rules_java_dependencies()
-
-rules_java_toolchains()
-
-load("@rules_cc//cc:repositories.bzl", "rules_cc_dependencies")
+load("@rules_cc//cc:repositories.bzl", "rules_cc_dependencies", "rules_cc_toolchains")
 
 rules_cc_dependencies()
 
+rules_cc_toolchains()
+
 # For `kt_jvm_library`
 load("@rules_kotlin//kotlin:repositories.bzl", "kotlin_repositories")
 
@@ -112,11 +138,11 @@ kt_register_toolchains()
 
 http_archive(
     name = "rules_ruby",
+    integrity = "sha256-Lh/xxR6WsKJnS92sYkpJDBtdS6DNrCbi0kuUxBffG6E=",
+    strip_prefix = "rules_ruby-588d9dd40487277e2560ece09fe310d7c0ecb4a6",
     urls = [
-      "https://github.com/protocolbuffers/rules_ruby/archive/b7f3e9756f3c45527be27bc38840d5a1ba690436.zip"
+        "https://github.com/protocolbuffers/rules_ruby/archive/588d9dd40487277e2560ece09fe310d7c0ecb4a6.zip",
     ],
-    strip_prefix = "rules_ruby-b7f3e9756f3c45527be27bc38840d5a1ba690436",
-    sha256 = "347927fd8de6132099fcdc58e8f7eab7bde4eb2fd424546b9cd4f1c6f8f8bad8",
 )
 
 load("@rules_ruby//ruby:defs.bzl", "ruby_runtime")
@@ -141,6 +167,7 @@ load("@system_ruby//:bundle.bzl", "ruby_bundle")
 ruby_bundle(
     name = "protobuf_bundle",
     srcs = ["//ruby:google-protobuf.gemspec"],
+    bundler_version = "2.4.22",
     gemfile = "//ruby:Gemfile",
 )
 
@@ -157,38 +184,47 @@ http_archive(
 
 http_archive(
     name = "com_github_google_benchmark",
-    urls = ["https://github.com/google/benchmark/archive/0baacde3618ca617da95375e0af13ce1baadea47.zip"],
-    strip_prefix = "benchmark-0baacde3618ca617da95375e0af13ce1baadea47",
     sha256 = "62e2f2e6d8a744d67e4bbc212fcfd06647080de4253c97ad5c6749e09faf2cb0",
+    strip_prefix = "benchmark-0baacde3618ca617da95375e0af13ce1baadea47",
+    urls = ["https://github.com/google/benchmark/archive/0baacde3618ca617da95375e0af13ce1baadea47.zip"],
 )
 
 http_archive(
     name = "com_google_googleapis",
-    urls = ["https://github.com/googleapis/googleapis/archive/d81d0b9e6993d6ab425dff4d7c3d05fb2e59fa57.zip"],
-    strip_prefix = "googleapis-d81d0b9e6993d6ab425dff4d7c3d05fb2e59fa57",
-    sha256 = "d986023c3d8d2e1b161e9361366669cac9fb97c2a07e656c2548aca389248bb4",
     build_file = "//benchmarks:BUILD.googleapis",
     patch_cmds = ["find google -type f -name BUILD.bazel -delete"],
+    sha256 = "d986023c3d8d2e1b161e9361366669cac9fb97c2a07e656c2548aca389248bb4",
+    strip_prefix = "googleapis-d81d0b9e6993d6ab425dff4d7c3d05fb2e59fa57",
+    urls = ["https://github.com/googleapis/googleapis/archive/d81d0b9e6993d6ab425dff4d7c3d05fb2e59fa57.zip"],
 )
 
 load("@system_python//:pip.bzl", "pip_parse")
 
 pip_parse(
-    name = "pip_deps",
+    name = "protobuf_pip_deps",
     requirements = "//python:requirements.txt",
 )
 
-load("@pip_deps//:requirements.bzl", "install_deps")
+load("@protobuf_pip_deps//:requirements.bzl", "install_deps")
 
 install_deps()
 
+http_archive(
+    name = "com_google_absl_py",
+    sha256 = "8a3d0830e4eb4f66c4fa907c06edf6ce1c719ced811a12e26d9d3162f8471758",
+    strip_prefix = "abseil-py-2.1.0",
+    urls = [
+        "https://github.com/abseil/abseil-py/archive/refs/tags/v2.1.0.tar.gz",
+    ],
+)
+
 http_archive(
     name = "rules_fuzzing",
+    patch_args = ["-p1"],
+    patches = ["//third_party:rules_fuzzing.patch"],
     sha256 = "77206c54b71f4dd5335123a6ff2a8ea688eca5378d34b4838114dff71652cf26",
     strip_prefix = "rules_fuzzing-0.5.1",
     urls = ["https://github.com/bazelbuild/rules_fuzzing/releases/download/v0.5.1/rules_fuzzing-0.5.1.zip"],
-    patches = ["//third_party:rules_fuzzing.patch"],
-    patch_args = ["-p1"],
 )
 
 load("@rules_fuzzing//fuzzing:repositories.bzl", "rules_fuzzing_dependencies")
@@ -205,8 +241,8 @@ fuzzing_py_deps_install_deps()
 
 http_archive(
     name = "rules_rust",
-    integrity = "sha256-F8U7+AC5MvMtPKGdLLnorVM84cDXKfDRgwd7/dq3rUY=",
-    urls = ["https://github.com/bazelbuild/rules_rust/releases/download/0.46.0/rules_rust-v0.46.0.tar.gz"],
+    integrity = "sha256-r09Wyq5QqZpov845sUG1Cd1oVIyCBLmKt6HK/JTVuwI=",
+    urls = ["https://github.com/bazelbuild/rules_rust/releases/download/0.54.1/rules_rust-v0.54.1.tar.gz"],
 )
 
 load("@rules_rust//rust:repositories.bzl", "rules_rust_dependencies", "rust_register_toolchains")
@@ -214,7 +250,9 @@ load("@rules_rust//rust:repositories.bzl", "rules_rust_dependencies", "rust_regi
 rules_rust_dependencies()
 
 rust_register_toolchains(edition = "2021")
+
 load("@rules_rust//crate_universe:defs.bzl", "crate", "crates_repository")
+
 # to repin, invoke `CARGO_BAZEL_REPIN=1 bazel sync --only=crate_index`
 crates_repository(
     name = "crate_index",
@@ -226,27 +264,28 @@ crates_repository(
             rev = "b407f3b5774defb8917d714bfb7af485e117d621",
         ),
         "paste": crate.spec(
-          version = ">=1",
+            version = ">=1",
         ),
     },
 )
 
 load("@crate_index//:defs.bzl", "crate_repositories")
+
 crate_repositories()
 
 # For testing runtime against old gencode from a previous major version.
 http_archive(
     name = "com_google_protobuf_v25.0",
+    integrity = "sha256-e+7ZxRHWMs/3wirACU3Xcg5VAVMDnV2n4Fm8zrSIR0o=",
     strip_prefix = "protobuf-25.0",
     url = "https://github.com/protocolbuffers/protobuf/releases/download/v25.0/protobuf-25.0.tar.gz",
 )
 
 # Needed as a dependency of @com_google_protobuf_v25.0
-load("@com_google_protobuf_v25.0//:protobuf_deps.bzl", protobuf_v25_deps="protobuf_deps")
+load("@com_google_protobuf_v25.0//:protobuf_deps.bzl", protobuf_v25_deps = "protobuf_deps")
+
 protobuf_v25_deps()
 
-# Needed for testing only
-load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 http_archive(
     name = "rules_testing",
     sha256 = "02c62574631876a4e3b02a1820cb51167bb9cdcdea2381b2fa9d9b8b11c407c4",

third_party/protobuf/WORKSPACE.bzlmod

@@ -9,10 +9,10 @@ load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 http_archive(
     name = "rules_ruby",
     urls = [
-      "https://github.com/protocolbuffers/rules_ruby/archive/b7f3e9756f3c45527be27bc38840d5a1ba690436.zip"
+      "https://github.com/protocolbuffers/rules_ruby/archive/588d9dd40487277e2560ece09fe310d7c0ecb4a6.zip"
     ],
-    strip_prefix = "rules_ruby-b7f3e9756f3c45527be27bc38840d5a1ba690436",
-    sha256 = "347927fd8de6132099fcdc58e8f7eab7bde4eb2fd424546b9cd4f1c6f8f8bad8",
+    strip_prefix = "rules_ruby-588d9dd40487277e2560ece09fe310d7c0ecb4a6",
+    integrity = "sha256-Lh/xxR6WsKJnS92sYkpJDBtdS6DNrCbi0kuUxBffG6E=",
 )
 
 load("@rules_ruby//ruby:defs.bzl", "ruby_runtime")
@@ -21,11 +21,49 @@ ruby_runtime("system_ruby")
 
 register_toolchains("@system_ruby//:toolchain")
 
+load("@system_ruby//:bundle.bzl", "ruby_bundle")
+
+ruby_bundle(
+    name = "protobuf_bundle",
+    srcs = ["//ruby:google-protobuf.gemspec"],
+    bundler_version = "2.4.22",
+    gemfile = "//ruby:Gemfile",
+)
+
+# For testing UPB.
+http_archive(
+    name = "lua",
+    build_file = "//python/dist:lua.BUILD",
+    sha256 = "b9e2e4aad6789b3b63a056d442f7b39f0ecfca3ae0f1fc0ae4e9614401b69f4b",
+    strip_prefix = "lua-5.2.4",
+    urls = [
+        "https://mirror.bazel.build/www.lua.org/ftp/lua-5.2.4.tar.gz",
+        "https://www.lua.org/ftp/lua-5.2.4.tar.gz",
+    ],
+)
+
+http_archive(
+    name = "com_github_google_benchmark",
+    sha256 = "62e2f2e6d8a744d67e4bbc212fcfd06647080de4253c97ad5c6749e09faf2cb0",
+    strip_prefix = "benchmark-0baacde3618ca617da95375e0af13ce1baadea47",
+    urls = ["https://github.com/google/benchmark/archive/0baacde3618ca617da95375e0af13ce1baadea47.zip"],
+)
+
+http_archive(
+    name = "com_google_googleapis",
+    build_file = "//benchmarks:BUILD.googleapis",
+    patch_cmds = ["find google -type f -name BUILD.bazel -delete"],
+    sha256 = "d986023c3d8d2e1b161e9361366669cac9fb97c2a07e656c2548aca389248bb4",
+    strip_prefix = "googleapis-d81d0b9e6993d6ab425dff4d7c3d05fb2e59fa57",
+    urls = ["https://github.com/googleapis/googleapis/archive/d81d0b9e6993d6ab425dff4d7c3d05fb2e59fa57.zip"],
+)
+
 # Following are just needed to run conformance tests, not really needed to support them via MODULE.bazel
 
 # For testing runtime against old gencode from a previous major version.
 http_archive(
     name = "com_google_protobuf_v25.0",
+    integrity = "sha256-e+7ZxRHWMs/3wirACU3Xcg5VAVMDnV2n4Fm8zrSIR0o=",
     strip_prefix = "protobuf-25.0",
     url = "https://github.com/protocolbuffers/protobuf/releases/download/v25.0/protobuf-25.0.tar.gz",
 )
@@ -34,7 +72,6 @@ http_archive(
 load("@com_google_protobuf_v25.0//:protobuf_deps.bzl", protobuf_v25_deps="protobuf_deps")
 protobuf_v25_deps()
 
-
 # Needed for checking breaking changes from the previous release version.
 load("//:protobuf_version.bzl", "PROTOBUF_PREVIOUS_RELEASE")
 

third_party/protobuf/bazel/common/proto_lang_toolchain_info.bzl

@@ -1,6 +1,6 @@
 """ProtoLangToolchainInfo"""
 
-load("//bazel/private:native.bzl", "native_proto_common")  # buildifier: disable=bzl-visibility
+load("//bazel/private:native.bzl", "native_proto_common")
 
 # Use Starlark implementation only if native_proto_common.ProtoLangToolchainInfo doesn't exist
 ProtoLangToolchainInfo = getattr(native_proto_common, "ProtoLangToolchainInfo", provider(

third_party/protobuf/bazel/java_lite_proto_library.bzl

@@ -13,4 +13,4 @@ def java_lite_proto_library(**kwattrs):
     if not hasattr(native, "java_lite_proto_library"):
         _java_lite_proto_library(**kwattrs)
     else:
-        native.java_lite_proto_library(**kwattrs)
+        native.java_lite_proto_library(**kwattrs)  # buildifier: disable=native-java-lite-proto

third_party/protobuf/bazel/java_proto_library.bzl

@@ -13,4 +13,4 @@ def java_proto_library(**kwattrs):
     if not hasattr(native, "java_proto_library"):
         _java_proto_library(**kwattrs)
     else:
-        native.java_proto_library(**kwattrs)
+        native.java_proto_library(**kwattrs)  # buildifier: disable=native-java-proto

third_party/protobuf/bazel/private/BUILD

@@ -95,7 +95,9 @@ bzl_library(
         "java_lite_proto_library.bzl",
         "java_proto_support.bzl",
     ],
-    visibility = ["//bazel:__subpackages__"],
+    visibility = [
+        "//bazel:__subpackages__",
+    ],
     deps = [
         ":toolchain_helpers_bzl",
         "//bazel/common:proto_common_bzl",
@@ -148,6 +150,14 @@ bzl_library(
     ],
 )
 
