Delete deprecated google/__init__.py namespace file

- Add CVE-2026-0994.patch to fix google.protobuf.Any recursion depth
  bypass in Python json_format.ParseDict (bsc#1257173, CVE-2026-0994)

CVE-2025-4565.patch

@@ -0,0 +1,256 @@
+From 1e7f83ea1b1945065ce1b89051cd655e4b8de22d Mon Sep 17 00:00:00 2001
+From: Protobuf Team Bot <protobuf-github-bot@google.com>
+Date: Tue, 13 May 2025 14:42:18 -0700
+Subject: [PATCH 2/2] Add recursion depth limits to pure python
+
+PiperOrigin-RevId: 758382549
+---
+ python/google/protobuf/internal/decoder.py    | 35 ++++++++++-
+ .../google/protobuf/internal/decoder_test.py  | 14 +++++
+ .../google/protobuf/internal/message_test.py  | 60 +++++++++++++++++--
+ .../protobuf/internal/self_recursive.proto    |  1 +
+ 4 files changed, 105 insertions(+), 5 deletions(-)
+
+diff --git a/python/google/protobuf/internal/decoder.py b/python/google/protobuf/internal/decoder.py
+index 89d829142..de0bc19a5 100755
+--- a/python/google/protobuf/internal/decoder.py
++++ b/python/google/protobuf/internal/decoder.py
+@@ -668,7 +668,13 @@ def GroupDecoder(field_number, is_repeated, is_packed, key, new_default):
+         if value is None:
+           value = field_dict.setdefault(key, new_default(message))
+         # Read sub-message.
++        current_depth += 1
++        if current_depth > _recursion_limit:
++          raise _DecodeError(
++              'Error parsing message: too many levels of nesting.'
++          )
+         pos = value.add()._InternalParse(buffer, pos, end, current_depth)
++        current_depth -= 1
+         # Read end tag.
+         new_pos = pos+end_tag_len
+         if buffer[pos:new_pos] != end_tag_bytes or new_pos > end:
+@@ -687,7 +693,11 @@ def GroupDecoder(field_number, is_repeated, is_packed, key, new_default):
+       if value is None:
+         value = field_dict.setdefault(key, new_default(message))
+       # Read sub-message.
++      current_depth += 1
++      if current_depth > _recursion_limit:
++        raise _DecodeError('Error parsing message: too many levels of nesting.')
+       pos = value._InternalParse(buffer, pos, end, current_depth)
++      current_depth -= 1
+       # Read end tag.
+       new_pos = pos+end_tag_len
+       if buffer[pos:new_pos] != end_tag_bytes or new_pos > end:
+@@ -720,6 +730,11 @@ def MessageDecoder(field_number, is_repeated, is_packed, key, new_default):
+         if new_pos > end:
+           raise _DecodeError('Truncated message.')
+         # Read sub-message.
++        current_depth += 1
++        if current_depth > _recursion_limit:
++          raise _DecodeError(
++              'Error parsing message: too many levels of nesting.'
++          )
+         if (
+             value.add()._InternalParse(buffer, pos, new_pos, current_depth)
+             != new_pos
+@@ -727,6 +742,7 @@ def MessageDecoder(field_number, is_repeated, is_packed, key, new_default):
+           # The only reason _InternalParse would return early is if it
+           # encountered an end-group tag.
+           raise _DecodeError('Unexpected end-group tag.')
++        current_depth -= 1
+         # Predict that the next tag is another copy of the same repeated field.
+         pos = new_pos + tag_len
+         if buffer[new_pos:pos] != tag_bytes or new_pos == end:
+@@ -746,10 +762,14 @@ def MessageDecoder(field_number, is_repeated, is_packed, key, new_default):
+       if new_pos > end:
+         raise _DecodeError('Truncated message.')
+       # Read sub-message.
++      current_depth += 1
++      if current_depth > _recursion_limit:
++        raise _DecodeError('Error parsing message: too many levels of nesting.')
+       if value._InternalParse(buffer, pos, new_pos, current_depth) != new_pos:
+         # The only reason _InternalParse would return early is if it encountered
+         # an end-group tag.
+         raise _DecodeError('Unexpected end-group tag.')
++      current_depth -= 1
+       return new_pos
+ 
+     return DecodeField
+@@ -984,6 +1004,15 @@ def _SkipGroup(buffer, pos, end):
+     pos = new_pos
+ 
+ 
++DEFAULT_RECURSION_LIMIT = 100
++_recursion_limit = DEFAULT_RECURSION_LIMIT
++
++
++def SetRecursionLimit(new_limit):
++  global _recursion_limit
++  _recursion_limit = new_limit
++
++
+ def _DecodeUnknownFieldSet(buffer, pos, end_pos=None, current_depth=0):
+   """Decode UnknownFieldSet.  Returns the UnknownFieldSet and new position."""
+ 
+@@ -1017,7 +1046,11 @@ def _DecodeUnknownField(
+     data = buffer[pos:pos+size].tobytes()
+     pos += size
+   elif wire_type == wire_format.WIRETYPE_START_GROUP:
+-    (data, pos) = _DecodeUnknownFieldSet(buffer, pos, None, current_depth)
++    current_depth += 1
++    if current_depth >= _recursion_limit:
++      raise _DecodeError('Error parsing message: too many levels of nesting.')
++    data, pos = _DecodeUnknownFieldSet(buffer, pos, None, current_depth)
++    current_depth -= 1
+   elif wire_type == wire_format.WIRETYPE_END_GROUP:
+     return (0, -1)
+   else:
+diff --git a/python/google/protobuf/internal/decoder_test.py b/python/google/protobuf/internal/decoder_test.py
+index f801b6e76..11e6465b6 100644
+--- a/python/google/protobuf/internal/decoder_test.py
++++ b/python/google/protobuf/internal/decoder_test.py
+@@ -11,8 +11,10 @@
+ import io
+ import unittest
+ 
++from google.protobuf import message
+ from google.protobuf.internal import decoder
+ from google.protobuf.internal import testing_refleaks
++from google.protobuf.internal import wire_format
+ 
+ 
+ _INPUT_BYTES = b'\x84r\x12'
+@@ -52,6 +54,18 @@ class DecoderTest(unittest.TestCase):
+     size = decoder._DecodeVarint(input_io)
+     self.assertEqual(size, None)
+ 
++  def test_decode_unknown_group_field_too_many_levels(self):
++    data = memoryview(b'\023' * 5_000_000)
++    self.assertRaisesRegex(
++        message.DecodeError,
++        'Error parsing message',
++        decoder._DecodeUnknownField,
++        data,
++        1,
++        wire_format.WIRETYPE_START_GROUP,
++        1
++    )
++
+ 
+ if __name__ == '__main__':
+   unittest.main()
+diff --git a/python/google/protobuf/internal/message_test.py b/python/google/protobuf/internal/message_test.py
+index 48e6df806..6facb8135 100755
+--- a/python/google/protobuf/internal/message_test.py
++++ b/python/google/protobuf/internal/message_test.py
+@@ -36,6 +36,7 @@ from google.protobuf.internal import enum_type_wrapper
+ from google.protobuf.internal import more_extensions_pb2
+ from google.protobuf.internal import more_messages_pb2
+ from google.protobuf.internal import packed_field_test_pb2
++from google.protobuf.internal import self_recursive_pb2
+ from google.protobuf.internal import test_proto3_optional_pb2
+ from google.protobuf.internal import test_util
+ from google.protobuf.internal import testing_refleaks
+@@ -1339,6 +1340,52 @@ class MessageTest(unittest.TestCase):
+     self.assertNotIn('oneof_string', m)
+ 
+ 
++@testing_refleaks.TestCase
++class TestRecursiveGroup(unittest.TestCase):
++
++  def _MakeRecursiveGroupMessage(self, n):
++    msg = self_recursive_pb2.SelfRecursive()
++    sub = msg
++    for _ in range(n):
++      sub = sub.sub_group
++    sub.i = 1
++    return msg.SerializeToString()
++
++  def testRecursiveGroups(self):
++    recurse_msg = self_recursive_pb2.SelfRecursive()
++    data = self._MakeRecursiveGroupMessage(100)
++    recurse_msg.ParseFromString(data)
++    self.assertTrue(recurse_msg.HasField('sub_group'))
++
++  def testRecursiveGroupsException(self):
++    if api_implementation.Type() != 'python':
++      api_implementation._c_module.SetAllowOversizeProtos(False)
++    recurse_msg = self_recursive_pb2.SelfRecursive()
++    data = self._MakeRecursiveGroupMessage(300)
++    with self.assertRaises(message.DecodeError) as context:
++      recurse_msg.ParseFromString(data)
++    self.assertIn('Error parsing message', str(context.exception))
++    if api_implementation.Type() == 'python':
++      self.assertIn('too many levels of nesting', str(context.exception))
++
++  def testRecursiveGroupsUnknownFields(self):
++    if api_implementation.Type() != 'python':
++      api_implementation._c_module.SetAllowOversizeProtos(False)
++    test_msg = unittest_pb2.TestAllTypes()
++    data = self._MakeRecursiveGroupMessage(300)  # unknown to test_msg
++    with self.assertRaises(message.DecodeError) as context:
++      test_msg.ParseFromString(data)
++    self.assertIn(
++        'Error parsing message',
++        str(context.exception),
++    )
++    if api_implementation.Type() == 'python':
++      self.assertIn('too many levels of nesting', str(context.exception))
++      decoder.SetRecursionLimit(310)
++      test_msg.ParseFromString(data)
++      decoder.SetRecursionLimit(decoder.DEFAULT_RECURSION_LIMIT)
++
++
+ # Class to test proto2-only features (required, extensions, etc.)
+ @testing_refleaks.TestCase
+ class Proto2Test(unittest.TestCase):
+@@ -2722,8 +2769,6 @@ class PackedFieldTest(unittest.TestCase):
+     self.assertEqual(golden_data, message.SerializeToString())
+ 
+ 
+-@unittest.skipIf(api_implementation.Type() == 'python',
+-                 'explicit tests of the C++ implementation')
+ @testing_refleaks.TestCase
+ class OversizeProtosTest(unittest.TestCase):
+ 
+@@ -2740,16 +2785,23 @@ class OversizeProtosTest(unittest.TestCase):
+     msg.ParseFromString(self.GenerateNestedProto(100))
+ 
+   def testAssertOversizeProto(self):
+-    api_implementation._c_module.SetAllowOversizeProtos(False)
++    if api_implementation.Type() != 'python':
++      api_implementation._c_module.SetAllowOversizeProtos(False)
+     msg = unittest_pb2.TestRecursiveMessage()
+     with self.assertRaises(message.DecodeError) as context:
+       msg.ParseFromString(self.GenerateNestedProto(101))
+     self.assertIn('Error parsing message', str(context.exception))
+ 
+   def testSucceedOversizeProto(self):
+-    api_implementation._c_module.SetAllowOversizeProtos(True)
++
++    if api_implementation.Type() == 'python':
++      decoder.SetRecursionLimit(310)
++    else:
++      api_implementation._c_module.SetAllowOversizeProtos(True)
++
+     msg = unittest_pb2.TestRecursiveMessage()
+     msg.ParseFromString(self.GenerateNestedProto(101))
++    decoder.SetRecursionLimit(decoder.DEFAULT_RECURSION_LIMIT)
+ 
+ 
+ if __name__ == '__main__':
+diff --git a/python/google/protobuf/internal/self_recursive.proto b/python/google/protobuf/internal/self_recursive.proto
+index 20bc2b4d3..d2a7f004b 100644
+--- a/python/google/protobuf/internal/self_recursive.proto
++++ b/python/google/protobuf/internal/self_recursive.proto
+@@ -12,6 +12,7 @@ package google.protobuf.python.internal;
+ message SelfRecursive {
+   SelfRecursive sub = 1;
+   int32 i = 2;
++  SelfRecursive sub_group = 3 [features.message_encoding = DELIMITED];
+ }
+ 
+ message IndirectRecursive {
+-- 
+2.51.1
+

CVE-2026-0994.patch

@@ -0,0 +1,58 @@
+From b8ada4c2a07449fe8c4c4574292a501c1350c6e6 Mon Sep 17 00:00:00 2001
+From: aviralgarg05 <gargaviral99@gmail.com>
+Date: Fri, 9 Jan 2026 20:59:10 +0530
+Subject: [PATCH] Fix Any recursion depth bypass in Python
+ json_format.ParseDict
+
+This fixes a security vulnerability where nested google.protobuf.Any messages
+could bypass the max_recursion_depth limit, potentially leading to denial of
+service via stack overflow.
+
+The root cause was that _ConvertAnyMessage() was calling itself recursively
+via methodcaller() for nested well-known types, bypassing the recursion depth
+tracking in ConvertMessage().
+
+The fix routes well-known type parsing through ConvertMessage() to ensure
+proper recursion depth accounting for all message types including nested Any.
+
+Fixes #25070
+---
+ python/google/protobuf/json_format.py | 15 +++++++++------
+ 1 file changed, 9 insertions(+), 6 deletions(-)
+
+diff --git a/python/google/protobuf/json_format.py b/python/google/protobuf/json_format.py
+index 2a6bba939..9ace6345e 100644
+--- a/python/google/protobuf/json_format.py
++++ b/python/google/protobuf/json_format.py
+@@ -521,6 +521,10 @@ class _Parser(object):
+     Raises:
+       ParseError: In case of convert problems.
+     """
++    # Increment recursion depth at message entry. The max_recursion_depth limit
++    # is exclusive: a depth value equal to max_recursion_depth will trigger an
++    # error. For example, with max_recursion_depth=5, nesting up to depth 4 is
++    # allowed, but attempting depth 5 raises ParseError.
+     self.recursion_depth += 1
+     if self.recursion_depth > self.max_recursion_depth:
+       raise ParseError(
+@@ -725,12 +729,11 @@ class _Parser(object):
+           value['value'], sub_message, '{0}.value'.format(path)
+       )
+     elif full_name in _WKTJSONMETHODS:
+-      methodcaller(
+-          _WKTJSONMETHODS[full_name][1],
+-          value['value'],
+-          sub_message,
+-          '{0}.value'.format(path),
+-      )(self)
++      # For well-known types (including nested Any), use ConvertMessage
++      # to ensure recursion depth is properly tracked
++      self.ConvertMessage(
++          value['value'], sub_message, '{0}.value'.format(path)
++      )
+     else:
+       del value['@type']
+       self._ConvertFieldValuePair(value, sub_message, path)
+-- 
+2.52.0
+

_multibuild

@@ -0,0 +1,5 @@
+<multibuild>
+  <package>python-protobuf</package>
+  <package>protobuf-java</package>
+</multibuild>
+

baselibs.conf

@@ -1,3 +1,4 @@
-libprotobuf25_3_0
-libprotoc25_3_0
-libprotobuf-lite25_3_0
+libprotobuf28_3_0
+libprotoc28_3_0
+libprotobuf-lite28_3_0
+libutf8_range-28_3_0