+bzl_library(
+    name = "cc_proto_aspect_bzl",
+    srcs = ["cc_proto_aspect.bzl"],
+    deps = [
+        ":bazel_cc_proto_library_bzl",
+    ],
+)
+
 bzl_library(
     name = "toolchain_helpers_bzl",
     srcs = [

third_party/protobuf/bazel/private/bazel_java_proto_library_rule.bzl

@@ -154,7 +154,6 @@ rules to generate Java code for.
         ),
         # buildifier: disable=attr-license (calling attr.license())
         "licenses": attr.license() if hasattr(attr, "license") else attr.string_list(),
-        "distribs": attr.string_list(),
     } | toolchains.if_legacy_toolchain({
         "_aspect_java_proto_toolchain": attr.label(
             default = configuration_field(fragment = "proto", name = "proto_toolchain_for_java"),

third_party/protobuf/bazel/private/cc_proto_aspect.bzl

@@ -0,0 +1,7 @@
+"""Exposes cc_proto_aspect to rules_rust"""
+
+load("@proto_bazel_features//:features.bzl", "bazel_features")
+load("//bazel/private:bazel_cc_proto_library.bzl", _cc_proto_aspect = "cc_proto_aspect")  # buildifier: disable=bzl-visibility
+
+# This resolves to Starlark cc_proto_aspect in Bazel 8 or with --incompatible_enable_autoload flag
+cc_proto_aspect = getattr(bazel_features.globals, "cc_proto_aspect", None) or _cc_proto_aspect

third_party/protobuf/bazel/private/java_lite_proto_library.bzl

@@ -95,7 +95,6 @@ def _rule_impl(ctx):
     Returns:
       ([JavaInfo, DefaultInfo, OutputGroupInfo, ProguardSpecInfo])
     """
-
     proto_toolchain_info = toolchains.find_toolchain(
         ctx,
         "_aspect_proto_toolchain_for_javalite",
@@ -109,7 +108,7 @@ def _rule_impl(ctx):
     if runtime:
         proguard_provider_specs = runtime[ProguardSpecInfo]
     else:
-        proguard_provider_specs = ProguardSpecInfo(specs = depset())
+        proguard_provider_specs = ProguardSpecInfo(depset())
 
     java_info = java_info_merge_for_protos([dep[JavaInfo] for dep in ctx.attr.deps], merge_java_outputs = False)
 
@@ -176,3 +175,6 @@ rules to generate Java code for.
     provides = [JavaInfo],
     toolchains = toolchains.use_toolchain(_JAVA_LITE_PROTO_TOOLCHAIN),
 )
+
+# public re-export, note that we can't rename the original symbol because that changes the aspect id
+java_lite_proto_aspect = _java_lite_proto_aspect

third_party/protobuf/bazel/private/proto_bazel_features.bzl

@@ -16,7 +16,8 @@ _PROTO_BAZEL_FEATURES = """bazel_features = struct(
   ),
   globals = struct(
     PackageSpecificationInfo = {PackageSpecificationInfo},
-    ProtoInfo = getattr(getattr(native, 'legacy_globals', None), 'ProtoInfo', {ProtoInfo})
+    ProtoInfo = getattr(getattr(native, 'legacy_globals', None), 'ProtoInfo', {ProtoInfo}),
+    cc_proto_aspect = getattr(getattr(native, 'legacy_globals', None), 'cc_proto_aspect', {cc_proto_aspect}),
   ),
 )
 """
@@ -35,6 +36,7 @@ def _proto_bazel_features_impl(rctx):
 
     protobuf_on_allowlist = major_version_int > 7
     ProtoInfo = "ProtoInfo" if major_version_int < 8 else "None"
+    cc_proto_aspect = "cc_proto_aspect" if major_version_int < 8 else "None"
 
     rctx.file("BUILD.bazel", """
 load("@bazel_skylib//:bzl_library.bzl", "bzl_library")
@@ -50,6 +52,7 @@ exports_files(["features.bzl"])
         PackageSpecificationInfo = "PackageSpecificationInfo" if PackageSpecificationInfo else "None",
         protobuf_on_allowlist = repr(protobuf_on_allowlist),
         ProtoInfo = ProtoInfo,
+        cc_proto_aspect = cc_proto_aspect,
     ))
 
 proto_bazel_features = repository_rule(

third_party/protobuf/bazel/private/toolchains/BUILD.bazel

@@ -1,4 +1,3 @@
-load("//bazel/toolchains:proto_lang_toolchain.bzl", "proto_lang_toolchain")
 load("//bazel/toolchains:proto_toolchain.bzl", "proto_toolchain")
 
 # Keep this file as small as possible and free of any unnecessary loads

third_party/protobuf/bazel/private/upb_proto_library_internal/aspect.bzl

@@ -228,7 +228,7 @@ def upb_proto_aspect_impl(
     if not getattr(ctx.rule.attr, "srcs", []):
         # This target doesn't declare any sources, reexport all its deps instead.
         # This is known as an "alias library":
-        #    https://bazel.build/reference/be/protocol-buffer#proto_library.srcs
+        # https://bazel.build/versions/6.4.0/reference/be/protocol-buffer#proto_library.srcs
         files = _merge_generated_srcs([dep[file_provider].srcs for dep in ctx.rule.attr.deps])
         wrapped_cc_info = cc_provider(
             cc_info = cc_common.merge_cc_infos(direct_cc_infos = dep_ccinfos),

third_party/protobuf/bazel/private/upb_proto_library_internal/cc_library_func.bzl

@@ -5,7 +5,7 @@ load("@bazel_tools//tools/cpp:toolchain_utils.bzl", "find_cpp_toolchain", "use_c
 def upb_use_cpp_toolchain():
     return use_cpp_toolchain()
 
-def cc_library_func(ctx, name, hdrs, srcs, copts, includes, dep_ccinfos):
+def cc_library_func(ctx, name, hdrs, srcs, copts, dep_ccinfos, includes = []):
     """Like cc_library(), but callable from rules.
 
     Args:
@@ -14,8 +14,8 @@ def cc_library_func(ctx, name, hdrs, srcs, copts, includes, dep_ccinfos):
       hdrs: Public headers that can be #included from other rules.
       srcs: C/C++ source files.
       copts: Additional options for cc compilation.
-      includes: Additional include paths.
       dep_ccinfos: CcInfo providers of dependencies we should build/link against.
+      includes: Additional include paths.
 
     Returns:
       CcInfo provider for this compilation.

third_party/protobuf/bazel/proto_library.bzl

@@ -17,4 +17,4 @@ def proto_library(**kwattrs):
         _proto_library(**kwattrs)
     else:
         # On older Bazel versions keep using native rules, so that mismatch in ProtoInfo doesn't happen
-        native.proto_library(**kwattrs)
+        native.proto_library(**kwattrs)  # buildifier: disable=native-proto

third_party/protobuf/bazel/py_proto_library.bzl

@@ -44,8 +44,9 @@ def _py_proto_aspect_impl(target, ctx):
 
     # Check Proto file names
     for proto in target[ProtoInfo].direct_sources:
-        if proto.is_source and "-" in proto.dirname:
-            fail("Cannot generate Python code for a .proto whose path contains '-' ({}).".format(
+        import_path = proto_common.get_import_path(proto)
+        if proto.is_source and "-" in import_path:
+            fail("Cannot generate Python code for a .proto whose python import path contains '-' ({}).".format(
                 proto.path,
             ))
 
@@ -76,7 +77,12 @@ def _py_proto_aspect_impl(target, ctx):
             proto_root = proto_root[len(ctx.bin_dir.path) + 1:]
 
         plugin_output = ctx.bin_dir.path + "/" + proto_root
-        proto_root = ctx.workspace_name + "/" + proto_root
+
+        # Import path within the runfiles tree
+        if proto_root.startswith("external/"):
+            proto_root = proto_root[len("external") + 1:]
+        else:
+            proto_root = ctx.workspace_name + "/" + proto_root
 
         proto_common.compile(
             actions = ctx.actions,

third_party/protobuf/bazel/system_python.bzl

@@ -1,17 +0,0 @@
-# Copyright (c) 2009-2021, Google LLC
-# All rights reserved.
-#
-# Use of this source code is governed by a BSD-style
-# license that can be found in the LICENSE file or at
-# https://developers.google.com/open-source/licenses/bsd
-
-"""Temporary alias to repository rule for using Python 3.x headers from the system."""
-
-load(
-    "//python/dist:system_python.bzl",
-    _system_python = "system_python",
-)
-
-# TODO: Temporary alias. This is deprecated and to be removed in a future
-# release. Users should now get system_python from protobuf_deps.bzl.
-system_python = _system_python

third_party/protobuf/bazel/tests/proto_common_compile_tests.bzl

@@ -58,7 +58,7 @@ def _test_compile_basic_impl(env, target):
     action.argv().contains_exactly_predicates(
         [
             matching.str_endswith(protocol_compiler),
-            matching.str_matches("--plugin=b*-out/*-exec-*/bin/*/testdata/plugin"),
+            matching.str_matches("--plugin=b*-out/*-exec*/bin/*/testdata/plugin"),
             matching.equals_wrapper("-I."),
             matching.str_endswith("/A.proto"),
         ],
@@ -111,7 +111,7 @@ def _test_compile_with_plugin_output_impl(env, target):
         [
             matching.str_endswith(protocol_compiler),
             matching.str_matches("--java_out=param1,param2:b*-out/*/test_compile_with_plugin_output_compile"),
-            matching.str_matches("--plugin=b*-out/*-exec-*/bin/*/testdata/plugin"),
+            matching.str_matches("--plugin=b*-out/*-exec*/bin/*/testdata/plugin"),
             matching.equals_wrapper("-I."),
             matching.str_endswith("/A.proto"),
         ],
@@ -138,7 +138,7 @@ def _test_compile_with_directory_plugin_output_impl(env, target):
         [
             matching.str_endswith(protocol_compiler),
             matching.str_matches("--java_out=param1,param2:b*-out/*/bin"),
-            matching.str_matches("--plugin=b*-out/*-exec-*/bin/*/testdata/plugin"),
+            matching.str_matches("--plugin=b*-out/*-exec*/bin/*/testdata/plugin"),
             matching.equals_wrapper("-I."),
             matching.str_endswith("/A.proto"),
         ],
@@ -166,7 +166,7 @@ def _test_compile_additional_args_impl(env, target):
             matching.str_endswith(protocol_compiler),
             matching.equals_wrapper("--a"),
             matching.equals_wrapper("--b"),
-            matching.str_matches("--plugin=b*-out/*-exec-*/bin/*/testdata/plugin"),
+            matching.str_matches("--plugin=b*-out/*-exec*/bin/*/testdata/plugin"),
             matching.equals_wrapper("-I."),
             matching.str_endswith("/A.proto"),
         ],
@@ -294,7 +294,7 @@ def _test_compile_protoc_opts_impl(env, target):
             matching.str_endswith(protocol_compiler),
             matching.equals_wrapper("--foo"),
             matching.equals_wrapper("--bar"),
-            matching.str_matches("--plugin=b*-out/*-exec-*/bin/*/testdata/plugin"),
+            matching.str_matches("--plugin=b*-out/*-exec*/bin/*/testdata/plugin"),
             matching.equals_wrapper("-I."),
             matching.str_endswith("/A.proto"),
         ],
@@ -325,7 +325,7 @@ def _test_compile_direct_generated_protos_impl(env, target):
     action.argv().contains_exactly_predicates(
         [
             matching.str_endswith(protocol_compiler),
-            matching.str_matches("--plugin=b*-out/*-exec-*/bin/*/testdata/plugin"),
+            matching.str_matches("--plugin=b*-out/*-exec*/bin/*/testdata/plugin"),
             matching.str_matches("-Ib*-out/*/*"),
             matching.equals_wrapper("-I."),
             matching.str_endswith("/A.proto"),
@@ -360,7 +360,7 @@ def _test_compile_indirect_generated_protos_impl(env, target):
     action.argv().contains_exactly_predicates(
         [
             matching.str_endswith(protocol_compiler),
-            matching.str_matches("--plugin=b*-out/*-exec-*/bin/*/testdata/plugin"),
+            matching.str_matches("--plugin=b*-out/*-exec*/bin/*/testdata/plugin"),
             matching.str_matches("-Ib*-out/*/*"),
             matching.equals_wrapper("-I."),
             matching.str_endswith("/A.proto"),

third_party/protobuf/bazel/tests/testdata/BUILD

@@ -1,3 +1,4 @@
+load("//bazel:proto_library.bzl", "proto_library")
 load("//bazel/toolchains:proto_lang_toolchain.bzl", "proto_lang_toolchain")
 
 package(

third_party/protobuf/bazel/tests/testdata/compile_rule.bzl

@@ -8,6 +8,7 @@
 """Testing function for proto_common module"""
 
 load("//bazel/common:proto_common.bzl", "proto_common")
+load("//bazel/common:proto_info.bzl", "ProtoInfo")
 
 def _resource_set_callback(_os, inputs_size):
     return {"memory": 25 + 0.15 * inputs_size, "cpu": 1}

third_party/protobuf/bazel/toolchains/proto_lang_toolchain.bzl

@@ -35,7 +35,7 @@ def proto_lang_toolchain(*, name, toolchain_type = None, exec_compatible_with =
         _proto_lang_toolchain_rule(name = name, **attrs)
     else:
         # On older Bazel versions keep using native rules, so that mismatch in ProtoInfo doesn't happen
-        native.proto_lang_toolchain(name = name, **attrs)
+        native.proto_lang_toolchain(name = name, **attrs)  # buildifier: disable=native-proto-lang-toolchain
 
     if toolchain_type:
         native.toolchain(

third_party/protobuf/benchmarks/BUILD

@@ -69,18 +69,18 @@ cc_test(
         ":benchmark_descriptor_sv_cc_proto",
         ":benchmark_descriptor_upb_proto",
         ":benchmark_descriptor_upb_proto_reflection",
-        "//:protobuf",
+        "//src/google/protobuf",
         "//src/google/protobuf/json",
         "//upb:base",
         "//upb:json",
         "//upb:mem",
         "//upb:reflection",
         "//upb:wire",
+        "@abseil-cpp//absl/container:flat_hash_set",
+        "@abseil-cpp//absl/log:absl_check",
         "@com_github_google_benchmark//:benchmark_main",
-        "@com_google_absl//absl/container:flat_hash_set",
-        "@com_google_absl//absl/log:absl_check",
-        "@com_google_googletest//:gtest",
-        "@com_google_googletest//:gtest_main",
+        "@googletest//:gtest",
+        "@googletest//:gtest_main",
     ],
 )
 

third_party/protobuf/benchmarks/build_defs.bzl

@@ -20,7 +20,7 @@ def tmpl_cc_binary(name, gen, args, replacements = [], **kwargs):
     )
 
     if _is_google3:
-        kwargs["malloc"] = "//base:system_malloc"
+        kwargs["malloc"] = "@bazel_tools//tools/cpp:malloc"
         kwargs["features"] = ["-static_linking_mode"]
     native.cc_binary(
         name = name,

third_party/protobuf/benchmarks/descriptor_sv.proto

@@ -22,7 +22,6 @@ option java_package = "com.google.protobuf";
 option java_outer_classname = "DescriptorProtos";
 option csharp_namespace = "Google.Protobuf.Reflection";
 option objc_class_prefix = "GPB";
-option cc_enable_arenas = true;
 
 // The protocol compiler can output a FileDescriptorSet containing the .proto
 // files it parses.
@@ -34,13 +33,16 @@ message FileDescriptorSet {
 message FileDescriptorProto {
   optional string name = 1
       [ctype = STRING_PIECE];  // file name, relative to root of source tree
+
   optional string package = 2
       [ctype = STRING_PIECE];  // e.g. "foo", "foo.bar", etc.
 