internal-pure-python-fixes.patch

@@ -0,0 +1,421 @@
+From dac2e91e36408087d769be89a72fbafe1ea5039c Mon Sep 17 00:00:00 2001
+From: Protobuf Team Bot <protobuf-github-bot@google.com>
+Date: Tue, 4 Mar 2025 13:16:32 -0800
+Subject: [PATCH 1/2] Internal pure python fixes
+
+PiperOrigin-RevId: 733441339
+---
+ python/google/protobuf/internal/decoder.py    | 98 ++++++++++++++-----
+ .../google/protobuf/internal/message_test.py  |  1 +
+ .../protobuf/internal/python_message.py       |  7 +-
+ .../protobuf/internal/self_recursive.proto    |  9 +-
+ 4 files changed, 86 insertions(+), 29 deletions(-)
+
+diff --git a/python/google/protobuf/internal/decoder.py b/python/google/protobuf/internal/decoder.py
+index dcde1d942..89d829142 100755
+--- a/python/google/protobuf/internal/decoder.py
++++ b/python/google/protobuf/internal/decoder.py
+@@ -184,7 +184,10 @@ def _SimpleDecoder(wire_type, decode_value):
+                       clear_if_default=False):
+     if is_packed:
+       local_DecodeVarint = _DecodeVarint
+-      def DecodePackedField(buffer, pos, end, message, field_dict):
++      def DecodePackedField(
++          buffer, pos, end, message, field_dict, current_depth=0
++      ):
++        del current_depth  # unused
+         value = field_dict.get(key)
+         if value is None:
+           value = field_dict.setdefault(key, new_default(message))
+@@ -199,11 +202,15 @@ def _SimpleDecoder(wire_type, decode_value):
+           del value[-1]   # Discard corrupt value.
+           raise _DecodeError('Packed element was truncated.')
+         return pos
++
+       return DecodePackedField
+     elif is_repeated:
+       tag_bytes = encoder.TagBytes(field_number, wire_type)
+       tag_len = len(tag_bytes)
+-      def DecodeRepeatedField(buffer, pos, end, message, field_dict):
++      def DecodeRepeatedField(
++          buffer, pos, end, message, field_dict, current_depth=0
++      ):
++        del current_depth  # unused
+         value = field_dict.get(key)
+         if value is None:
+           value = field_dict.setdefault(key, new_default(message))
+@@ -218,9 +225,12 @@ def _SimpleDecoder(wire_type, decode_value):
+             if new_pos > end:
+               raise _DecodeError('Truncated message.')
+             return new_pos
++
+       return DecodeRepeatedField
+     else:
+-      def DecodeField(buffer, pos, end, message, field_dict):
++
++      def DecodeField(buffer, pos, end, message, field_dict, current_depth=0):
++        del current_depth  # unused
+         (new_value, pos) = decode_value(buffer, pos)
+         if pos > end:
+           raise _DecodeError('Truncated message.')
+@@ -229,6 +239,7 @@ def _SimpleDecoder(wire_type, decode_value):
+         else:
+           field_dict[key] = new_value
+         return pos
++
+       return DecodeField
+ 
+   return SpecificDecoder
+@@ -364,7 +375,9 @@ def EnumDecoder(field_number, is_repeated, is_packed, key, new_default,
+   enum_type = key.enum_type
+   if is_packed:
+     local_DecodeVarint = _DecodeVarint
+-    def DecodePackedField(buffer, pos, end, message, field_dict):
++    def DecodePackedField(
++        buffer, pos, end, message, field_dict, current_depth=0
++    ):
+       """Decode serialized packed enum to its value and a new position.
+ 
+       Args:
+@@ -377,6 +390,7 @@ def EnumDecoder(field_number, is_repeated, is_packed, key, new_default,
+       Returns:
+         int, new position in serialized data.
+       """
++      del current_depth  # unused
+       value = field_dict.get(key)
+       if value is None:
+         value = field_dict.setdefault(key, new_default(message))
+@@ -407,11 +421,14 @@ def EnumDecoder(field_number, is_repeated, is_packed, key, new_default,
+           # pylint: enable=protected-access
+         raise _DecodeError('Packed element was truncated.')
+       return pos
++
+     return DecodePackedField
+   elif is_repeated:
+     tag_bytes = encoder.TagBytes(field_number, wire_format.WIRETYPE_VARINT)
+     tag_len = len(tag_bytes)
+-    def DecodeRepeatedField(buffer, pos, end, message, field_dict):
++    def DecodeRepeatedField(
++        buffer, pos, end, message, field_dict, current_depth=0
++    ):
+       """Decode serialized repeated enum to its value and a new position.
+ 
+       Args:
+@@ -424,6 +441,7 @@ def EnumDecoder(field_number, is_repeated, is_packed, key, new_default,
+       Returns:
+         int, new position in serialized data.
+       """
++      del current_depth  # unused
+       value = field_dict.get(key)
+       if value is None:
+         value = field_dict.setdefault(key, new_default(message))
+@@ -446,9 +464,11 @@ def EnumDecoder(field_number, is_repeated, is_packed, key, new_default,
+           if new_pos > end:
+             raise _DecodeError('Truncated message.')
+           return new_pos
++
+     return DecodeRepeatedField
+   else:
+-    def DecodeField(buffer, pos, end, message, field_dict):
++
++    def DecodeField(buffer, pos, end, message, field_dict, current_depth=0):
+       """Decode serialized repeated enum to its value and a new position.
+ 
+       Args:
+@@ -461,6 +481,7 @@ def EnumDecoder(field_number, is_repeated, is_packed, key, new_default,
+       Returns:
+         int, new position in serialized data.
+       """
++      del current_depth  # unused
+       value_start_pos = pos
+       (enum_value, pos) = _DecodeSignedVarint32(buffer, pos)
+       if pos > end:
+@@ -480,6 +501,7 @@ def EnumDecoder(field_number, is_repeated, is_packed, key, new_default,
+             (tag_bytes, buffer[value_start_pos:pos].tobytes()))
+         # pylint: enable=protected-access
+       return pos
++
+     return DecodeField
+ 
+ 
+@@ -538,7 +560,10 @@ def StringDecoder(field_number, is_repeated, is_packed, key, new_default,
+     tag_bytes = encoder.TagBytes(field_number,
+                                  wire_format.WIRETYPE_LENGTH_DELIMITED)
+     tag_len = len(tag_bytes)
+-    def DecodeRepeatedField(buffer, pos, end, message, field_dict):
++    def DecodeRepeatedField(
++        buffer, pos, end, message, field_dict, current_depth=0
++    ):
++      del current_depth  # unused
+       value = field_dict.get(key)
+       if value is None:
+         value = field_dict.setdefault(key, new_default(message))
+@@ -553,9 +578,12 @@ def StringDecoder(field_number, is_repeated, is_packed, key, new_default,
+         if buffer[new_pos:pos] != tag_bytes or new_pos == end:
+           # Prediction failed.  Return.
+           return new_pos
++
+     return DecodeRepeatedField
+   else:
+-    def DecodeField(buffer, pos, end, message, field_dict):
++
++    def DecodeField(buffer, pos, end, message, field_dict, current_depth=0):
++      del current_depth  # unused
+       (size, pos) = local_DecodeVarint(buffer, pos)
+       new_pos = pos + size
+       if new_pos > end:
+@@ -565,6 +593,7 @@ def StringDecoder(field_number, is_repeated, is_packed, key, new_default,
+       else:
+         field_dict[key] = _ConvertToUnicode(buffer[pos:new_pos])
+       return new_pos
++
+     return DecodeField
+ 
+ 
+@@ -579,7 +608,10 @@ def BytesDecoder(field_number, is_repeated, is_packed, key, new_default,
+     tag_bytes = encoder.TagBytes(field_number,
+                                  wire_format.WIRETYPE_LENGTH_DELIMITED)
+     tag_len = len(tag_bytes)
+-    def DecodeRepeatedField(buffer, pos, end, message, field_dict):
++    def DecodeRepeatedField(
++        buffer, pos, end, message, field_dict, current_depth=0
++    ):
++      del current_depth  # unused
+       value = field_dict.get(key)
+       if value is None:
+         value = field_dict.setdefault(key, new_default(message))
+@@ -594,9 +626,12 @@ def BytesDecoder(field_number, is_repeated, is_packed, key, new_default,
+         if buffer[new_pos:pos] != tag_bytes or new_pos == end:
+           # Prediction failed.  Return.
+           return new_pos
++
+     return DecodeRepeatedField
+   else:
+-    def DecodeField(buffer, pos, end, message, field_dict):
++
++    def DecodeField(buffer, pos, end, message, field_dict, current_depth=0):
++      del current_depth  # unused
+       (size, pos) = local_DecodeVarint(buffer, pos)
+       new_pos = pos + size
+       if new_pos > end:
+@@ -606,6 +641,7 @@ def BytesDecoder(field_number, is_repeated, is_packed, key, new_default,
+       else:
+         field_dict[key] = buffer[pos:new_pos].tobytes()
+       return new_pos
++
+     return DecodeField
+ 
+ 
+@@ -621,7 +657,9 @@ def GroupDecoder(field_number, is_repeated, is_packed, key, new_default):
+     tag_bytes = encoder.TagBytes(field_number,
+                                  wire_format.WIRETYPE_START_GROUP)
+     tag_len = len(tag_bytes)
+-    def DecodeRepeatedField(buffer, pos, end, message, field_dict):
++    def DecodeRepeatedField(
++        buffer, pos, end, message, field_dict, current_depth=0
++    ):
+       value = field_dict.get(key)
+       if value is None:
+         value = field_dict.setdefault(key, new_default(message))
+@@ -630,7 +668,7 @@ def GroupDecoder(field_number, is_repeated, is_packed, key, new_default):
+         if value is None:
+           value = field_dict.setdefault(key, new_default(message))
+         # Read sub-message.
+-        pos = value.add()._InternalParse(buffer, pos, end)
++        pos = value.add()._InternalParse(buffer, pos, end, current_depth)
+         # Read end tag.
+         new_pos = pos+end_tag_len
+         if buffer[pos:new_pos] != end_tag_bytes or new_pos > end:
+@@ -640,19 +678,22 @@ def GroupDecoder(field_number, is_repeated, is_packed, key, new_default):
+         if buffer[new_pos:pos] != tag_bytes or new_pos == end:
+           # Prediction failed.  Return.
+           return new_pos
++
+     return DecodeRepeatedField
+   else:
+-    def DecodeField(buffer, pos, end, message, field_dict):
++
++    def DecodeField(buffer, pos, end, message, field_dict, current_depth=0):
+       value = field_dict.get(key)
+       if value is None:
+         value = field_dict.setdefault(key, new_default(message))
+       # Read sub-message.
+-      pos = value._InternalParse(buffer, pos, end)
++      pos = value._InternalParse(buffer, pos, end, current_depth)
+       # Read end tag.
+       new_pos = pos+end_tag_len
+       if buffer[pos:new_pos] != end_tag_bytes or new_pos > end:
+         raise _DecodeError('Missing group end tag.')
+       return new_pos
++
+     return DecodeField
+ 
+ 
+@@ -666,7 +707,9 @@ def MessageDecoder(field_number, is_repeated, is_packed, key, new_default):
+     tag_bytes = encoder.TagBytes(field_number,
+                                  wire_format.WIRETYPE_LENGTH_DELIMITED)
+     tag_len = len(tag_bytes)
+-    def DecodeRepeatedField(buffer, pos, end, message, field_dict):
++    def DecodeRepeatedField(
++        buffer, pos, end, message, field_dict, current_depth=0
++    ):
+       value = field_dict.get(key)
+       if value is None:
+         value = field_dict.setdefault(key, new_default(message))
+@@ -677,7 +720,10 @@ def MessageDecoder(field_number, is_repeated, is_packed, key, new_default):
+         if new_pos > end:
+           raise _DecodeError('Truncated message.')
+         # Read sub-message.
+-        if value.add()._InternalParse(buffer, pos, new_pos) != new_pos:
++        if (
++            value.add()._InternalParse(buffer, pos, new_pos, current_depth)
++            != new_pos
++        ):
+           # The only reason _InternalParse would return early is if it
+           # encountered an end-group tag.
+           raise _DecodeError('Unexpected end-group tag.')
+@@ -686,9 +732,11 @@ def MessageDecoder(field_number, is_repeated, is_packed, key, new_default):
+         if buffer[new_pos:pos] != tag_bytes or new_pos == end:
+           # Prediction failed.  Return.
+           return new_pos
++
+     return DecodeRepeatedField
+   else:
+-    def DecodeField(buffer, pos, end, message, field_dict):
++
++    def DecodeField(buffer, pos, end, message, field_dict, current_depth=0):
+       value = field_dict.get(key)
+       if value is None:
+         value = field_dict.setdefault(key, new_default(message))
+@@ -698,11 +746,12 @@ def MessageDecoder(field_number, is_repeated, is_packed, key, new_default):
+       if new_pos > end:
+         raise _DecodeError('Truncated message.')
+       # Read sub-message.
+-      if value._InternalParse(buffer, pos, new_pos) != new_pos:
++      if value._InternalParse(buffer, pos, new_pos, current_depth) != new_pos:
+         # The only reason _InternalParse would return early is if it encountered
+         # an end-group tag.
+         raise _DecodeError('Unexpected end-group tag.')
+       return new_pos
++
+     return DecodeField
+ 
+ 
+@@ -851,7 +900,8 @@ def MapDecoder(field_descriptor, new_default, is_message_map):
+   # Can't read _concrete_class yet; might not be initialized.
+   message_type = field_descriptor.message_type
+ 
+-  def DecodeMap(buffer, pos, end, message, field_dict):
++  def DecodeMap(buffer, pos, end, message, field_dict, current_depth=0):
++    del current_depth  # Unused.
+     submsg = message_type._concrete_class()
+     value = field_dict.get(key)
+     if value is None:
+@@ -934,7 +984,7 @@ def _SkipGroup(buffer, pos, end):
+     pos = new_pos
+ 
+ 
+-def _DecodeUnknownFieldSet(buffer, pos, end_pos=None):
++def _DecodeUnknownFieldSet(buffer, pos, end_pos=None, current_depth=0):
+   """Decode UnknownFieldSet.  Returns the UnknownFieldSet and new position."""
+ 
+   unknown_field_set = containers.UnknownFieldSet()
+@@ -944,14 +994,16 @@ def _DecodeUnknownFieldSet(buffer, pos, end_pos=None):
+     field_number, wire_type = wire_format.UnpackTag(tag)
+     if wire_type == wire_format.WIRETYPE_END_GROUP:
+       break
+-    (data, pos) = _DecodeUnknownField(buffer, pos, wire_type)
++    (data, pos) = _DecodeUnknownField(buffer, pos, wire_type, current_depth)
+     # pylint: disable=protected-access
+     unknown_field_set._add(field_number, wire_type, data)
+ 
+   return (unknown_field_set, pos)
+ 
+ 
+-def _DecodeUnknownField(buffer, pos, wire_type):
++def _DecodeUnknownField(
++    buffer, pos, wire_type, current_depth=0
++):
+   """Decode a unknown field.  Returns the UnknownField and new position."""
+ 
+   if wire_type == wire_format.WIRETYPE_VARINT:
+@@ -965,7 +1017,7 @@ def _DecodeUnknownField(buffer, pos, wire_type):
+     data = buffer[pos:pos+size].tobytes()
+     pos += size
+   elif wire_type == wire_format.WIRETYPE_START_GROUP:
+-    (data, pos) = _DecodeUnknownFieldSet(buffer, pos)
++    (data, pos) = _DecodeUnknownFieldSet(buffer, pos, None, current_depth)
+   elif wire_type == wire_format.WIRETYPE_END_GROUP:
+     return (0, -1)
+   else:
+diff --git a/python/google/protobuf/internal/message_test.py b/python/google/protobuf/internal/message_test.py
+index 2a723eabb..48e6df806 100755
+--- a/python/google/protobuf/internal/message_test.py
++++ b/python/google/protobuf/internal/message_test.py
+@@ -30,6 +30,7 @@ import warnings
+ cmp = lambda x, y: (x > y) - (x < y)
+ 
+ from google.protobuf.internal import api_implementation # pylint: disable=g-import-not-at-top
++from google.protobuf.internal import decoder
+ from google.protobuf.internal import encoder
+ from google.protobuf.internal import enum_type_wrapper
+ from google.protobuf.internal import more_extensions_pb2
+diff --git a/python/google/protobuf/internal/python_message.py b/python/google/protobuf/internal/python_message.py
+index fabc6aa07..62c059cd2 100755
+--- a/python/google/protobuf/internal/python_message.py
++++ b/python/google/protobuf/internal/python_message.py
+@@ -1194,7 +1194,7 @@ def _AddMergeFromStringMethod(message_descriptor, cls):
+   fields_by_tag = cls._fields_by_tag
+   message_set_decoders_by_tag = cls._message_set_decoders_by_tag
+ 
+-  def InternalParse(self, buffer, pos, end):
++  def InternalParse(self, buffer, pos, end, current_depth=0):
+     """Create a message from serialized bytes.
+ 
+     Args:
+@@ -1244,10 +1244,13 @@ def _AddMergeFromStringMethod(message_descriptor, cls):
+       else:
+         _MaybeAddDecoder(cls, field_des)
+         field_decoder = field_des._decoders[is_packed]
+-        pos = field_decoder(buffer, new_pos, end, self, field_dict)
++        pos = field_decoder(
++            buffer, new_pos, end, self, field_dict, current_depth
++        )
+         if field_des.containing_oneof:
+           self._UpdateOneofState(field_des)
+     return pos
++
+   cls._InternalParse = InternalParse
+ 
+ 
+diff --git a/python/google/protobuf/internal/self_recursive.proto b/python/google/protobuf/internal/self_recursive.proto
+index dbfcaf971..20bc2b4d3 100644
+--- a/python/google/protobuf/internal/self_recursive.proto
++++ b/python/google/protobuf/internal/self_recursive.proto
+@@ -5,18 +5,19 @@
+ // license that can be found in the LICENSE file or at
+ // https://developers.google.com/open-source/licenses/bsd
+ 
+-syntax = "proto2";
++edition = "2023";
+ 
+ package google.protobuf.python.internal;
+ 
+ message SelfRecursive {
+-  optional SelfRecursive sub = 1;
++  SelfRecursive sub = 1;
++  int32 i = 2;
+ }
+ 
+ message IndirectRecursive {
+-  optional IntermediateRecursive intermediate = 1;
++  IntermediateRecursive intermediate = 1;
+ }
+ 
+ message IntermediateRecursive {
+-  optional IndirectRecursive indirect = 1;
++  IndirectRecursive indirect = 1;
+ }
+-- 
+2.51.1
+