   // Names of files imported by this file.
   repeated string dependency = 3 [ctype = STRING_PIECE];
+
   // Indexes of the public imported files in the dependency list above.
   repeated int32 public_dependency = 10;
+
   // Indexes of the weak imported files in the dependency list.
   // For Google-internal migration only. Do not use.
   repeated int32 weak_dependency = 11;
@@ -50,7 +52,6 @@ message FileDescriptorProto {
   repeated EnumDescriptorProto enum_type = 5;
   repeated ServiceDescriptorProto service = 6;
   repeated FieldDescriptorProto extension = 7;
-
   optional FileOptions options = 8;
 
   // This field contains optional information about the original source code.
@@ -70,20 +71,17 @@ message DescriptorProto {
 
   repeated FieldDescriptorProto field = 2;
   repeated FieldDescriptorProto extension = 6;
-
   repeated DescriptorProto nested_type = 3;
   repeated EnumDescriptorProto enum_type = 4;
 
   message ExtensionRange {
     optional int32 start = 1;  // Inclusive.
     optional int32 end = 2;    // Exclusive.
-
     optional ExtensionRangeOptions options = 3;
   }
+
   repeated ExtensionRange extension_range = 5;
-
   repeated OneofDescriptorProto oneof_decl = 8;
-
   optional MessageOptions options = 7;
 
   // Range of reserved tag numbers. Reserved tag numbers may not be used by
@@ -93,7 +91,9 @@ message DescriptorProto {
     optional int32 start = 1;  // Inclusive.
     optional int32 end = 2;    // Exclusive.
   }
+
   repeated ReservedRange reserved_range = 9;
+
   // Reserved field names, which may not be used by fields in the same message.
   // A given name may only be reserved once.
   repeated string reserved_name = 10 [ctype = STRING_PIECE];
@@ -114,10 +114,12 @@ message FieldDescriptorProto {
     // Order is weird for historical reasons.
     TYPE_DOUBLE = 1;
     TYPE_FLOAT = 2;
+
     // Not ZigZag encoded.  Negative numbers take 10 bytes.  Use TYPE_SINT64 if
     // negative values are likely.
     TYPE_INT64 = 3;
     TYPE_UINT64 = 4;
+
     // Not ZigZag encoded.  Negative numbers take 10 bytes.  Use TYPE_SINT32 if
     // negative values are likely.
     TYPE_INT32 = 5;
@@ -125,6 +127,7 @@ message FieldDescriptorProto {
     TYPE_FIXED32 = 7;
     TYPE_BOOL = 8;
     TYPE_STRING = 9;
+
     // Tag-delimited aggregate.
     // Group type is deprecated and not supported in proto3. However, Proto3
     // implementations should still be able to parse the group wire format and
@@ -150,6 +153,7 @@ message FieldDescriptorProto {
   }
 
   optional string name = 1 [ctype = STRING_PIECE];
+
   optional int32 number = 3;
   optional Label label = 4;
 
@@ -214,6 +218,7 @@ message FieldDescriptorProto {
 // Describes a oneof.
 message OneofDescriptorProto {
   optional string name = 1 [ctype = STRING_PIECE];
+
   optional OneofOptions options = 2;
 }
 
@@ -222,7 +227,6 @@ message EnumDescriptorProto {
   optional string name = 1 [ctype = STRING_PIECE];
 
   repeated EnumValueDescriptorProto value = 2;
-
   optional EnumOptions options = 3;
 
   // Range of reserved numeric values. Reserved values may not be used by
@@ -249,16 +253,16 @@ message EnumDescriptorProto {
 // Describes a value within an enum.
 message EnumValueDescriptorProto {
   optional string name = 1 [ctype = STRING_PIECE];
-  optional int32 number = 2;
 
+  optional int32 number = 2;
   optional EnumValueOptions options = 3;
 }
 
 // Describes a service.
 message ServiceDescriptorProto {
   optional string name = 1 [ctype = STRING_PIECE];
-  repeated MethodDescriptorProto method = 2;
 
+  repeated MethodDescriptorProto method = 2;
   optional ServiceOptions options = 3;
 }
 
@@ -269,12 +273,14 @@ message MethodDescriptorProto {
   // Input and output type names.  These are resolved in the same way as
   // FieldDescriptorProto.type_name, but must refer to a message type.
   optional string input_type = 2 [ctype = STRING_PIECE];
+
   optional string output_type = 3 [ctype = STRING_PIECE];
 
   optional MethodOptions options = 4;
 
   // Identifies if client streams multiple client messages
   optional bool client_streaming = 5 [default = false];
+
   // Identifies if server streams multiple server messages
   optional bool server_streaming = 6 [default = false];
 }
@@ -351,6 +357,7 @@ message FileOptions {
     CODE_SIZE = 2;     // Use ReflectionOps to implement these methods.
     LITE_RUNTIME = 3;  // Generate code using MessageLite and the lite runtime.
   }
+
   optional OptimizeMode optimize_for = 9 [default = SPEED];
 
   // Sets the Go package where structs generated from this .proto will be
@@ -371,8 +378,11 @@ message FileOptions {
   // these default to false.  Old code which depends on generic services should
   // explicitly set them to true.
   optional bool cc_generic_services = 16 [default = false];
+
   optional bool java_generic_services = 17 [default = false];
+
   optional bool py_generic_services = 18 [default = false];
+
   optional bool php_generic_services = 42 [default = false];
 
   // Is this file deprecated?
@@ -499,14 +509,14 @@ message FieldOptions {
   // options below.  This option is not yet implemented in the open source
   // release -- sorry, we'll try to include it in a future version!
   optional CType ctype = 1 [default = STRING];
+
   enum CType {
     // Default mode.
     STRING = 0;
-
     CORD = 1;
-
     STRING_PIECE = 2;
   }
+
   // The packed option can be enabled for repeated primitive fields to enable
   // a more efficient representation on the wire. Rather than repeatedly
   // writing the tag and type for each element, the entire array is encoded as
@@ -526,6 +536,7 @@ message FieldOptions {
   // This option is an enum to permit additional types to be added, e.g.
   // goog.math.Integer.
   optional JSType jstype = 6 [default = JS_NORMAL];
+
   enum JSType {
     // Use the default type.
     JS_NORMAL = 0;
@@ -554,7 +565,6 @@ message FieldOptions {
   // call from multiple threads concurrently, while non-const methods continue
   // to require exclusive access.
   //
-  //
   // Note that implementations may choose not to check required fields within
   // a lazy sub-message.  That is, calling IsInitialized() on the outer message
   // may return true even if the inner message has missing required fields.
@@ -666,6 +676,7 @@ message MethodOptions {
     NO_SIDE_EFFECTS = 1;  // implies idempotent
     IDEMPOTENT = 2;       // idempotent, but may have side effects
   }
+
   optional IdempotencyLevel idempotency_level = 34
       [default = IDEMPOTENCY_UNKNOWN];
 
@@ -690,13 +701,16 @@ message UninterpretedOption {
   // "foo.(bar.baz).qux".
   message NamePart {
     optional string name_part = 1 [ctype = STRING_PIECE];
+
     optional bool is_extension = 2;
   }
+
   repeated NamePart name = 2;
 
   // The value of the uninterpreted option, in whatever type the tokenizer
   // identified it as during parsing. Exactly one of these should be set.
   optional string identifier_value = 3 [ctype = STRING_PIECE];
+
   optional uint64 positive_int_value = 4;
   optional int64 negative_int_value = 5;
   optional double double_value = 6;
@@ -754,6 +768,7 @@ message SourceCodeInfo {
   //   ignore those that it doesn't understand, as more types of locations could
   //   be recorded in the future.
   repeated Location location = 1;
+
   message Location {
     // Identifies which part of the FileDescriptorProto was defined at this
     // location.
@@ -835,7 +850,9 @@ message SourceCodeInfo {
     //
     //   // ignored detached comments.
     optional string leading_comments = 3 [ctype = STRING_PIECE];
+
     optional string trailing_comments = 4 [ctype = STRING_PIECE];
+
     repeated string leading_detached_comments = 6 [ctype = STRING_PIECE];
   }
 }
@@ -847,6 +864,7 @@ message GeneratedCodeInfo {
   // An Annotation connects some span of text in generated code to an element
   // of its generating .proto file.
   repeated Annotation annotation = 1;
+
   message Annotation {
     // Identifies the element in the original source .proto file. This field
     // is formatted the same as SourceCodeInfo.Location.path.

third_party/protobuf/build_defs/BUILD.bazel

@@ -18,12 +18,44 @@ create_compiler_config_setting(
     value = "msvc-cl",
 )
 
-# Caveat: clang-cl support in protobuf is only best-effort / untested for now.
 create_compiler_config_setting(
     name = "config_clang_cl",
     value = "clang-cl",
 )
 
+platform(
+    name = "x64_windows-clang-cl",
+    constraint_values = [
+        "@platforms//cpu:x86_64",
+        "@platforms//os:windows",
+        # This is necessary for Bazel 7 compatibility with a MODULE.bazel file that still works in
+        # Bazel 8.  Using cc_configure_extension from rules_cc produces a @local_config_cc
+        # repository that's not compatible with @bazel_tools//tools/cpp:clang-cl from before
+        # Bazel 8.  See https://github.com/bazelbuild/rules_cc/issues/330.
+        "@rules_cc//cc/private/toolchain:clang-cl",
+    ],
+)
+
+platform(
+    name = "x64_windows-msvc-cl",
+    constraint_values = [
+        "@platforms//cpu:x86_64",
+        "@platforms//os:windows",
+        # This may be necessary in case cc_configure_extension from rules_cc produces a
+        # @local_config_cc repository that's not compatible with @bazel_tools//tools/cpp:msvc from
+        # before Bazel 8, as with clang-cl above, to avoid silently falling back to clang-cl.
+        # See https://github.com/bazelbuild/rules_cc/issues/330.
+        "@rules_cc//cc/private/toolchain:msvc",
+    ],
+)
+
+config_setting(
+    name = "protobuf_allow_msvc",
+    values = {
+        "define": "protobuf_allow_msvc=true",
+    },
+)
+
 selects.config_setting_group(
     name = "config_msvc",
     match_any = [
@@ -32,6 +64,14 @@ selects.config_setting_group(
     ],
 )
 
+platform(
+    name = "aarch64_linux",
+    constraint_values = [
+        "@platforms//cpu:aarch64",
+        "@platforms//os:linux",
+    ],
+)
+
 config_setting(
     name = "aarch64",
     values = {"cpu": "linux-aarch_64"},

third_party/protobuf/build_defs/cpp_opts.bzl

@@ -17,10 +17,7 @@ COPTS = select({
         "/wd4996",  # The compiler encountered a deprecated declaration.
     ],
     "//conditions:default": [
-        "-DHAVE_ZLIB",
-        "-Woverloaded-virtual",
         "-Wno-sign-compare",
-        "-Wno-nonnull",
     ],
 })
 

third_party/protobuf/ci/Linux.bazelrc

@@ -1,4 +1,7 @@
 import common.bazelrc
 
-build --cxxopt=-std=c++14 --host_cxxopt=-std=c++14
+build --cxxopt=-std=c++17 --host_cxxopt=-std=c++17
+build --cxxopt="-Woverloaded-virtual"
+build --copt="-Wpointer-arith"
 build --copt="-Werror" --copt="-Wno-sign-compare" --copt="-Wno-sign-conversion" --copt="-Wno-error=sign-conversion" --copt="-Wno-deprecated-declarations"
+

third_party/protobuf/ci/Windows.bazelrc

@@ -1,5 +1,11 @@
 import common.bazelrc
 
 # Workaround for maximum path length issues
+build --cxxopt=/std:c++17 --host_cxxopt=/std:c++17
 startup --output_user_root=C:/tmp --windows_enable_symlinks
-common --enable_runfiles
+common --enable_runfiles
+
+build --extra_toolchains=@local_config_cc//:cc-toolchain-x64_windows-clang-cl
+build:clang-cl --extra_execution_platforms=//build_defs:x64_windows-clang-cl --host_platform=//build_defs:x64_windows-clang-cl
+build:msvc-cl --extra_execution_platforms=//build_defs:x64_windows-msvc-cl --host_platform=//build_defs:x64_windows-msvc-cl
+build --config=clang-cl

third_party/protobuf/ci/common.bazelrc

@@ -5,11 +5,12 @@ build:dbg --compilation_mode=dbg
 
 build:opt --compilation_mode=opt
 
-build:san-common --config=dbg --strip=never --copt=-O0 --copt=-fno-omit-frame-pointer
+build:san-common --config=dbg --strip=never --copt=-O1 --copt=-fno-omit-frame-pointer
+# TODO ASAN hits ODR violations with shared linkage due to
+# cc_proto_library cyclic dependency.
+build:san-common --dynamic_mode=off
 
 build:asan --config=san-common --copt=-fsanitize=address --linkopt=-fsanitize=address
-# ASAN hits ODR violations with shared linkage due to rules_proto.
-build:asan --dynamic_mode=off
 
 build:msan --config=san-common --copt=-fsanitize=memory --linkopt=-fsanitize=memory
 build:msan --copt=-fsanitize-memory-track-origins
@@ -76,10 +77,12 @@ build --incompatible_use_host_features
 #   --incompatible_fail_on_unknown_attributes
 #   --incompatible_merge_fixed_and_default_shell_env
 
-# TODO: migrate all dependencies from WORKSPACE to MODULE.bazel
-# https://github.com/protocolbuffers/protobuf/issues/14313
-common --noenable_bzlmod
+# For easier debugging of build failures.
+common --announce_rc
+build --verbose_failures
 
 # Important: this flag ensures that we remain compliant with the C++ layering
 # check.
 build --features=layering_check
+
+build --enable_platform_specific_config

third_party/protobuf/ci/macOS.bazelrc

@@ -1,6 +1,11 @@
 import common.bazelrc
 
-build --cxxopt=-std=c++14 --host_cxxopt=-std=c++14
+build --cxxopt=-std=c++17 --host_cxxopt=-std=c++17
+build --cxxopt="-Woverloaded-virtual"
+build --copt="-Wpointer-arith"
 build --copt="-Werror" --copt="-Wno-sign-compare" --copt="-Wno-sign-conversion" --copt="-Wno-error=sign-conversion" --copt="-Wno-deprecated-declarations"
-common --repo_env=BAZEL_NO_APPLE_CPP_TOOLCHAIN=1
-common --xcode_version_config=@com_google_protobuf//.github:host_xcodes
+common --xcode_version_config=@com_google_protobuf//.github:host_xcodes
+
+build --apple_crosstool_top=@local_config_apple_cc//:toolchain
+build --crosstool_top=@local_config_apple_cc//:toolchain
+build --host_crosstool_top=@local_config_apple_cc//:toolchain

third_party/protobuf/cmake/BUILD.bazel

@@ -0,0 +1,25 @@
+load("@rules_python//python:defs.bzl", "py_binary")
+load("//upb/cmake:build_defs.bzl", "staleness_test")
+
+py_binary(
+    name = "dependencies_generator",
+    srcs = ["dependencies_generator.py"],
+)
+
+genrule(
+    name = "generate_dependencies",
+    srcs = ["//:MODULE.bazel"],
+    outs = ["generated-in/dependencies.cmake"],
+    cmd = "$(location :dependencies_generator) " +
+          "$(location //:MODULE.bazel) $@",
+    tools = [":dependencies_generator"],
+)
+
+staleness_test(
+    name = "test_dependencies_staleness",
+    outs = [
+        "dependencies.cmake",
+    ],
+    generated_pattern = "generated-in/%s",
+    tags = ["manual"],
+)

third_party/protobuf/cmake/README.md

@@ -12,16 +12,18 @@ the same actions can be performed using appropriate GUI tools.
 
 ## C++ Version
 
-By default, CMake will use whatever C++ version is the system default.  Since
-protobuf requires C++14 or newer, sometimes you will need to explicitly override
-this.  For example, the following:
+By default, CMake will use whatever C++ version is the system default. Since
+protobuf requires C++17 or newer, sometimes you will need to explicitly override
+this. For example, the following:
 
 ```
-cmake . -DCMAKE_CXX_STANDARD=14
+cmake . -DCMAKE_CXX_STANDARD=17
 cmake --build .
 ```
 
-will build protobuf using C++14 (see [CXX_STANDARD](https://cmake.org/cmake/help/latest/prop_tgt/CXX_STANDARD.html#prop_tgt:CXX_STANDARD){.external} for all available options).
+will build protobuf using C++17 (see
+[CXX_STANDARD](https://cmake.org/cmake/help/latest/prop_tgt/CXX_STANDARD.html#prop_tgt:CXX_STANDARD){.external}
+for all available options).
 
 # Windows Builds
 
@@ -82,13 +84,6 @@ Go to the project folder:
      C:\Path\to\src> cd protobuf
      C:\Path\to\src\protobuf>
 
-Remember to update any submodules if you are using git clone (you can skip this
-step if you are using a release .tar.gz or .zip package):
-
-```console
-C:\Path\to\src\protobuf> git submodule update --init --recursive
-```
-
 Good. Now you are ready for *CMake* configuration.
 
 ## CMake Configuration
@@ -117,19 +112,23 @@ Create a temporary *build* folder and change your working directory to it:
      C:\Path\to\build\protobuf>
 
 During configuration you will also be specifying where CMake should expect to
-find your Abseil installation. To do so, first set `-Dprotobuf_ABSL_PROVIDER=package`
-and then set `-DCMAKE_PREFIX_PATH` to the path where you installed Abseil.
+find your Abseil installation. To do so, set `-DCMAKE_PREFIX_PATH` to the path
+where you installed Abseil.
 
 For example:
 
 ```console
 C:\Path\to\build\protobuf> cmake -S. -Bcmake-out \
                            -DCMAKE_INSTALL_PREFIX=/tmp/protobuf \
-                           -DCMAKE_CXX_STANDARD=14 \
-                           -Dprotobuf_ABSL_PROVIDER=package \
+                           -DCMAKE_CXX_STANDARD=17 \
                            -DCMAKE_PREFIX_PATH=/tmp/absl  # Path to where I installed Abseil
 ```
 
+If the installation of a dependency can't be found, CMake will default to
+downloading and building a copy from GitHub. To prevent this and make it an
+error condition, you can optionally set
+`-Dprotobuf_LOCAL_DEPENDENCIES_ONLY=ON`.
+
 The *Makefile* and *Ninja* generators can build the project in only one configuration, so you need to build
 a separate folder for each configuration.
 
@@ -156,15 +155,14 @@ It will generate *Visual Studio* solution file *protobuf.sln* in current directo
 
 Unit tests are being built along with the rest of protobuf. The unit tests require Google Mock (now a part of Google Test).
 
-A copy of [Google Test](https://github.com/google/googletest) is included as a Git submodule in the `third-party/googletest` folder.
-(You do need to initialize the Git submodules as explained above.)
+By default, a local copy of [Google Test](https://github.com/google/googletest)
+will be downloaded during CMake configuration.
 
 Alternately, you may want to use protobuf in a larger set-up, you may want to use that standard CMake approach where
 you build and install a shared copy of Google Test.
 
-After you've built and installed your Google Test copy, you need add the following definition to your *cmake* command line
-during the configuration step: `-Dprotobuf_USE_EXTERNAL_GTEST=ON`.
-This will cause the standard CMake `find_package(GTest REQUIRED)` to be used.
+After you've built and installed your Google Test copy, the standard CMake
+`find_package(GTest)` will use it.
 
 [find_package](https://cmake.org/cmake/help/latest/command/find_package.html) will search in a default location,
 which on Windows is *C:\Program Files*. This is most likely not what you want. You will want instead to search for

third_party/protobuf/cmake/abseil-cpp.cmake

@@ -10,31 +10,36 @@ if(protobuf_BUILD_TESTS)
   set(ABSL_FIND_GOOGLETEST OFF)
 endif()
 
-if(TARGET absl::strings)
-  # If Abseil is included already, skip including it.
-  # (https://github.com/protocolbuffers/protobuf/issues/10435)
-elseif(protobuf_ABSL_PROVIDER STREQUAL "module")
-  if(NOT ABSL_ROOT_DIR)
-    set(ABSL_ROOT_DIR ${CMAKE_CURRENT_SOURCE_DIR}/third_party/abseil-cpp)
+if (NOT TARGET absl::strings)
+  if (NOT protobuf_FORCE_FETCH_DEPENDENCIES)
+    # Use "CONFIG" as there is no built-in cmake module for absl.
+    find_package(absl CONFIG)
   endif()
-  if(EXISTS "${ABSL_ROOT_DIR}/CMakeLists.txt")
-    if(protobuf_INSTALL)
+
+  # Fallback to fetching Abseil from github if it's not found locally.
+  if (NOT absl_FOUND AND NOT protobuf_LOCAL_DEPENDENCIES_ONLY)
+    include(${protobuf_SOURCE_DIR}/cmake/dependencies.cmake)
+    message(STATUS "Fallback to downloading Abseil ${abseil-cpp-version} from GitHub")
+
+    include(FetchContent)
+    FetchContent_Declare(
+      absl
+      GIT_REPOSITORY "https://github.com/abseil/abseil-cpp.git"
+      GIT_TAG "${abseil-cpp-version}"
+    )
+    if (protobuf_INSTALL)
       # When protobuf_INSTALL is enabled and Abseil will be built as a module,
       # Abseil will be installed along with protobuf for convenience.
       set(ABSL_ENABLE_INSTALL ON)
     endif()
-    add_subdirectory(${ABSL_ROOT_DIR} third_party/abseil-cpp)
-  else()
-    message(WARNING "protobuf_ABSL_PROVIDER is \"module\" but ABSL_ROOT_DIR is wrong")
+    FetchContent_MakeAvailable(absl)
   endif()
-  if(protobuf_INSTALL AND NOT _protobuf_INSTALL_SUPPORTED_FROM_MODULE)
-    message(WARNING "protobuf_INSTALL will be forced to FALSE because protobuf_ABSL_PROVIDER is \"module\" and CMake version (${CMAKE_VERSION}) is less than 3.13.")
-    set(protobuf_INSTALL FALSE)
-  endif()
-elseif(protobuf_ABSL_PROVIDER STREQUAL "package")
-  # Use "CONFIG" as there is no built-in cmake module for absl.
-  find_package(absl REQUIRED CONFIG)
 endif()
+
+if (NOT TARGET absl::strings)
+  message(FATAL_ERROR "Cannot find abseil-cpp dependency that's needed to build protobuf.\n")
+endif()
+
 set(_protobuf_FIND_ABSL "if(NOT TARGET absl::strings)\n  find_package(absl CONFIG)\nendif()")
 
 if (BUILD_SHARED_LIBS AND MSVC)
@@ -45,13 +50,8 @@ if (BUILD_SHARED_LIBS AND MSVC)
   # Once https://github.com/abseil/abseil-cpp/pull/1466 is merged and released
   # in the minimum version of abseil required by protobuf, it is possible to
   # always link absl::abseil_dll and absl::abseil_test_dll and remove the if
-  if(protobuf_ABSL_PROVIDER STREQUAL "package")
-    set(protobuf_ABSL_USED_TARGETS absl::abseil_dll)
-    set(protobuf_ABSL_USED_TEST_TARGETS absl::abseil_test_dll)
-  else()
-    set(protobuf_ABSL_USED_TARGETS abseil_dll)
-    set(protobuf_ABSL_USED_TEST_TARGETS abseil_test_dll)
-  endif()
+  set(protobuf_ABSL_USED_TARGETS absl::abseil_dll)
+  set(protobuf_ABSL_USED_TEST_TARGETS absl::abseil_test_dll)
 else()
   set(protobuf_ABSL_USED_TARGETS
     absl::absl_check
@@ -72,7 +72,6 @@ else()
     absl::flat_hash_set
     absl::function_ref
     absl::hash
-    absl::if_constexpr
     absl::layout
     absl::log_initialize
     absl::log_globals

third_party/protobuf/cmake/conformance.cmake

@@ -1,15 +1,31 @@
-if (protobuf_JSONCPP_PROVIDER STREQUAL "module")
-  if (NOT EXISTS "${protobuf_SOURCE_DIR}/third_party/jsoncpp/CMakeLists.txt")
-    message(FATAL_ERROR
-            "Cannot find third_party/jsoncpp directory that's needed to "
-            "build conformance tests. If you use git, make sure you have cloned "
-            "submodules:\n"
-            "  git submodule update --init --recursive\n"
-            "If instead you want to skip them, run cmake with:\n"
-            "  cmake -Dprotobuf_BUILD_CONFORMANCE=OFF\n")
+# Don't run jsoncpp tests.
+set(JSONCPP_WITH_TESTS OFF)
+
+if (NOT TARGET jsoncpp_lib)
+  if (NOT protobuf_FORCE_FETCH_DEPENDENCIES)
+    find_package(jsoncpp)
   endif()
-elseif(protobuf_JSONCPP_PROVIDER STREQUAL "package")
-  find_package(jsoncpp REQUIRED)
+
+  # Fallback to fetching Googletest from github if it's not found locally.
+  if (NOT jsoncpp_FOUND AND NOT protobuf_LOCAL_DEPENDENCIES_ONLY)
+    include(${protobuf_SOURCE_DIR}/cmake/dependencies.cmake)
+    message(STATUS "Fallback to downloading jsoncpp ${jsoncpp-version} from GitHub")
+
+    include(FetchContent)
+    FetchContent_Declare(
+      jsoncpp
+      GIT_REPOSITORY "https://github.com/open-source-parsers/jsoncpp.git"
+      GIT_TAG "${jsoncpp-version}"
+    )
+    FetchContent_MakeAvailable(jsoncpp)
+  endif()
+endif()
+
+if (NOT TARGET jsoncpp_lib)
+  message(FATAL_ERROR
+          "Cannot find jsoncpp dependency that's needed to build conformance tests.\n"
+          "If instead you want to skip these tests, run cmake with:\n"
+          "  cmake -Dprotobuf_BUILD_CONFORMANCE=OFF\n")
 endif()
 
 file(MAKE_DIRECTORY ${protobuf_BINARY_DIR}/conformance)
@@ -129,18 +145,13 @@ add_test(NAME conformance_cpp_test
     --text_format_failure_list ${protobuf_SOURCE_DIR}/conformance/text_format_failure_list_cpp.txt
     --output_dir ${protobuf_TEST_XML_OUTDIR}
     --maximum_edition 2023
-    ${CMAKE_CURRENT_BINARY_DIR}/conformance_cpp
+    $<TARGET_FILE:conformance_cpp>
   DEPENDS conformance_test_runner conformance_cpp)
 
 set(JSONCPP_WITH_TESTS OFF CACHE BOOL "Disable tests")
-if(protobuf_JSONCPP_PROVIDER STREQUAL "module")
-  add_subdirectory(${CMAKE_CURRENT_SOURCE_DIR}/third_party/jsoncpp third_party/jsoncpp)
-  target_include_directories(conformance_test_runner PRIVATE ${CMAKE_CURRENT_SOURCE_DIR}/third_party/jsoncpp/include)
-  if(BUILD_SHARED_LIBS)
-    target_link_libraries(conformance_test_runner jsoncpp_lib)
-  else()
-    target_link_libraries(conformance_test_runner jsoncpp_static)
-  endif()
+
+if(BUILD_SHARED_LIBS)
+  target_link_libraries(conformance_test_runner jsoncpp_lib)
 else()
-  target_link_libraries(conformance_test_runner jsoncpp)
+  target_link_libraries(conformance_test_runner jsoncpp_static)
 endif()