manifest.txt.in

@@ -1,9 +0,0 @@
-Manifest-Version: 1.0
-Created-By: stick@gk2.sk
-Name: com/google/protobuf/
-Specification-Title: Google Protocol Buffers
-Specification-Version: @VERSION@
-Specification-Vendor: stick@gk2.sk
-Implementation-Title: com.google.protobuf
-Implementation-Version: @VERSION@
-Implementation-Vendor: stick@gk2.sk

pre_checkin.sh

@@ -0,0 +1,5 @@
+#!/bin/sh
+cp protobuf.changes protobuf-java.changes
+cp protobuf.changes python-protobuf.changes
+osc service runall format_spec_file
+

protobuf-25.3.tar.gz

@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:d19643d265b978383352b3143f04c0641eea75a75235c111cc01a1350173180e
-size 5878962

protobuf-fix-google-imports.patch

@@ -0,0 +1,45 @@
+From 8351926380c7cc91aae6df5695c91426e209f958 Mon Sep 17 00:00:00 2001
+From: Ge Yunxi <141423244+gyx47@users.noreply.github.com>
+Date: Fri, 11 Jul 2025 11:04:58 -0700
+Subject: [PATCH] drop-deprecated-pkg-resources-declare (#22442)
+
+# Description
+As of setuptools 81, pkg_resources.declare_namespace has been marked as deprecated (scheduled to be removed after 2025-11-30) so I remove it from init.py
+
+# Environment:
+a virtual machine of arch riscv64
+
+# procedure
+I got this problem when running a test that applied this package.
+```
+src/certbot_dns_google/_internal/tests/dns_google_test.py:9: in <module>
+    from google.auth import exceptions as googleauth_exceptions
+/usr/lib/python3.13/site-packages/google/__init__.py:2: in <module>
+    __import__('pkg_resources').declare_namespace(__name__)
+    ^^^^^^^^^^^^^^^^^^^^^^^^^^^
+/usr/lib/python3.13/site-packages/pkg_resources/__init__.py:98: in <module>
+    warnings.warn(
+E   UserWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html. The pkg_resources package is slated for removal as early as 2025-11-30. Refrain from using this package or pin to Setuptools<81.
+```
+[certbot-dns-google-4.1.1-1-riscv64-check.log](https://github.com/user-attachments/files/20976539/certbot-dns-google-4.1.1-1-riscv64-check.log)
+
+Closes #22442
+
+COPYBARA_INTEGRATE_REVIEW=https://github.com/protocolbuffers/protobuf/pull/22442 from gyx47:patch-1 6aef5c9df150cce444910d224fe90b2a514c7868
+PiperOrigin-RevId: 782041935
+---
+ python/google/__init__.py | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/python/google/__init__.py b/python/google/__init__.py
+index 5585614122997..b36383a61027f 100644
+--- a/python/google/__init__.py
++++ b/python/google/__init__.py
+@@ -1,4 +1,3 @@
+-try:
+-  __import__('pkg_resources').declare_namespace(__name__)
+-except ImportError:
+-  __path__ = __import__('pkgutil').extend_path(__path__, __name__)
++from pkgutil import extend_path
++
++__path__ = extend_path(__path__, __name__)

protobuf-java-4.28.3.pom

@@ -0,0 +1,41 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+  <modelVersion>4.0.0</modelVersion>
+  <parent>
+    <groupId>com.google.protobuf</groupId>
+    <artifactId>protobuf-parent</artifactId>
+    <version>4.28.3</version>
+  </parent>
+
+  <artifactId>protobuf-java</artifactId>
+  <packaging>jar</packaging>
+
+  <name>Protocol Buffers [Core]</name>
+  <description>
+    Core Protocol Buffers library. Protocol Buffers are a way of encoding structured data in an
+    efficient yet extensible format.
+  </description>
+  <dependencies>
+    
+  </dependencies>
+
+  <build>
+    <plugins>
+      <!-- OSGI bundle configuration -->
+      <plugin>
+        <groupId>org.apache.felix</groupId>
+        <artifactId>maven-bundle-plugin</artifactId>
+        <extensions>true</extensions>
+        <configuration>
+          <instructions>
+            <Automatic-Module-Name>com.google.protobuf</Automatic-Module-Name> <!-- Java9+ Jigsaw module name -->
+            <Bundle-DocURL>https://developers.google.com/protocol-buffers/</Bundle-DocURL>
+            <Bundle-SymbolicName>com.google.protobuf</Bundle-SymbolicName>
+            <Export-Package>com.google.protobuf;version=${project.version}</Export-Package>
+            <Import-Package>sun.misc;resolution:=optional,*</Import-Package>
+          </instructions>
+        </configuration>
+      </plugin>
+    </plugins>
+  </build>
+</project>

protobuf-java-util-4.28.3.pom

@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+  <modelVersion>4.0.0</modelVersion>
+  <parent>
+    <groupId>com.google.protobuf</groupId>
+    <artifactId>protobuf-parent</artifactId>
+    <version>4.28.3</version>
+  </parent>
+
+  <artifactId>protobuf-java-util</artifactId>
+  <packaging>jar</packaging>
+
+  <name>Protocol Buffers [Util]</name>
+  <description>Utilities for Protocol Buffers</description>
+  <dependencies>
+    <dependency>
+      <groupId>com.google.protobuf</groupId>
+      <artifactId>protobuf-java</artifactId>
+      <version>4.28.3</version>
+    </dependency>
+            <dependency>
+            <groupId>com.google.code.findbugs</groupId>
+            <artifactId>jsr305</artifactId>
+            <version>3.0.2</version>
+        </dependency>
+        <dependency>
+            <groupId>com.google.code.gson</groupId>
+            <artifactId>gson</artifactId>
+            <version>2.8.9</version>
+        </dependency>
+        <dependency>
+            <groupId>com.google.errorprone</groupId>
+            <artifactId>error_prone_annotations</artifactId>
+            <version>2.18.0</version>
+        </dependency>
+        <dependency>
+            <groupId>com.google.guava</groupId>
+            <artifactId>guava</artifactId>
+            <version>32.0.1-jre</version>
+        </dependency>
+        <dependency>
+            <groupId>com.google.j2objc</groupId>
+            <artifactId>j2objc-annotations</artifactId>
+            <version>2.8</version>
+        </dependency>
+  </dependencies>
+
+  <build>
+    <plugins>
+      <!-- OSGI bundle configuration -->
+      <plugin>
+        <groupId>org.apache.felix</groupId>
+        <artifactId>maven-bundle-plugin</artifactId>
+        <extensions>true</extensions>
+        <configuration>
+          <instructions>
+            <Automatic-Module-Name>com.google.protobuf.util</Automatic-Module-Name> <!-- Java9+ Jigsaw module name -->
+            <Bundle-DocURL>https://developers.google.com/protocol-buffers/</Bundle-DocURL>
+            <Bundle-SymbolicName>com.google.protobuf.util</Bundle-SymbolicName>
+            <Export-Package>com.google.protobuf.util;version=${project.version}</Export-Package>
+          </instructions>
+        </configuration>
+      </plugin>
+    </plugins>
+  </build>
+
+</project>