third_party/protobuf/cmake/dependencies.cmake

@@ -0,0 +1,37 @@
+# Auto-generated by @//cmake:make_dependencies
+#
+# This file contains lists of external dependencies based on our Bazel
+# config. It should be included from a hand-written CMake file that uses
+# them.
+#
+# Changes to this file will be overwritten based on Bazel definitions.
+
+if(${CMAKE_VERSION} VERSION_GREATER 3.16 OR ${CMAKE_VERSION} VERSION_EQUAL 3.16)
+  include_guard()
+endif()
+
+set(rules_apple-version "3.13.0")
+set(apple_support-version "1.15.1")
+set(abseil-cpp-version "20250127.0")
+set(rules_cc-version "0.0.17")
+set(zlib-version "1.3.1.bcr.5")
+set(bazel_features-version "1.23.0")
+set(bazel_skylib-version "1.7.1")
+set(jsoncpp-version "1.9.6")
+set(rules_fuzzing-version "0.5.2")
+set(rules_java-version "8.6.1")
+set(rules_jvm_external-version "6.3")
+set(rules_kotlin-version "1.9.6")
+set(rules_license-version "1.0.0")
+set(rules_pkg-version "1.0.1")
+set(rules_python-version "1.0.0")
+set(rules_rust-version "0.51.0")
+set(rules_shell-version "0.2.0")
+set(platforms-version "0.0.10")
+set(googletest-version "1.14.0")
+set(rules_buf-version "0.3.0")
+set(rules_testing-version "0.6.0")
+set(abseil-py-version "2.1.0")
+set(rules_proto-version "4.0.0")
+
+

third_party/protobuf/cmake/dependencies_generator.py

@@ -0,0 +1,149 @@
+#!/usr/bin/python
+#
+# Protocol Buffers - Google's data interchange format
+# Copyright 2023 Google LLC.  All rights reserved.
+# https://developers.google.com/protocol-buffers/
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google LLC nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+"""A tool to convert MODULE.bazel -> CMakeLists.txt.
+
+This tool is very protobuf-specific at the moment, and should not be seen as a
+generic Bazel -> CMake converter.
+"""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import print_function
+
+import os
+import sys
+import textwrap
+
+
+class ExtensionFunctions(object):
+  """A fake extension that we can use to get the functions we need."""
+
+  def toolchain(self, *args, **kwargs):
+    pass
+
+  def parse(self, *args, **kwargs):
+    pass
+
+  def spec(self, *args, **kwargs):
+    pass
+
+  def from_specs(self, *args, **kwargs):
+    pass
+
+  def install(self, *args, **kwargs):
+    pass
+
+
+class ModuleFileFunctions(object):
+  """A fake MODULE file that we can exec() to get the functions we need."""
+
+  def __init__(self, converter):
+    self.converter = converter
+
+  def module(self, *args, **kwargs):
+    pass
+
+  def bazel_dep(self, name, version, **kwargs):
+    self.converter.toplevel += textwrap.dedent(
+        """\
+      set(%(name)s-version "%(version)s")
+    """
+        % {
+            "name": name,
+            "version": version,
+        }
+    )
+
+  def register_toolchains(self, *args):
+    pass
+
+  def use_repo(self, *args, **kwargs):
+    pass
+
+  def use_extension(self, *args, **kwargs):
+    return ExtensionFunctions()
+
+  def local_path_override(self, *args, **kwargs):
+    pass
+
+  def git_override(self, *args, **kwargs):
+    pass
+
+
+class Converter(object):
+
+  def __init__(self):
+    self.toplevel = ""
+    self.if_lua = ""
+
+  def convert(self):
+    return self.template % {
+        "toplevel": converter.toplevel,
+    }
+
+  template = textwrap.dedent("""\
+    # Auto-generated by @//cmake:make_dependencies
+    #
+    # This file contains lists of external dependencies based on our Bazel
+    # config. It should be included from a hand-written CMake file that uses
+    # them.
+    #
+    # Changes to this file will be overwritten based on Bazel definitions.
+
+    if(${CMAKE_VERSION} VERSION_GREATER 3.16 OR ${CMAKE_VERSION} VERSION_EQUAL 3.16)
+      include_guard()
+    endif()
+
+    %(toplevel)s
+
+  """)
+
+
+data = {}
+converter = Converter()
+
+
+def GetDict(obj):
+  ret = {}
+  for k in dir(obj):
+    if not k.startswith("_"):
+      ret[k] = getattr(obj, k)
+  return ret
+
+
+# We take the MODULE path as a command-line argument to ensure that we can find
+# it regardless of how exactly Bazel was invoked.
+exec(open(sys.argv[1]).read(), GetDict(ModuleFileFunctions(converter)))
+
+with open(sys.argv[2], "w") as f:
+  f.write(converter.convert())

third_party/protobuf/cmake/gtest.cmake

@@ -1,48 +1,28 @@
-option(protobuf_USE_EXTERNAL_GTEST "Use external Google Test (i.e. not the one in third_party/googletest)" OFF)
-
-if (protobuf_USE_EXTERNAL_GTEST)
-  find_package(GTest REQUIRED CONFIG)
-else()
-  if (NOT EXISTS "${protobuf_SOURCE_DIR}/third_party/googletest/CMakeLists.txt")
-    message(FATAL_ERROR
-            "Cannot find third_party/googletest directory that's needed to "
-            "build tests. If you use git, make sure you have cloned submodules:\n"
-            "  git submodule update --init --recursive\n"
-            "If instead you want to skip tests, run cmake with:\n"
-            "  cmake -Dprotobuf_BUILD_TESTS=OFF\n")
+if (NOT TARGET GTest::gmock)
+  if (NOT protobuf_FORCE_FETCH_DEPENDENCIES)
+    find_package(GTest CONFIG)
   endif()
 
-  set(googlemock_source_dir "${protobuf_SOURCE_DIR}/third_party/googletest/googlemock")
-  set(googletest_source_dir "${protobuf_SOURCE_DIR}/third_party/googletest/googletest")
-  include_directories(
-    ${googlemock_source_dir}
-    ${googletest_source_dir}
-    ${googletest_source_dir}/include
-    ${googlemock_source_dir}/include
-  )
+  # Fallback to fetching Googletest from github if it's not found locally.
+  if (NOT GTest_FOUND AND NOT protobuf_LOCAL_DEPENDENCIES_ONLY)
+    include(${protobuf_SOURCE_DIR}/cmake/dependencies.cmake)
+    message(STATUS "Fallback to downloading GTest ${googletest-version} from GitHub")
 
-  add_library(gmock ${protobuf_SHARED_OR_STATIC}
-    "${googlemock_source_dir}/src/gmock-all.cc"
-    "${googletest_source_dir}/src/gtest-all.cc"
-  )
-  if (protobuf_BUILD_SHARED_LIBS)
-    set_target_properties(gmock
-      PROPERTIES
-        COMPILE_DEFINITIONS
-          "GTEST_CREATE_SHARED_LIBRARY=1"
+    include(FetchContent)
+    FetchContent_Declare(
+      googletest
+      GIT_REPOSITORY "https://github.com/google/googletest.git"
+      GIT_TAG "v${googletest-version}"
     )
-
+    # Due to https://github.com/google/googletest/issues/4384, we can't name this
+    # GTest for use with find_package until 1.15.0.
+    FetchContent_MakeAvailable(googletest)
   endif()
-  if (protobuf_INSTALL)
-    set(protobuf_INSTALL_TESTS ON)
-  endif()
-
-  target_link_libraries(gmock ${CMAKE_THREAD_LIBS_INIT})
-  add_library(gmock_main STATIC "${googlemock_source_dir}/src/gmock_main.cc")
-  target_link_libraries(gmock_main gmock)
-
-  add_library(GTest::gmock ALIAS gmock)
-  add_library(GTest::gmock_main ALIAS gmock_main)
-  add_library(GTest::gtest ALIAS gmock)
-  add_library(GTest::gtest_main ALIAS gmock_main)
+endif()
+
+if (NOT TARGET GTest::gmock)
+  message(FATAL_ERROR
+          "Cannot find googletest dependency that's needed to build tests.\n"
+          "If instead you want to skip tests, run cmake with:\n"
+          "  cmake -Dprotobuf_BUILD_TESTS=OFF\n")
 endif()

third_party/protobuf/cmake/install.cmake

@@ -20,6 +20,10 @@ if (protobuf_BUILD_SHARED_LIBS)
   set(_protobuf_PC_CFLAGS -DPROTOBUF_USE_DLLS)
 endif ()
 
+if(CMAKE_BUILD_TYPE STREQUAL Debug)
+  # attach debug postfix only in debug mode
+  set(protobuf_LIBRARY_POSTFIX ${protobuf_DEBUG_POSTFIX})
+endif()
 configure_file(${CMAKE_CURRENT_SOURCE_DIR}/cmake/protobuf.pc.cmake
                ${CMAKE_CURRENT_BINARY_DIR}/protobuf.pc @ONLY)
 configure_file(${CMAKE_CURRENT_SOURCE_DIR}/cmake/protobuf-lite.pc.cmake
@@ -83,7 +87,7 @@ endif ()
 include(${protobuf_SOURCE_DIR}/src/file_lists.cmake)
 set(protobuf_HEADERS
   ${libprotobuf_hdrs}
-  ${libprotoc_hdrs}
+  ${libprotoc_public_hdrs}
   ${wkt_protos_files}
   ${cpp_features_proto_proto_srcs}
   ${descriptor_proto_proto_srcs}
@@ -116,7 +120,6 @@ foreach(_header ${protobuf_HEADERS})
       break()
     endif()
   endforeach()
-  message(${_from_dir} "-" ${_header})
 
   # Escape _from_dir for regex special characters in the directory name.
   string(REGEX REPLACE "([$^.[|*+?()]|])" "\\\\\\1" _from_dir_regexp "${_from_dir}")

third_party/protobuf/cmake/installed_bin_golden.txt

@@ -0,0 +1,4 @@
+protoc
+protoc-gen-upb
+protoc-gen-upb_minitable
+protoc-gen-upbdefs

third_party/protobuf/cmake/installed_include_golden.txt

@@ -0,0 +1,221 @@
+google/protobuf/any.h
+google/protobuf/any.pb.h
+google/protobuf/any.proto
+google/protobuf/api.pb.h
+google/protobuf/api.proto
+google/protobuf/arena.h
+google/protobuf/arena_align.h
+google/protobuf/arena_allocation_policy.h
+google/protobuf/arena_cleanup.h
+google/protobuf/arenastring.h
+google/protobuf/arenaz_sampler.h
+google/protobuf/compiler/code_generator.h
+google/protobuf/compiler/code_generator_lite.h
+google/protobuf/compiler/command_line_interface.h
+google/protobuf/compiler/cpp/helpers.h
+google/protobuf/compiler/cpp/names.h
+google/protobuf/compiler/cpp/options.h
+google/protobuf/compiler/csharp/names.h
+google/protobuf/compiler/importer.h
+google/protobuf/compiler/java/context.h
+google/protobuf/compiler/java/doc_comment.h
+google/protobuf/compiler/java/generator.h
+google/protobuf/compiler/java/helpers.h
+google/protobuf/compiler/java/java_features.pb.h
+google/protobuf/compiler/java/name_resolver.h
+google/protobuf/compiler/java/names.h
+google/protobuf/compiler/java/options.h
+google/protobuf/compiler/notices.h
+google/protobuf/compiler/objectivec/line_consumer.h
+google/protobuf/compiler/objectivec/names.h
+google/protobuf/compiler/objectivec/nsobject_methods.h
+google/protobuf/compiler/parser.h
+google/protobuf/compiler/php/names.h
+google/protobuf/compiler/php/php_generator.h
+google/protobuf/compiler/plugin.h
+google/protobuf/compiler/plugin.pb.h
+google/protobuf/compiler/plugin.proto
+google/protobuf/compiler/retention.h
+google/protobuf/compiler/scc.h
+google/protobuf/compiler/subprocess.h
+google/protobuf/compiler/versions.h
+google/protobuf/compiler/zip_writer.h
+google/protobuf/cpp_edition_defaults.h
+google/protobuf/cpp_features.pb.h
+google/protobuf/cpp_features.proto
+google/protobuf/descriptor.h
+google/protobuf/descriptor.pb.h
+google/protobuf/descriptor.proto
+google/protobuf/descriptor.upb.h
+google/protobuf/descriptor.upb_minitable.h
+google/protobuf/descriptor_database.h
+google/protobuf/descriptor_legacy.h
+google/protobuf/descriptor_lite.h
+google/protobuf/descriptor_visitor.h
+google/protobuf/duration.pb.h
+google/protobuf/duration.proto
+google/protobuf/dynamic_message.h
+google/protobuf/empty.pb.h
+google/protobuf/empty.proto
+google/protobuf/endian.h
+google/protobuf/explicitly_constructed.h
+google/protobuf/extension_set.h
+google/protobuf/extension_set_inl.h
+google/protobuf/feature_resolver.h
+google/protobuf/field_access_listener.h
+google/protobuf/field_mask.pb.h
+google/protobuf/field_mask.proto
+google/protobuf/generated_enum_reflection.h
+google/protobuf/generated_enum_util.h
+google/protobuf/generated_message_bases.h
+google/protobuf/generated_message_reflection.h
+google/protobuf/generated_message_tctable_decl.h
+google/protobuf/generated_message_tctable_gen.h
+google/protobuf/generated_message_tctable_impl.h
+google/protobuf/generated_message_util.h
+google/protobuf/go_features.proto
+google/protobuf/has_bits.h
+google/protobuf/implicit_weak_message.h
+google/protobuf/inlined_string_field.h
+google/protobuf/io/coded_stream.h
+google/protobuf/io/gzip_stream.h
+google/protobuf/io/io_win32.h
+google/protobuf/io/printer.h
+google/protobuf/io/strtod.h
+google/protobuf/io/tokenizer.h
+google/protobuf/io/zero_copy_sink.h
+google/protobuf/io/zero_copy_stream.h
+google/protobuf/io/zero_copy_stream_impl.h
+google/protobuf/io/zero_copy_stream_impl_lite.h
+google/protobuf/java_features.proto
+google/protobuf/json/json.h
+google/protobuf/map.h
+google/protobuf/map_entry.h
+google/protobuf/map_field.h
+google/protobuf/map_field_inl.h
+google/protobuf/map_field_lite.h
+google/protobuf/map_type_handler.h
+google/protobuf/message.h
+google/protobuf/message_lite.h
+google/protobuf/metadata.h
+google/protobuf/metadata_lite.h
+google/protobuf/parse_context.h
+google/protobuf/port.h
+google/protobuf/port_def.inc
+google/protobuf/port_undef.inc
+google/protobuf/raw_ptr.h
+google/protobuf/reflection.h
+google/protobuf/reflection_mode.h
+google/protobuf/reflection_ops.h
+google/protobuf/reflection_visit_field_info.h
+google/protobuf/reflection_visit_fields.h
+google/protobuf/repeated_field.h
+google/protobuf/repeated_ptr_field.h
+google/protobuf/runtime_version.h
+google/protobuf/serial_arena.h
+google/protobuf/service.h
+google/protobuf/source_context.pb.h
+google/protobuf/source_context.proto
+google/protobuf/string_block.h
+google/protobuf/struct.pb.h
+google/protobuf/struct.proto
+google/protobuf/stubs/callback.h
+google/protobuf/stubs/common.h
+google/protobuf/stubs/platform_macros.h
+google/protobuf/stubs/port.h
+google/protobuf/stubs/status_macros.h
+google/protobuf/text_format.h
+google/protobuf/thread_safe_arena.h
+google/protobuf/timestamp.pb.h
+google/protobuf/timestamp.proto
+google/protobuf/type.pb.h
+google/protobuf/type.proto
+google/protobuf/unknown_field_set.h
+google/protobuf/util/delimited_message_util.h
+google/protobuf/util/field_comparator.h
+google/protobuf/util/field_mask_util.h
+google/protobuf/util/json_util.h
+google/protobuf/util/message_differencer.h
+google/protobuf/util/time_util.h
+google/protobuf/util/type_resolver.h
+google/protobuf/util/type_resolver_util.h
+google/protobuf/varint_shuffle.h
+google/protobuf/wire_format.h
+google/protobuf/wire_format_lite.h
+google/protobuf/wrappers.pb.h
+google/protobuf/wrappers.proto
+upb/base/descriptor_constants.h
+upb/base/status.h
+upb/base/status.hpp
+upb/base/string_view.h
+upb/base/upcast.h
+upb/generated_code_support.h
+upb/hash/common.h
+upb/hash/int_table.h
+upb/hash/str_table.h
+upb/json/decode.h
+upb/json/encode.h
+upb/lex/atoi.h
+upb/lex/round_trip.h
+upb/lex/strtod.h
+upb/lex/unicode.h
+upb/mem/alloc.h
+upb/mem/arena.h
+upb/mem/arena.hpp
+upb/message/accessors.h
+upb/message/array.h
+upb/message/compare.h
+upb/message/compat.h
+upb/message/copy.h
+upb/message/map.h
+upb/message/map_gencode_util.h
+upb/message/merge.h
+upb/message/message.h
+upb/message/tagged_ptr.h
+upb/message/value.h
+upb/mini_descriptor/build_enum.h
+upb/mini_descriptor/decode.h
+upb/mini_descriptor/link.h
+upb/mini_table/enum.h
+upb/mini_table/extension.h
+upb/mini_table/extension_registry.h
+upb/mini_table/field.h
+upb/mini_table/file.h
+upb/mini_table/message.h
+upb/mini_table/sub.h
+upb/port/atomic.h
+upb/port/def.inc
+upb/port/undef.inc
+upb/port/vsnprintf_compat.h
+upb/reflection/common.h
+upb/reflection/def.h
+upb/reflection/def.hpp
+upb/reflection/def_pool.h
+upb/reflection/def_type.h
+upb/reflection/descriptor_bootstrap.h
+upb/reflection/enum_def.h
+upb/reflection/enum_reserved_range.h
+upb/reflection/enum_value_def.h
+upb/reflection/extension_range.h
+upb/reflection/field_def.h
+upb/reflection/file_def.h
+upb/reflection/message.h
+upb/reflection/message.hpp
+upb/reflection/message_def.h
+upb/reflection/message_reserved_range.h
+upb/reflection/method_def.h
+upb/reflection/oneof_def.h
+upb/reflection/service_def.h
+upb/text/debug_string.h
+upb/text/encode.h
+upb/text/options.h
+upb/util/def_to_proto.h
+upb/util/required_fields.h
+upb/wire/byte_size.h
+upb/wire/decode.h
+upb/wire/encode.h
+upb/wire/eps_copy_input_stream.h
+upb/wire/reader.h
+upb/wire/types.h
+utf8_range.h
+utf8_validity.h

third_party/protobuf/cmake/installed_lib_shared_golden.txt

@@ -0,0 +1,20 @@
+cmake/protobuf/protobuf-config-version.cmake
+cmake/protobuf/protobuf-config.cmake
+cmake/protobuf/protobuf-generate.cmake
+cmake/protobuf/protobuf-module.cmake
+cmake/protobuf/protobuf-options.cmake
+cmake/protobuf/protobuf-targets-noconfig.cmake
+cmake/protobuf/protobuf-targets.cmake
+cmake/utf8_range/utf8_range-config.cmake
+cmake/utf8_range/utf8_range-targets-noconfig.cmake
+cmake/utf8_range/utf8_range-targets.cmake
+libprotobuf-lite.so
+libprotobuf.so
+libprotoc.so
+libupb.a
+libutf8_range.so
+libutf8_validity.so
+pkgconfig/protobuf-lite.pc
+pkgconfig/protobuf.pc
+pkgconfig/upb.pc
+pkgconfig/utf8_range.pc

third_party/protobuf/cmake/installed_lib_static_golden.txt

@@ -0,0 +1,20 @@
+cmake/protobuf/protobuf-config-version.cmake
+cmake/protobuf/protobuf-config.cmake
+cmake/protobuf/protobuf-generate.cmake
+cmake/protobuf/protobuf-module.cmake
+cmake/protobuf/protobuf-options.cmake
+cmake/protobuf/protobuf-targets-noconfig.cmake
+cmake/protobuf/protobuf-targets.cmake
+cmake/utf8_range/utf8_range-config.cmake
+cmake/utf8_range/utf8_range-targets-noconfig.cmake
+cmake/utf8_range/utf8_range-targets.cmake
+libprotobuf-lite.a
+libprotobuf.a
+libprotoc.a
+libupb.a
+libutf8_range.a
+libutf8_validity.a
+pkgconfig/protobuf-lite.pc
+pkgconfig/protobuf.pc
+pkgconfig/upb.pc
+pkgconfig/utf8_range.pc

third_party/protobuf/cmake/protobuf-generate.cmake

@@ -2,11 +2,11 @@ function(protobuf_generate)
   include(CMakeParseArguments)
 
   set(_options APPEND_PATH)
-  set(_singleargs LANGUAGE OUT_VAR EXPORT_MACRO PROTOC_OUT_DIR PLUGIN PLUGIN_OPTIONS DEPENDENCIES PROTOC_EXE)
+  set(_singleargs LANGUAGE OUT_VAR EXPORT_MACRO PROTOC_OUT_DIR PLUGIN PLUGIN_OPTIONS PROTOC_EXE)
   if(COMMAND target_sources)
     list(APPEND _singleargs TARGET)
   endif()
-  set(_multiargs PROTOS IMPORT_DIRS GENERATE_EXTENSIONS PROTOC_OPTIONS)
+  set(_multiargs PROTOS IMPORT_DIRS GENERATE_EXTENSIONS PROTOC_OPTIONS DEPENDENCIES)
 
   cmake_parse_arguments(protobuf_generate "${_options}" "${_singleargs}" "${_multiargs}" "${ARGN}")
 

third_party/protobuf/cmake/protobuf.pc.cmake

@@ -7,6 +7,6 @@ Name: Protocol Buffers
 Description: Google's Data Interchange Format
 Version: @protobuf_VERSION@
 Requires: @_protobuf_PC_REQUIRES@
-Libs: -L${libdir} -lprotobuf @CMAKE_THREAD_LIBS_INIT@
+Libs: -L${libdir} -lprotobuf@protobuf_LIBRARY_POSTFIX@ @CMAKE_THREAD_LIBS_INIT@
 Cflags: -I${includedir} @_protobuf_PC_CFLAGS@
 Conflicts: protobuf-lite

third_party/protobuf/cmake/tests.cmake

@@ -220,19 +220,26 @@ add_custom_target(restore-installed-headers)
 file(GLOB_RECURSE _local_hdrs
   "${PROJECT_SOURCE_DIR}/src/*.h"
   "${PROJECT_SOURCE_DIR}/src/*.inc"
+)
+file(GLOB_RECURSE _local_upb_hdrs
   "${PROJECT_SOURCE_DIR}/upb/*.h"
 )
 
+# Exclude test library headers.
+list(APPEND _exclude_hdrs ${test_util_hdrs} ${lite_test_util_hdrs} ${common_test_hdrs}
+  ${compiler_test_utils_hdrs} ${upb_test_util_files} ${libprotoc_hdrs})
+foreach(_hdr ${_exclude_hdrs})
+  list(REMOVE_ITEM _local_hdrs ${_hdr})
+  list(REMOVE_ITEM _local_upb_hdrs ${_hdr})
+endforeach()
+list(APPEND _local_hdrs ${libprotoc_public_hdrs})
+
 # Exclude the bootstrapping that are directly used by tests.
 set(_exclude_hdrs
   "${protobuf_SOURCE_DIR}/src/google/protobuf/cpp_features.pb.h"
   "${protobuf_SOURCE_DIR}/src/google/protobuf/descriptor.pb.h"
   "${protobuf_SOURCE_DIR}/src/google/protobuf/compiler/plugin.pb.h"
   "${protobuf_SOURCE_DIR}/src/google/protobuf/compiler/java/java_features.pb.h")
-
-# Exclude test library headers.
-list(APPEND _exclude_hdrs ${test_util_hdrs} ${lite_test_util_hdrs} ${common_test_hdrs}
-  ${compiler_test_utils_hdrs} ${upb_test_util_files})
 foreach(_hdr ${_exclude_hdrs})
   list(REMOVE_ITEM _local_hdrs ${_hdr})
 endforeach()
@@ -250,6 +257,19 @@ foreach(_hdr ${_local_hdrs})
                         copy "${_tmp_file}" "${_hdr}")
 endforeach()
 
+foreach(_hdr ${_local_upb_hdrs})
+  string(REPLACE "${protobuf_SOURCE_DIR}/upb" "" _file ${_hdr})
+  set(_tmp_file "${CMAKE_BINARY_DIR}/tmp-install-test/${_file}")
+  add_custom_command(TARGET remove-installed-headers PRE_BUILD
+                     COMMAND ${CMAKE_COMMAND} -E remove -f "${_hdr}")
+  add_custom_command(TARGET save-installed-headers PRE_BUILD
+                     COMMAND ${CMAKE_COMMAND} -E
+                        copy "${_hdr}" "${_tmp_file}" || true)
+  add_custom_command(TARGET restore-installed-headers PRE_BUILD
+                     COMMAND ${CMAKE_COMMAND} -E
+                        copy "${_tmp_file}" "${_hdr}")
+endforeach()
+
 add_dependencies(remove-installed-headers save-installed-headers)
 if(protobuf_REMOVE_INSTALLED_HEADERS)
   # Make sure we remove all the headers *before* any codegen occurs.

third_party/protobuf/cmake/upb_generators.cmake

@@ -16,6 +16,7 @@ foreach(generator upb upbdefs upb_minitable)
   )
   target_include_directories(protoc-gen-${generator} PRIVATE ${bootstrap_cmake_dir})
   target_link_libraries(protoc-gen-${generator}
+    utf8_validity
     ${protobuf_LIB_UPB}
     ${protobuf_ABSL_USED_TARGETS}
   )

third_party/protobuf/conformance/BUILD.bazel

@@ -1,6 +1,14 @@
+# Copyright (c) 2024, Google LLC
+# All rights reserved.
+#
+# Use of this source code is governed by a BSD-style
+# license that can be found in the LICENSE file or at
+# https://developers.google.com/open-source/licenses/bsd
+
 # Conformance testing for Protobuf.
 
 load("@rules_cc//cc:defs.bzl", "cc_binary", "cc_library", "objc_library")
+load("@rules_java//java:java_binary.bzl", "java_binary")
 load(
     "@rules_pkg//pkg:mappings.bzl",
     "pkg_filegroup",
@@ -153,14 +161,14 @@ cc_library(
         "//src/google/protobuf/util:differencer",
         "//src/google/protobuf/util:json_util",
         "//src/google/protobuf/util:type_resolver",
-        "@com_google_absl//absl/container:btree",
-        "@com_google_absl//absl/container:flat_hash_set",
-        "@com_google_absl//absl/log:absl_check",
-        "@com_google_absl//absl/log:absl_log",
-        "@com_google_absl//absl/status",
-        "@com_google_absl//absl/strings",
-        "@com_google_absl//absl/strings:str_format",
-        "@com_google_absl//absl/types:optional",
+        "@abseil-cpp//absl/container:btree",
+        "@abseil-cpp//absl/container:flat_hash_set",
+        "@abseil-cpp//absl/log:absl_check",
+        "@abseil-cpp//absl/log:absl_log",
+        "@abseil-cpp//absl/status",
+        "@abseil-cpp//absl/strings",
+        "@abseil-cpp//absl/strings:str_format",
+        "@abseil-cpp//absl/types:optional",
     ],
 )
 
@@ -169,12 +177,12 @@ cc_test(
     srcs = ["failure_list_trie_node_test.cc"],
     deps = [
         ":conformance_test",
-        "@com_google_absl//absl/status",
-        "@com_google_absl//absl/status:statusor",
-        "@com_google_absl//absl/strings",
-        "@com_google_absl//absl/types:optional",
-        "@com_google_googletest//:gtest",
-        "@com_google_googletest//:gtest_main",
+        "@abseil-cpp//absl/status",
+        "@abseil-cpp//absl/status:statusor",
+        "@abseil-cpp//absl/strings",
+        "@abseil-cpp//absl/types:optional",
+        "@googletest//:gtest",
+        "@googletest//:gtest_main",
     ],
 )
 