protobuf-java.spec

@@ -0,0 +1,283 @@
+#
+# spec file for package protobuf-java
+#
+# Copyright (c) 2026 SUSE LLC and contributors
+# Copyright (c) 2024 Andreas Stieger <Andreas.Stieger@gmx.de>
+#
+# All modifications and additions to the file contributed by third parties
+# remain the property of their copyright owners, unless otherwise agreed
+# upon. The license for this file, and modifications and additions to the
+# file, is the same license as for the pristine package itself (unless the
+# license for the pristine package is not an Open Source License, in which
+# case the license is the MIT License). An "Open Source License" is a
+# license that conforms to the Open Source Definition (Version 1.9)
+# published by the Open Source Initiative.
+
+# Please submit bugfixes or comments via https://bugs.opensuse.org/
+#
+
+
+%define tarname protobuf
+Name:           protobuf-java
+Version:        28.3
+Release:        0
+Summary:        Java Bindings for Google Protocol Buffers
+License:        BSD-3-Clause
+Group:          Development/Libraries/Java
+URL:            https://github.com/protocolbuffers/protobuf
+Source0:        https://github.com/protocolbuffers/protobuf/releases/download/v%{version}/%{tarname}-%{version}.tar.gz
+Source1:        https://repo1.maven.org/maven2/com/google/protobuf/%{name}/4.%{version}/%{name}-4.%{version}.pom
+Source2:        https://repo1.maven.org/maven2/com/google/protobuf/%{name}lite/4.%{version}/%{name}lite-4.%{version}.pom
+Source3:        https://repo1.maven.org/maven2/com/google/protobuf/%{name}-util/4.%{version}/%{name}-util-4.%{version}.pom
+BuildRequires:  fdupes
+BuildRequires:  java-devel >= 1.8
+BuildRequires:  maven-local
+BuildRequires:  protobuf-devel >= %{version}
+BuildRequires:  mvn(com.google.code.findbugs:jsr305)
+BuildRequires:  mvn(com.google.code.gson:gson)
+BuildRequires:  mvn(com.google.errorprone:error_prone_annotations)
+BuildRequires:  mvn(com.google.guava:guava)
+BuildRequires:  mvn(com.google.j2objc:j2objc-annotations)
+BuildRequires:  mvn(org.apache.felix:maven-bundle-plugin)
+Requires:       java >= 1.8
+BuildArch:      noarch
+
+%description
+Protocol Buffers are a way of encoding structured data in an efficient yet
+extensible format. Google uses Protocol Buffers for almost all of its internal
+RPC protocols and file formats.
+
+This package contains the Java bindings.
+
+%package parent
+Summary:        Java Bindings for Google Protocol Buffers (parent pom)
+
+%description parent
+Protocol Buffers are a way of encoding structured data in an efficient yet
+extensible format. Google uses Protocol Buffers for almost all of its internal
+RPC protocols and file formats.
+
+This package contains the parent pom of the Java bindings.
+
+%package bom
+Summary:        Java Bindings for Google Protocol Buffers (bom)
+
+%description bom
+Protocol Buffers are a way of encoding structured data in an efficient yet
+extensible format. Google uses Protocol Buffers for almost all of its internal
+RPC protocols and file formats.
+
+This package contains the bill-of-materials pom of the Java bindings.
+
+%package javadoc
+Summary:        Javadoc for %{name}
+Group:          Documentation/HTML
+
+%description javadoc
+This package contains the API documentation for %{name}.
+
+%prep
+%autosetup -p1 -n %{tarname}-%{version}
+
+# The previous blank line is crucial for older system being able
+# to use the autosetup macro
+
+pushd java
+cp %{SOURCE1} core/pom.xml
+cp %{SOURCE2} lite/pom.xml
+cp %{SOURCE3} util/pom.xml
+%pom_disable_module kotlin
+%pom_disable_module kotlin-lite
+%pom_remove_plugin :animal-sniffer-maven-plugin
+%pom_xpath_set "pom:plugin[pom:artifactId[text()='maven-compiler-plugin']]/pom:configuration/pom:source" "1.8"
+%pom_xpath_set "pom:plugin[pom:artifactId[text()='maven-compiler-plugin']]/pom:configuration/pom:target" "1.8"
+
+%{mvn_package} :{*}-parent parent
+%{mvn_package} :{*}-bom bom
+
+%{mvn_file} :{*} @1
+%{mvn_file} :%{name} %{tarname}
+
+popd
+
+%build
+pushd java
+# Core build
+protoc \
+  --java_out=core/src/main/java \
+  --proto_path=../src \
+  --proto_path=core/src/main/resources/google/protobuf \
+  core/src/main/resources/google/protobuf/java_features.proto \
+  ../src/google/protobuf/any.proto \
+  ../src/google/protobuf/api.proto \
+  ../src/google/protobuf/descriptor.proto \
+  ../src/google/protobuf/duration.proto \
+  ../src/google/protobuf/empty.proto \
+  ../src/google/protobuf/field_mask.proto \
+  ../src/google/protobuf/source_context.proto \
+  ../src/google/protobuf/struct.proto \
+  ../src/google/protobuf/timestamp.proto \
+  ../src/google/protobuf/type.proto \
+  ../src/google/protobuf/wrappers.proto \
+  ../src/google/protobuf/compiler/plugin.proto
+cp \
+  ../src/google/protobuf/any.proto \
+  ../src/google/protobuf/api.proto \
+  ../src/google/protobuf/descriptor.proto \
+  ../src/google/protobuf/duration.proto \
+  ../src/google/protobuf/empty.proto \
+  ../src/google/protobuf/field_mask.proto \
+  ../src/google/protobuf/source_context.proto \
+  ../src/google/protobuf/struct.proto \
+  ../src/google/protobuf/timestamp.proto \
+  ../src/google/protobuf/type.proto \
+  ../src/google/protobuf/wrappers.proto \
+  ../src/google/protobuf/compiler/plugin.proto \
+  core/src/main/resources/google/protobuf/
+# Lite build
+mkdir -p lite/src/main/resources/google/protobuf
+mkdir -p lite/src/main/java/com/google/protobuf
+# lite sources from lite/BUILD.bazel
+cp \
+  core/src/main/java/com/google/protobuf/AbstractMessageLite.java \
+  core/src/main/java/com/google/protobuf/AbstractParser.java \
+  core/src/main/java/com/google/protobuf/AbstractProtobufList.java \
+  core/src/main/java/com/google/protobuf/AllocatedBuffer.java \
+  core/src/main/java/com/google/protobuf/Android.java \
+  core/src/main/java/com/google/protobuf/ArrayDecoders.java \
+  core/src/main/java/com/google/protobuf/BinaryReader.java \
+  core/src/main/java/com/google/protobuf/BinaryWriter.java \
+  core/src/main/java/com/google/protobuf/BooleanArrayList.java \
+  core/src/main/java/com/google/protobuf/BufferAllocator.java \
+  core/src/main/java/com/google/protobuf/ByteBufferWriter.java \
+  core/src/main/java/com/google/protobuf/ByteOutput.java \
+  core/src/main/java/com/google/protobuf/ByteString.java \
+  core/src/main/java/com/google/protobuf/CanIgnoreReturnValue.java \
+  core/src/main/java/com/google/protobuf/CheckReturnValue.java \
+  core/src/main/java/com/google/protobuf/CodedInputStream.java \
+  core/src/main/java/com/google/protobuf/CodedInputStreamReader.java \
+  core/src/main/java/com/google/protobuf/CodedOutputStream.java \
+  core/src/main/java/com/google/protobuf/CodedOutputStreamWriter.java \
+  core/src/main/java/com/google/protobuf/CompileTimeConstant.java \
+  core/src/main/java/com/google/protobuf/DoubleArrayList.java \
+  core/src/main/java/com/google/protobuf/ExperimentalApi.java \
+  core/src/main/java/com/google/protobuf/ExtensionLite.java \
+  core/src/main/java/com/google/protobuf/ExtensionRegistryFactory.java \
+  core/src/main/java/com/google/protobuf/ExtensionRegistryLite.java \
+  core/src/main/java/com/google/protobuf/ExtensionSchema.java \
+  core/src/main/java/com/google/protobuf/ExtensionSchemaLite.java \
+  core/src/main/java/com/google/protobuf/ExtensionSchemas.java \
+  core/src/main/java/com/google/protobuf/FieldInfo.java \
+  core/src/main/java/com/google/protobuf/FieldSet.java \
+  core/src/main/java/com/google/protobuf/FieldType.java \
+  core/src/main/java/com/google/protobuf/FloatArrayList.java \
+  core/src/main/java/com/google/protobuf/GeneratedMessageInfoFactory.java \
+  core/src/main/java/com/google/protobuf/GeneratedMessageLite.java \
+  core/src/main/java/com/google/protobuf/InlineMe.java \
+  core/src/main/java/com/google/protobuf/IntArrayList.java \
+  core/src/main/java/com/google/protobuf/Internal.java \
+  core/src/main/java/com/google/protobuf/InvalidProtocolBufferException.java \
+  core/src/main/java/com/google/protobuf/IterableByteBufferInputStream.java \
+  core/src/main/java/com/google/protobuf/Java8Compatibility.java \
+  core/src/main/java/com/google/protobuf/JavaType.java \
+  core/src/main/java/com/google/protobuf/LazyField.java \
+  core/src/main/java/com/google/protobuf/LazyFieldLite.java \
+  core/src/main/java/com/google/protobuf/LazyStringArrayList.java \
+  core/src/main/java/com/google/protobuf/LazyStringList.java \
+  core/src/main/java/com/google/protobuf/ListFieldSchema.java \
+  core/src/main/java/com/google/protobuf/ListFieldSchemaLite.java \
+  core/src/main/java/com/google/protobuf/ListFieldSchemas.java \
+  core/src/main/java/com/google/protobuf/LongArrayList.java \
+  core/src/main/java/com/google/protobuf/ManifestSchemaFactory.java \
+  core/src/main/java/com/google/protobuf/MapEntryLite.java \
+  core/src/main/java/com/google/protobuf/MapFieldLite.java \
+  core/src/main/java/com/google/protobuf/MapFieldSchema.java \
+  core/src/main/java/com/google/protobuf/MapFieldSchemaLite.java \
+  core/src/main/java/com/google/protobuf/MapFieldSchemas.java \
+  core/src/main/java/com/google/protobuf/MessageInfo.java \
+  core/src/main/java/com/google/protobuf/MessageInfoFactory.java \
+  core/src/main/java/com/google/protobuf/MessageLite.java \
+  core/src/main/java/com/google/protobuf/MessageLiteOrBuilder.java \
+  core/src/main/java/com/google/protobuf/MessageLiteToString.java \
+  core/src/main/java/com/google/protobuf/MessageSchema.java \
+  core/src/main/java/com/google/protobuf/MessageSetSchema.java \
+  core/src/main/java/com/google/protobuf/MutabilityOracle.java \
+  core/src/main/java/com/google/protobuf/NewInstanceSchema.java \
+  core/src/main/java/com/google/protobuf/NewInstanceSchemaLite.java \
+  core/src/main/java/com/google/protobuf/NewInstanceSchemas.java \
+  core/src/main/java/com/google/protobuf/OneofInfo.java \
+  core/src/main/java/com/google/protobuf/Parser.java \
+  core/src/main/java/com/google/protobuf/PrimitiveNonBoxingCollection.java \
+  core/src/main/java/com/google/protobuf/ProtoSyntax.java \
+  core/src/main/java/com/google/protobuf/Protobuf.java \
+  core/src/main/java/com/google/protobuf/ProtobufArrayList.java \
+  core/src/main/java/com/google/protobuf/ProtocolStringList.java \
+  core/src/main/java/com/google/protobuf/RawMessageInfo.java \
+  core/src/main/java/com/google/protobuf/Reader.java \
+  core/src/main/java/com/google/protobuf/RopeByteString.java \
+  core/src/main/java/com/google/protobuf/RuntimeVersion.java \
+  core/src/main/java/com/google/protobuf/Schema.java \
+  core/src/main/java/com/google/protobuf/SchemaFactory.java \
+  core/src/main/java/com/google/protobuf/SchemaUtil.java \
+  core/src/main/java/com/google/protobuf/SmallSortedMap.java \
+  core/src/main/java/com/google/protobuf/StructuralMessageInfo.java \
+  core/src/main/java/com/google/protobuf/TextFormatEscaper.java \
+  core/src/main/java/com/google/protobuf/UninitializedMessageException.java \
+  core/src/main/java/com/google/protobuf/UnknownFieldSchema.java \
+  core/src/main/java/com/google/protobuf/UnknownFieldSetLite.java \
+  core/src/main/java/com/google/protobuf/UnknownFieldSetLiteSchema.java \
+  core/src/main/java/com/google/protobuf/UnmodifiableLazyStringList.java \
+  core/src/main/java/com/google/protobuf/UnsafeByteOperations.java \
+  core/src/main/java/com/google/protobuf/UnsafeUtil.java \
+  core/src/main/java/com/google/protobuf/Utf8.java \
+  core/src/main/java/com/google/protobuf/WireFormat.java \
+  core/src/main/java/com/google/protobuf/Writer.java \
+  lite/src/main/java/com/google/protobuf/
+protoc \
+  --java_out=lite:lite/src/main/java \
+  --proto_path=../src \
+  --proto_path=core/src/main/resources/google/protobuf \
+  ../src/google/protobuf/any.proto \
+  ../src/google/protobuf/api.proto \
+  ../src/google/protobuf/descriptor.proto \
+  ../src/google/protobuf/duration.proto \
+  ../src/google/protobuf/empty.proto \
+  ../src/google/protobuf/field_mask.proto \
+  ../src/google/protobuf/source_context.proto \
+  ../src/google/protobuf/struct.proto \
+  ../src/google/protobuf/timestamp.proto \
+  ../src/google/protobuf/type.proto \
+  ../src/google/protobuf/wrappers.proto
+cp \
+  ../src/google/protobuf/any.proto \
+  ../src/google/protobuf/api.proto \
+  ../src/google/protobuf/descriptor.proto \
+  ../src/google/protobuf/duration.proto \
+  ../src/google/protobuf/empty.proto \
+  ../src/google/protobuf/field_mask.proto \
+  ../src/google/protobuf/source_context.proto \
+  ../src/google/protobuf/struct.proto \
+  ../src/google/protobuf/timestamp.proto \
+  ../src/google/protobuf/type.proto \
+  ../src/google/protobuf/wrappers.proto \
+  lite/src/main/resources/google/protobuf/
+
+%{mvn_build} -f -- -Dprotoc=$(type -p protoc)
+popd
+
+%install
+pushd java
+%mvn_install
+%fdupes -s %{buildroot}%{_javadocdir}
+
+%files -f java/.mfiles
+%license LICENSE
+
+%files bom -f java/.mfiles-bom
+
+%files parent -f java/.mfiles-parent
+
+%files javadoc -f java/.mfiles-javadoc
+%license LICENSE
+
+%changelog