@@ -201,12 +209,12 @@ cc_library(
         "//src/google/protobuf:protobuf_lite",
         "//src/google/protobuf/json",
         "//src/google/protobuf/util:type_resolver",
-        "@com_google_absl//absl/log:absl_check",
-        "@com_google_absl//absl/log:absl_log",
-        "@com_google_absl//absl/log:die_if_null",
-        "@com_google_absl//absl/status",
-        "@com_google_absl//absl/strings",
-        "@com_google_absl//absl/strings:str_format",
+        "@abseil-cpp//absl/log:absl_check",
+        "@abseil-cpp//absl/log:absl_log",
+        "@abseil-cpp//absl/log:die_if_null",
+        "@abseil-cpp//absl/status",
+        "@abseil-cpp//absl/strings",
+        "@abseil-cpp//absl/strings:str_format",
         "@jsoncpp",
     ],
 )
@@ -224,10 +232,10 @@ cc_library(
         "//editions:test_messages_proto2_editions_cc_proto",
         "//editions:test_messages_proto3_editions_cc_proto",
         "//src/google/protobuf",
-        "@com_google_absl//absl/log:absl_log",
-        "@com_google_absl//absl/log:die_if_null",
-        "@com_google_absl//absl/strings",
-        "@com_google_absl//absl/strings:str_format",
+        "@abseil-cpp//absl/log:absl_log",
+        "@abseil-cpp//absl/log:die_if_null",
+        "@abseil-cpp//absl/strings",
+        "@abseil-cpp//absl/strings:str_format",
     ],
 )
 
@@ -240,7 +248,7 @@ cc_binary(
         ":binary_json_conformance_suite",
         ":conformance_test",
         ":text_format_conformance_suite",
-        "@com_google_absl//absl/strings:str_format",
+        "@abseil-cpp//absl/strings:str_format",
     ],
 )
 
@@ -264,11 +272,11 @@ cc_binary(
         "//src/google/protobuf/stubs",
         "//src/google/protobuf/util:json_util",
         "//src/google/protobuf/util:type_resolver",
-        "@com_google_absl//absl/log:absl_check",
-        "@com_google_absl//absl/log:absl_log",
-        "@com_google_absl//absl/status",
-        "@com_google_absl//absl/status:statusor",
-        "@com_google_absl//absl/strings",
+        "@abseil-cpp//absl/log:absl_check",
+        "@abseil-cpp//absl/log:absl_log",
+        "@abseil-cpp//absl/status",
+        "@abseil-cpp//absl/status:statusor",
+        "@abseil-cpp//absl/strings",
     ],
 )
 
@@ -346,7 +354,7 @@ inline_sh_binary(
         "conformance_php.php",
     ],
     cmd = """
-        php -d include_path=conformance:src/google/protobuf \\
+        php -d include_path=php/generated:conformance:src/google/protobuf:editions/golden \\
             -d auto_prepend_file=$(rootpath autoload.php) \\
             $(rootpath conformance_php.php)
     """,
@@ -354,6 +362,7 @@ inline_sh_binary(
     deps = [
         ":conformance_php_proto",
         "//:test_messages_proto3_php_proto",
+        "//editions:test_messages_proto3_editions_php_proto",
         "//php:source_files",
     ],
 )

third_party/protobuf/conformance/README.md

@@ -70,7 +70,7 @@ C#:
 
 Objective-C (Mac only):
 
-    $ `bazel test //objectivec:conformance_test --macos_minimum_os=10.9
+    $ `bazel test //objectivec:conformance_test --macos_minimum_os=11.0`
 
 Ruby:
 

third_party/protobuf/conformance/autoload.php

@@ -7,8 +7,12 @@ define("GOOGLE_GPBMETADATA_NAMESPACE", "GPBMetadata\\Google\\Protobuf\\");
 function protobuf_autoloader_impl($class, $prefix) {
     $length = strlen($prefix);
     if ((substr($class, 0, $length) === $prefix)) {
-        $path = 'php/src/' . implode('/', array_map('ucwords', explode('\\', $class))) . '.php';
-        include_once $path;
+        $path = 'src/' . implode('/', array_map('ucwords', explode('\\', $class))) . '.php';
+        if (file_exists('php/' . $path)) {
+            include_once 'php/' . $path;
+        } else {
+            include_once 'php/generated/' . $path;
+        }
     }
 }
 

third_party/protobuf/conformance/binary_json_conformance_suite.cc

@@ -1366,13 +1366,61 @@ void BinaryAndJsonConformanceSuiteImpl<MessageType>::TestIllegalTags() {
   }
 }
 
+template <typename MessageType>
+void BinaryAndJsonConformanceSuiteImpl<MessageType>::TestUnmatchedGroup() {
+  ExpectParseFailureForProto(tag(201, WireFormatLite::WIRETYPE_END_GROUP),
+                             "UnmatchedEndGroup", REQUIRED);
+  ExpectParseFailureForProto(tag(1234, WireFormatLite::WIRETYPE_END_GROUP),
+                             "UnmatchedEndGroupUnknown", REQUIRED);
+  ExpectParseFailureForProto(tag(1, WireFormatLite::WIRETYPE_END_GROUP),
+                             "UnmatchedEndGroupWrongType", REQUIRED);
+  ExpectParseFailureForProto(
+      len(18, tag(1234, WireFormatLite::WIRETYPE_END_GROUP)),
+      "UnmatchedEndGroupNestedLen", REQUIRED);
+  ExpectParseFailureForProto(
+      group(201, tag(202, WireFormatLite::WIRETYPE_END_GROUP)),
+      "UnmatchedEndGroupNested", REQUIRED);
+  ExpectParseFailureForProto(
+      absl::StrCat(tag(1, WireFormatLite::WIRETYPE_END_GROUP),
+                   len(2, "hello world")),
+      "UnmatchedEndGroupWithData", REQUIRED);
+
+  ExpectParseFailureForProto(tag(201, WireFormatLite::WIRETYPE_START_GROUP),
+                             "UnmatchedStartGroup", REQUIRED);
+  ExpectParseFailureForProto(tag(1234, WireFormatLite::WIRETYPE_START_GROUP),
+                             "UnmatchedStartGroupUnknown", REQUIRED);
+  ExpectParseFailureForProto(tag(1, WireFormatLite::WIRETYPE_START_GROUP),
+                             "UnmatchedStartGroupWrongType", REQUIRED);
+  ExpectParseFailureForProto(
+      len(18, tag(1234, WireFormatLite::WIRETYPE_START_GROUP)),
+      "UnmatchedStartGroupNestedLen", REQUIRED);
+  ExpectParseFailureForProto(
+      group(201, tag(202, WireFormatLite::WIRETYPE_START_GROUP)),
+      "UnmatchedStartGroupNested", REQUIRED);
+  ExpectParseFailureForProto(
+      absl::StrCat(tag(1, WireFormatLite::WIRETYPE_START_GROUP),
+                   len(2, "hello world")),
+      "UnmatchedStartGroupWithData", REQUIRED);
+
+  ExpectParseFailureForProto(
+      absl::StrCat(tag(201, WireFormatLite::WIRETYPE_START_GROUP),
+                   len(2, "hello world"),
+                   tag(202, WireFormatLite::WIRETYPE_END_GROUP)),
+      "MismatchedGroupTags", REQUIRED);
+  ExpectParseFailureForProto(
+      group(201, absl::StrCat(tag(202, WireFormatLite::WIRETYPE_START_GROUP),
+                              len(2, "hello world"),
+                              tag(203, WireFormatLite::WIRETYPE_END_GROUP))),
+      "MismatchedNestedGroupTags", REQUIRED);
+}
+
 template <typename MessageType>
 void BinaryAndJsonConformanceSuiteImpl<MessageType>::TestUnknownWireType() {
   for (uint8_t type : {0x6, 0x7}) {
     for (uint8_t field = 0; field < 4; ++field) {
       for (uint8_t value = 0; value < 4; ++value) {
-        std::string name = absl::StrFormat("UnknownWireType%d_Field%d_Verion%d",
-                                           type, field, value);
+        std::string name = absl::StrFormat(
+            "UnknownWireType%d_Field%d_Version%d", type, field, value);
 
         char data[2];
         data[0] = (field << 3) | type;  // unknown wire type.
@@ -1553,7 +1601,7 @@ void BinaryAndJsonConformanceSuiteImpl<MessageType>::RunAllTests() {
     }
 
     TestIllegalTags();
-
+    TestUnmatchedGroup();
     TestUnknownWireType();
 
     int64_t kInt64Min = -9223372036854775808ULL;
@@ -2289,6 +2337,10 @@ void BinaryAndJsonConformanceSuiteImpl<
   RunValidJsonTest("Int32FieldStringValueEscaped", REQUIRED,
                    R"({"optionalInt32": "2\u003147483647"})",
                    "optional_int32: 2147483647");
+  RunValidJsonTest("Int32FieldStringValueZero", REQUIRED,
+                   R"({"optionalInt32": "0"})", "optional_int32: 0");
+  RunValidJsonTest("Int32FieldQuotedExponentialValue", REQUIRED,
+                   R"({"optionalInt32": "1e5"})", "optional_int32: 100000");
 
   // Parsers reject out-of-bound integer values.
   ExpectParseFailureForJson("Int32FieldTooLarge", REQUIRED,
@@ -2303,7 +2355,8 @@ void BinaryAndJsonConformanceSuiteImpl<
                             R"({"optionalInt64": "-9223372036854775809"})");
   ExpectParseFailureForJson("Uint64FieldTooLarge", REQUIRED,
                             R"({"optionalUint64": "18446744073709551616"})");
-  // Parser reject non-integer numeric values as well.
+
+  // Parser reject non-integer numeric values.
   ExpectParseFailureForJson("Int32FieldNotInteger", REQUIRED,
                             R"({"optionalInt32": 0.5})");
   ExpectParseFailureForJson("Uint32FieldNotInteger", REQUIRED,
@@ -2313,6 +2366,22 @@ void BinaryAndJsonConformanceSuiteImpl<
   ExpectParseFailureForJson("Uint64FieldNotInteger", REQUIRED,
                             R"({"optionalUint64": "0.5"})");
 
+  // Parser reject non-numeric string values.
+  ExpectParseFailureForJson("Int32FieldStringValuePartiallyNumeric", REQUIRED,
+                            R"({"optionalInt32": "12abc"})");
+  ExpectParseFailureForJson("Int32FieldStringValueNonNumeric", REQUIRED,
+                            R"({"optionalInt32": "abc"})");
+
+  // Parser reject empty string values.
+  ExpectParseFailureForJson("Int32FieldEmptyString", REQUIRED,
+                            R"({"optionalInt32": ""})");
+  ExpectParseFailureForJson("Uint32FieldEmptyString", REQUIRED,
+                            R"({"optionalUint32": ""})");
+  ExpectParseFailureForJson("Int64FieldEmptyString", REQUIRED,
+                            R"({"optionalInt64": ""})");
+  ExpectParseFailureForJson("Uint64FieldEmptyString", REQUIRED,
+                            R"({"optionalUint64": ""})");
+
   // Integers but represented as float values are accepted.
   RunValidJsonTest("Int32FieldFloatTrailingZero", REQUIRED,
                    R"({"optionalInt32": 100000.000})",
@@ -2407,6 +2476,9 @@ void BinaryAndJsonConformanceSuiteImpl<
   // Values can be quoted.
   RunValidJsonTest("FloatFieldQuotedValue", REQUIRED,
                    R"({"optionalFloat": "1"})", "optional_float: 1");
+  RunValidJsonTest("FloatFieldQuotedExponentialValue", REQUIRED,
+                   R"({"optionalFloat": "1.175494e-38"})",
+                   "optional_float: 1.175494e-38");
   // Special values.
   RunValidJsonTest("FloatFieldNan", REQUIRED, R"({"optionalFloat": "NaN"})",
                    "optional_float: nan");
@@ -2436,12 +2508,23 @@ void BinaryAndJsonConformanceSuiteImpl<
                             R"({"optionalFloat": Infinity})");
   ExpectParseFailureForJson("FloatFieldNegativeInfinityNotQuoted", RECOMMENDED,
                             R"({"optionalFloat": -Infinity})");
+
   // Parsers should reject out-of-bound values.
   ExpectParseFailureForJson("FloatFieldTooSmall", REQUIRED,
                             R"({"optionalFloat": -3.502823e+38})");
   ExpectParseFailureForJson("FloatFieldTooLarge", REQUIRED,
                             R"({"optionalFloat": 3.502823e+38})");
 
+  // Parsers should reject empty string values.
+  ExpectParseFailureForJson("FloatFieldEmptyString", REQUIRED,
+                            R"({"optionalFloat": ""})");
+
+  // Parser reject non-numeric string values.
+  ExpectParseFailureForJson("FloatFieldStringValuePartiallyNumeric", REQUIRED,
+                            R"({"optionalFloat": "12abc"})");
+  ExpectParseFailureForJson("FloatFieldStringValueNonNumeric", REQUIRED,
+                            R"({"optionalFloat": "abc"})");
+
   // Double fields.
   RunValidJsonTest("DoubleFieldMinPositiveValue", REQUIRED,
                    R"({"optionalDouble": 2.22507e-308})",
@@ -2458,6 +2541,9 @@ void BinaryAndJsonConformanceSuiteImpl<
   // Values can be quoted.
   RunValidJsonTest("DoubleFieldQuotedValue", REQUIRED,
                    R"({"optionalDouble": "1"})", "optional_double: 1");
+  RunValidJsonTest("DoubleFieldQuotedExponentialValue", REQUIRED,
+                   R"({"optionalDouble": "2.22507e-308"})",
+                   "optional_double: 2.22507e-308");
   // Special values.
   RunValidJsonTest("DoubleFieldNan", REQUIRED, R"({"optionalDouble": "NaN"})",
                    "optional_double: nan");
@@ -2494,6 +2580,16 @@ void BinaryAndJsonConformanceSuiteImpl<
   ExpectParseFailureForJson("DoubleFieldTooLarge", REQUIRED,
                             R"({"optionalDouble": +1.89769e+308})");
 