protobuf-javalite-4.28.3.pom

@@ -0,0 +1,41 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+  <modelVersion>4.0.0</modelVersion>
+  <parent>
+    <groupId>com.google.protobuf</groupId>
+    <artifactId>protobuf-parent</artifactId>
+    <version>4.28.3</version>
+  </parent>
+
+  <artifactId>protobuf-javalite</artifactId>
+  <packaging>jar</packaging>
+
+  <name>Protocol Buffers [Lite]</name>
+  <description>
+    Lite version of Protocol Buffers library. This version is optimized for code size, but does
+    not guarantee API/ABI stability.
+  </description>
+  <dependencies>
+    
+  </dependencies>
+
+  <build>
+    <plugins>
+      <!-- OSGI bundle configuration -->
+      <plugin>
+        <groupId>org.apache.felix</groupId>
+        <artifactId>maven-bundle-plugin</artifactId>
+        <extensions>true</extensions>
+        <configuration>
+          <instructions>
+            <Automatic-Module-Name>com.google.protobuf</Automatic-Module-Name> <!-- Java9+ Jigsaw module name -->
+            <Bundle-DocURL>https://developers.google.com/protocol-buffers/</Bundle-DocURL>
+            <Bundle-SymbolicName>com.google.protobuf</Bundle-SymbolicName>
+            <Export-Package>com.google.protobuf;version=${project.version}</Export-Package>
+            <Import-Package>sun.misc;resolution:=optional,*</Import-Package>
+          </instructions>
+        </configuration>
+      </plugin>
+    </plugins>
+  </build>
+</project>

protobuf.changes

@@ -1,3 +1,135 @@
+-------------------------------------------------------------------
+Tue Jan 27 08:29:42 UTC 2026 - John Paul Adrian Glaubitz <adrian.glaubitz@suse.com>
+
+- Delete deprecated google/__init__.py namespace file
+
+-------------------------------------------------------------------
+Mon Jan 26 13:00:51 UTC 2026 - John Paul Adrian Glaubitz <adrian.glaubitz@suse.com>
+
+- Add CVE-2026-0994.patch to fix google.protobuf.Any recursion depth
+  bypass in Python json_format.ParseDict (bsc#1257173, CVE-2026-0994)
+
+-------------------------------------------------------------------
+Mon Jan  5 12:14:24 UTC 2026 - John Paul Adrian Glaubitz <adrian.glaubitz@suse.com>
+
+- Cherry-pick protobuf-fix-google-imports.patch to fix import issues of
+  reverse-dependency packages within the google namespace (bsc#1244918)
+
+-------------------------------------------------------------------
+Fri Nov 14 14:32:06 UTC 2025 - John Paul Adrian Glaubitz <adrian.glaubitz@suse.com>
+
+- Add internal-pure-python-fixes.patch to backport changes required for CVE fix
+- Add CVE-2025-4565.patch to fix parsing of untrusted Protocol Buffers
+  data containing an arbitrary number of recursive groups or messages
+  can lead to crash due to RecursionError (bsc#1244663, CVE-2025-4565)
+
+-------------------------------------------------------------------
+Mon Oct 28 08:20:17 UTC 2024 - Dirk Müller <dmueller@suse.com>
+
+- python: switch to pypi package to get the cythonized component
+- drop python-protobuf-setup_py.patch (obsolete)
+
+-------------------------------------------------------------------
+Sat Oct 26 08:40:48 UTC 2024 - Jan Engelhardt <jengelh@inai.de>
+
+- Add versionize-shlibs.patch, delete static-utf8-ranges.patch
+  * Build the libutf8_range and libutf8_validity as shared library
+    to conform to SLPP
+
+-------------------------------------------------------------------
+Fri Oct 25 15:24:11 UTC 2024 - Dirk Müller <dmueller@suse.com>
+
+- update to 28.3:
+  * Fix packed reflection handling bug in edition 2023.
+  * Mute the minor version warning
+  * Populate Kotlin Manifest Files
+  * Re-export includingDefaultValueFields in deprecated state for
+    important Cloud customer. (https://github.com/protocolbuffers
+    /protobuf/commit/3b62d78dc70d2b43af5998d427452246279363c7)
+  * Cherrypick restoration of mutableCopy helpers (https://github
+    .com/protocolbuffers/protobuf/commit/3ea568a9b6107ebf0d617c47
+    6f53a31490fd3182)
+  * Mute the minor version warning
+
+-------------------------------------------------------------------
+Thu Oct 24 20:56:51 UTC 2024 - Fridrich Strba <fstrba@suse.com>
+
+- Added patch: static-utf8-ranges.patch
+  * Build the libutf8_range and libutf8_validity as static library
+    to avoid installcheck failures
+
+-------------------------------------------------------------------
+Wed Oct 23 08:44:06 UTC 2024 - Fridrich Strba <fstrba@suse.com>
+
+- Java: fix generating proper maven descriptor for protoc on aarch64
+- Java: rename global variable buildarch -> protoc_arch to avoid
+  name clash on sle15
+
+-------------------------------------------------------------------
+Mon Oct 21 20:55:21 UTC 2024 - Fridrich Strba <fstrba@suse.com>
+
+- Java: mimic the bazel build and build also the protobuf-javalite
+  artifact
+
+-------------------------------------------------------------------
+Mon Oct 21 13:27:27 UTC 2024 - Dirk Müller <dmueller@suse.com>
+
+- Python: keep building for 15.4+
+
+-------------------------------------------------------------------
+Mon Oct 21 11:34:51 UTC 2024 - Fridrich Strba <fstrba@suse.com>
+
+- Java: add maven artifact metadata for the protoc binary
+  * make the main package archful, since the protoc artifact
+    metadata declares the architecture of the binary
+
+-------------------------------------------------------------------
+Sat Oct 19 17:03:05 UTC 2024 - Fridrich Strba <fstrba@suse.com>
+
+- Python: Generate the headers that the Cython native library needs
+  to build
+- Added patch:
+  * python-protobuf-setup_py.patch
+    + make the bitrotten setup.py find the source files for the
+      C native library
+    + Modify the code so that the build works on python 3.6 too
+
+-------------------------------------------------------------------
+Tue Oct 15 13:49:20 UTC 2024 - Fridrich Strba <fstrba@suse.com>
+
+- Splitting the java and python parts into separate packages
+  * allows much more readable and simple spec files
+  * allows disabling bindings separately from the main package
+- Build protobuf-java with the upstream version that is currently
+  4.28.2
+- Add a pre_checkin.sh script to synchronize the changes files
+
+-------------------------------------------------------------------
+Mon Oct  7 10:46:17 UTC 2024 - Adrian Schröter <adrian@suse.de>
+
+- update to 28.2
+  C++: Fix cord handling in DynamicMessage and oneofs
+  Java: Add recursion check when parsing unknown fields
+- python packages became arch dependend
+
+-------------------------------------------------------------------
+Sun Aug 11 09:49:53 UTC 2024 - Andreas Stieger <andreas.stieger@gmx.de>
+
+- tweak and correct how minimum version of abseil is specified
+  (20230125 to 20230125.3)
+- Remove explicit requirements of the protobuf-devel package, as
+  the they are autogenerated when needed
+
+-------------------------------------------------------------------
+Fri Aug  2 16:42:09 UTC 2024 - Andreas Stieger <andreas.stieger@gmx.de>
+
+- update to 25.4:
+  * Java: Check that size is non-negative when reading string or
+    bytes in StreamDecoder
+  * Java: Add Automatic-Module-Name
+  * PHP: Regen stale files
+  * Ruby C-Extension: Regen stale files
+
 -------------------------------------------------------------------
 Sat Mar  9 20:36:14 UTC 2024 - Andreas Stieger <andreas.stieger@gmx.de>
 