+  // Parsers should reject empty string values.
+  ExpectParseFailureForJson("DoubleFieldEmptyString", REQUIRED,
+                            R"({"optionalDouble": ""})");
+
+  // Parser reject non-numeric string values.
+  ExpectParseFailureForJson("DoubleFieldStringValuePartiallyNumeric", REQUIRED,
+                            R"({"optionalDouble": "12abc"})");
+  ExpectParseFailureForJson("DoubleFieldStringValueNonNumeric", REQUIRED,
+                            R"({"optionalDouble": "abc"})");
+
   // Enum fields.
   RunValidJsonTest("EnumField", REQUIRED, R"({"optionalNestedEnum": "FOO"})",
                    "optional_nested_enum: FOO");
@@ -2997,6 +3093,27 @@ void BinaryAndJsonConformanceSuiteImpl<
       })",
       "repeated_timestamp: {seconds: -62135596800}"
       "repeated_timestamp: {seconds: 253402300799 nanos: 999999999}");
+  RunValidJsonTest("TimestampEpochValue", REQUIRED,
+                   R"({"optionalTimestamp": "1970-01-01T00:00:00.000Z"})",
+                   "optional_timestamp: {seconds: 0}");
+  RunValidJsonTest("TimestampNanoAfterEpochlValue", REQUIRED,
+                   R"({"optionalTimestamp": "1970-01-01T00:00:00.000000001Z"})",
+                   "optional_timestamp: {seconds: 0 nanos: 1}");
+  RunValidJsonTest("TimestampNanoBeforeEpochValue", REQUIRED,
+                   R"({"optionalTimestamp": "1969-12-31T23:59:59.999999999Z"})",
+                   "optional_timestamp: {seconds: -1 nanos: 999999999}");
+  RunValidJsonTest("TimestampLittleAfterEpochlValue", REQUIRED,
+                   R"({"optionalTimestamp": "1970-01-01T00:00:01.000000001Z"})",
+                   "optional_timestamp: {seconds: 1 nanos: 1}");
+  RunValidJsonTest("TimestampLittleBeforeEpochValue", REQUIRED,
+                   R"({"optionalTimestamp": "1969-12-31T23:59:58.999999999Z"})",
+                   "optional_timestamp: {seconds: -2 nanos: 999999999}");
+  RunValidJsonTest("TimestampTenAndHalfSecondsAfterEpochValue", REQUIRED,
+                   R"({"optionalTimestamp": "1970-01-01T00:00:10.500Z"})",
+                   "optional_timestamp: {seconds: 10 nanos: 500000000}");
+  RunValidJsonTest("TimestampTenAndHalfSecondsBeforeEpochValue", REQUIRED,
+                   R"({"optionalTimestamp": "1969-12-31T23:59:49.500Z"})",
+                   "optional_timestamp: {seconds: -11 nanos: 500000000}");
   RunValidJsonTest("TimestampLeap", REQUIRED,
                    R"({"optionalTimestamp": "1993-02-10T00:00:00.000Z"})",
                    "optional_timestamp: {seconds: 729302400}");
@@ -3428,6 +3545,40 @@ void BinaryAndJsonConformanceSuiteImpl<MessageType>::RunJsonTestsForAny() {
     }
   }
       )");
+  // When the Any is in WKT form (with "@type"), the type_url must be present
+  // and URL shaped, otherwise it should be a parse error (because it can't be
+  // parsed into the Any schema).
+  ExpectParseFailureForJson("AnyWktRepresentationWithEmptyTypeAndValue",
+                            REQUIRED,
+                            R"({
+        "optionalAny": {
+          "@type": "",
+          "value": ""
+        }
+      })");
+  ExpectParseFailureForJson("AnyWktRepresentationWithBadType", REQUIRED,
+                            R"({
+        "optionalAny": {
+          "@type": "not_a_url",
+          "value": ""
+        }
+      })");
+  // When the Any can be parsed as non-WKT form, the type_url could be missing
+  // or invalid, since that can still be parsed into the Any schema.
+  RunValidJsonTest("AnyWithNoType", REQUIRED,
+                   R"({
+        "optionalAny": {}
+      })",
+                   R"(
+        optional_any: {}
+      )");
+  // `null` where an Any exists should just result in the field being unset.
+  RunValidJsonTest("AnyNull", REQUIRED,
+                   R"({
+        "optionalAny": null
+      })",
+                   R"(
+      )");
 }
 
 template <typename MessageType>

third_party/protobuf/conformance/binary_json_conformance_suite.h

@@ -143,6 +143,7 @@ class BinaryAndJsonConformanceSuiteImpl {
                                       ConformanceLevel level);
   void TestPrematureEOFForType(google::protobuf::FieldDescriptor::Type type);
   void TestIllegalTags();
+  void TestUnmatchedGroup();
   void TestUnknownWireType();
   void TestOneofMessage();
   void TestUnknownMessage();

third_party/protobuf/conformance/conformance_php.php

@@ -36,6 +36,8 @@ if (!ini_get('date.timezone')) {
     ini_set('date.timezone', 'UTC');
 }
 
+error_reporting(0);
+
 $test_count = 0;
 
 function doTest($request)
@@ -78,6 +80,9 @@ function doTest($request)
             } catch (Exception $e) {
                 $response->setParseError($e->getMessage());
                 return $response;
+            } catch (Error $e) {
+                $response->setParseError($e->getMessage());
+                return $response;
             }
             break;
 
@@ -86,6 +91,7 @@ function doTest($request)
                 case 'protobuf_test_messages.editions.proto3.TestAllTypesProto3':
                     $test_message = new TestAllTypesProto3Editions();
                     break;
+                case 'protobuf_test_messages.proto2.TestAllTypesProto2':
                 case 'protobuf_test_messages.editions.proto2.TestAllTypesProto2':
                     $response->setSkipped('PHP doesn\'t support proto2');
                     return $response;
@@ -103,6 +109,9 @@ function doTest($request)
             } catch (Exception $e) {
                 $response->setParseError($e->getMessage());
                 return $response;
+            } catch (Error $e) {
+                $response->setParseError($e->getMessage());
+                return $response;
             }
             break;
 
@@ -128,6 +137,9 @@ function doTest($request)
             } catch (Exception $e) {
                 $response->setSerializeError($e->getMessage());
                 return $response;
+            } catch (Error $e) {
+                $response->setSerializeError($e->getMessage());
+                return $response;
             }
     }
 

third_party/protobuf/conformance/conformance_python.py

@@ -48,64 +48,10 @@ def _create_test_message(type):
 def do_test(request):
   response = conformance_pb2.ConformanceResponse()
 
-  if request.message_type == "conformance.FailureSet":
-    failure_set = conformance_pb2.FailureSet()
-    failures = []
-    # TODO: Remove, this is a hack to detect if the old vs new
-    # parser is used by the cpp code. Relying on a bug in the old parser.
-    hack_proto = test_messages_proto2_pb2.TestAllTypesProto2()
-    old_parser = True
-    try:
-      hack_proto.ParseFromString(b"\322\002\001")
-    except message.DecodeError as e:
-      old_parser = False
-    if old_parser:
-      # the string above is one of the failing conformance test strings of the
-      # old parser. If we succeed the c++ implementation is using the old
-      # parser so we add the list of failing conformance tests.
-      failures = [
-          "Required.Proto3.ProtobufInput.PrematureEofInDelimitedDataForKnownNonRepeatedValue.MESSAGE",
-          "Required.Proto3.ProtobufInput.PrematureEofInDelimitedDataForKnownRepeatedValue.MESSAGE",
-          "Required.Proto3.ProtobufInput.PrematureEofInPackedField.BOOL",
-          "Required.Proto3.ProtobufInput.PrematureEofInPackedField.DOUBLE",
-          "Required.Proto3.ProtobufInput.PrematureEofInPackedField.ENUM",
-          "Required.Proto3.ProtobufInput.PrematureEofInPackedField.FIXED32",
-          "Required.Proto3.ProtobufInput.PrematureEofInPackedField.FIXED64",
-          "Required.Proto3.ProtobufInput.PrematureEofInPackedField.FLOAT",
-          "Required.Proto3.ProtobufInput.PrematureEofInPackedField.INT32",
-          "Required.Proto3.ProtobufInput.PrematureEofInPackedField.INT64",
-          "Required.Proto3.ProtobufInput.PrematureEofInPackedField.SFIXED32",
-          "Required.Proto3.ProtobufInput.PrematureEofInPackedField.SFIXED64",
-          "Required.Proto3.ProtobufInput.PrematureEofInPackedField.SINT32",
-          "Required.Proto3.ProtobufInput.PrematureEofInPackedField.SINT64",
-          "Required.Proto3.ProtobufInput.PrematureEofInPackedField.UINT32",
-          "Required.Proto3.ProtobufInput.PrematureEofInPackedField.UINT64",
-          "Required.Proto2.ProtobufInput.PrematureEofInDelimitedDataForKnownNonRepeatedValue.MESSAGE",
-          "Required.Proto2.ProtobufInput.PrematureEofInDelimitedDataForKnownRepeatedValue.MESSAGE",
-          "Required.Proto2.ProtobufInput.PrematureEofInPackedField.BOOL",
-          "Required.Proto2.ProtobufInput.PrematureEofInPackedField.DOUBLE",
-          "Required.Proto2.ProtobufInput.PrematureEofInPackedField.ENUM",
-          "Required.Proto2.ProtobufInput.PrematureEofInPackedField.FIXED32",
-          "Required.Proto2.ProtobufInput.PrematureEofInPackedField.FIXED64",
-          "Required.Proto2.ProtobufInput.PrematureEofInPackedField.FLOAT",
-          "Required.Proto2.ProtobufInput.PrematureEofInPackedField.INT32",
-          "Required.Proto2.ProtobufInput.PrematureEofInPackedField.INT64",
-          "Required.Proto2.ProtobufInput.PrematureEofInPackedField.SFIXED32",
-          "Required.Proto2.ProtobufInput.PrematureEofInPackedField.SFIXED64",
-          "Required.Proto2.ProtobufInput.PrematureEofInPackedField.SINT32",
-          "Required.Proto2.ProtobufInput.PrematureEofInPackedField.SINT64",
-          "Required.Proto2.ProtobufInput.PrematureEofInPackedField.UINT32",
-          "Required.Proto2.ProtobufInput.PrematureEofInPackedField.UINT64",
-      ]
-    for x in failures:
-      failure_set.test.append(conformance_pb2.TestStatus(name=x))
-    response.protobuf_payload = failure_set.SerializeToString()
-    return response
-
-  isJson = request.WhichOneof("payload") == "json_payload"
+  is_json = request.WhichOneof("payload") == "json_payload"
   test_message = _create_test_message(request.message_type)
 
-  if (not isJson) and (test_message is None):
+  if (not is_json) and (test_message is None):
     raise ProtocolError("Protobuf request doesn't have specific payload type")
 
   try:

third_party/protobuf/conformance/conformance_rust.rs

@@ -8,7 +8,7 @@ use conformance_rust_proto::{ConformanceRequest, ConformanceResponse, WireFormat
 
 use protobuf::prelude::*;
 use protobuf::Optional::{Set, Unset};
-use protobuf::ParseError;
+use protobuf::{Message, ParseError};
 
 use std::io::{self, ErrorKind, Read, Write};
 use test_messages_edition2023_rust_proto::TestAllTypesEdition2023;

third_party/protobuf/conformance/conformance_test.cc

@@ -182,7 +182,7 @@ bool CheckSetEmpty(const absl::btree_map<std::string, TestStatus>& set_to_check,
 namespace google {
 namespace protobuf {
 
-constexpr int kMaximumWildcardExpansions = 5;
+constexpr int kMaximumWildcardExpansions = 10;
 
 ConformanceTestSuite::ConformanceRequestSetting::ConformanceRequestSetting(
     ConformanceLevel level, conformance::WireFormat input_format,

third_party/protobuf/conformance/failure_list_cpp.txt

@@ -14,8 +14,6 @@ Recommended.*.JsonInput.FieldNameDuplicateDifferentCasing1
 Recommended.*.JsonInput.FieldNameDuplicateDifferentCasing2                                                         # Should have failed to parse, but didn't.
 Recommended.*.JsonInput.FieldNameExtension.Validator                                                               # Expected JSON payload but got type 1
 Recommended.*.JsonInput.FieldNameNotQuoted                                                                         # Should have failed to parse, but didn't.
-Recommended.*.JsonInput.IgnoreUnknownEnumStringValueInMapPart.ProtobufOutput                                       # Output was not equivalent to reference message: added: map_string_nested_enum[key2]: FOO
-Recommended.*.JsonInput.IgnoreUnknownEnumStringValueInMapValue.ProtobufOutput                                      # Output was not equivalent to reference message: added: map_string_nested_enum[key]: FOO
 Recommended.*.JsonInput.MapFieldValueIsNull                                                                        # Should have failed to parse, but didn't.
 Recommended.*.JsonInput.RepeatedFieldMessageElementIsNull                                                          # Should have failed to parse, but didn't.
 Recommended.*.JsonInput.RepeatedFieldPrimitiveElementIsNull                                                        # Should have failed to parse, but didn't.

third_party/protobuf/conformance/failure_list_csharp.txt

@@ -33,3 +33,7 @@ Recommended.Editions_Proto3.ValueRejectInfNumberValue.JsonOutput
 Recommended.Editions_Proto3.ValueRejectNanNumberValue.JsonOutput
 Required.Editions_Proto2.ProtobufInput.UnknownOrdering.ProtobufOutput
 Required.Editions_Proto3.ProtobufInput.UnknownOrdering.ProtobufOutput
+Required.*.JsonInput.AnyWithNoType.* # Failed to parse input or produce output.
+Required.*.JsonInput.AnyWktRepresentationWithEmptyTypeAndValue # Should have failed to parse, but didn't.
+Required.*.JsonInput.AnyWktRepresentationWithBadType # Should have failed to parse, but didn't.
+

third_party/protobuf/conformance/failure_list_jruby_ffi.txt

@@ -0,0 +1,2 @@
+Required.*.JsonInput.Int32FieldQuotedExponentialValue.*     # Failed to parse input or produce output.
+Required.*.JsonInput.AnyWithNoType.* # Failed to parse input or produce output.