protobuf.spec

@@ -1,7 +1,8 @@
 #
 # spec file for package protobuf
 #
-# Copyright (c) 2024 SUSE LLC
+# Copyright (c) 2026 SUSE LLC and contributors
+# Copyright (c) 2024 Andreas Stieger <Andreas.Stieger@gmx.de>
 #
 # All modifications and additions to the file contributed by third parties
 # remain the property of their copyright owners, unless otherwise agreed
@@ -17,51 +18,112 @@
 
 
 %define tarname protobuf
-%define extra_java_flags -source 8 -target 8
+# see cmake/abseil-cpp.cmake and src/google/protobuf/port_def.inc
+%define abseil_min_version 20230125.3
+%global         sover 28_3_0
+%if 0%{?gcc_version} < 11
+%define with_gcc 11
+%endif
 # requires gmock, which is not yet in the distribution
 %bcond_with    check
-%bcond_without java
-%bcond_without python3
-%{?sle15_python_module_pythons}
+%global protoc_arch %{_arch}
+%ifarch x86_64 %{?x86_64}
+%global protoc_arch x86_64
+%endif
+%ifarch ppc
+%global protoc_arch ppc_32
+%endif
+%ifarch ppc64
+%global protoc_arch ppc_64
+%endif
+%ifarch ppc64le
+%global protoc_arch ppcle_64
+%endif
+%ifarch %{ix86}
+%global protoc_arch x86_32
+%endif
+%ifarch ia64
+%global protoc_arch itanium_64
+%endif
+%ifarch s390
+%global protoc_arch s390_32
+%endif
+%ifarch s390x
+%global protoc_arch s390_64
+%endif
+%ifarch %{arm}
+%global protoc_arch arm_32
+%endif
+%ifarch aarch64 %{arm64}
+%global protoc_arch aarch_64
+%endif
+# 32 bit sparc, optimized for v9
+%ifarch sparcv9
+%global protoc_arch sparc_32
+%endif
+# 64 bit sparc
+%ifarch sparc64
+%global protoc_arch sparc_64
+%endif
 Name:           protobuf
-Version:        25.3
-%global         sover 25_3_0
+Version:        28.3
 Release:        0
 Summary:        Protocol Buffers - Google's data interchange format
 License:        BSD-3-Clause
 Group:          Development/Libraries/C and C++
 URL:            https://github.com/protocolbuffers/protobuf
 Source0:        https://github.com/protocolbuffers/protobuf/releases/download/v%{version}/%{tarname}-%{version}.tar.gz
-Source1:        manifest.txt.in
-Source2:        baselibs.conf
-BuildRequires:  %{python_module abseil}
-BuildRequires:  %{python_module devel >= 3.7}
-BuildRequires:  %{python_module python-dateutil}
-BuildRequires:  %{python_module setuptools}
-BuildRequires:  abseil-cpp-devel >= 20230125
+Source1:        baselibs.conf
+Patch1:         versionize-shlibs.patch
+# PATCH-FIX-UPSTREAM - Backport changes from 29.x branch required to apply fix for CVE-2025-4565
+Patch2:         internal-pure-python-fixes.patch
+# PATCH-FIX-UPSTREAM - Fix parsing of untrusted Protocol Buffers data containing an arbitrary
+# number of recursive groups or messages can lead to crash due to RecursionError (CVE-2025-4565)
+Patch3:         CVE-2025-4565.patch
 BuildRequires:  cmake
 BuildRequires:  fdupes
-BuildRequires:  gcc-c++
+BuildRequires:  gcc%{?with_gcc}-c++
 BuildRequires:  pkgconfig
 BuildRequires:  python-rpm-macros
+# see cmake/abseil-cpp.cmake
+BuildRequires:  pkgconfig(absl_absl_check) >= %{abseil_min_version}
+BuildRequires:  pkgconfig(absl_absl_log) >= %{abseil_min_version}
+BuildRequires:  pkgconfig(absl_algorithm) >= %{abseil_min_version}
+BuildRequires:  pkgconfig(absl_base) >= %{abseil_min_version}
+BuildRequires:  pkgconfig(absl_bind_front) >= %{abseil_min_version}
+BuildRequires:  pkgconfig(absl_bits) >= %{abseil_min_version}
+BuildRequires:  pkgconfig(absl_btree) >= %{abseil_min_version}
+BuildRequires:  pkgconfig(absl_cleanup) >= %{abseil_min_version}
+BuildRequires:  pkgconfig(absl_cord) >= %{abseil_min_version}
+BuildRequires:  pkgconfig(absl_core_headers) >= %{abseil_min_version}
+BuildRequires:  pkgconfig(absl_debugging) >= %{abseil_min_version}
+BuildRequires:  pkgconfig(absl_die_if_null) >= %{abseil_min_version}
+BuildRequires:  pkgconfig(absl_dynamic_annotations) >= %{abseil_min_version}
+BuildRequires:  pkgconfig(absl_flags) >= %{abseil_min_version}
+BuildRequires:  pkgconfig(absl_flat_hash_map) >= %{abseil_min_version}
+BuildRequires:  pkgconfig(absl_flat_hash_set) >= %{abseil_min_version}
+BuildRequires:  pkgconfig(absl_function_ref) >= %{abseil_min_version}
+BuildRequires:  pkgconfig(absl_hash) >= %{abseil_min_version}
+BuildRequires:  pkgconfig(absl_layout) >= %{abseil_min_version}
+BuildRequires:  pkgconfig(absl_log_initialize) >= %{abseil_min_version}
+BuildRequires:  pkgconfig(absl_log_severity) >= %{abseil_min_version}
+BuildRequires:  pkgconfig(absl_memory) >= %{abseil_min_version}
+BuildRequires:  pkgconfig(absl_node_hash_map) >= %{abseil_min_version}
+BuildRequires:  pkgconfig(absl_node_hash_set) >= %{abseil_min_version}
+BuildRequires:  pkgconfig(absl_optional) >= %{abseil_min_version}
+BuildRequires:  pkgconfig(absl_span) >= %{abseil_min_version}
+BuildRequires:  pkgconfig(absl_status) >= %{abseil_min_version}
+BuildRequires:  pkgconfig(absl_statusor) >= %{abseil_min_version}
+BuildRequires:  pkgconfig(absl_strings) >= %{abseil_min_version}
+BuildRequires:  pkgconfig(absl_synchronization) >= %{abseil_min_version}
+BuildRequires:  pkgconfig(absl_time) >= %{abseil_min_version}
+BuildRequires:  pkgconfig(absl_type_traits) >= %{abseil_min_version}
+BuildRequires:  pkgconfig(absl_utility) >= %{abseil_min_version}
+BuildRequires:  pkgconfig(absl_variant) >= %{abseil_min_version}
 BuildRequires:  pkgconfig(zlib)
 %if %{with check}
 BuildRequires:  libgmock-devel >= 1.7.0
 %endif
-%if %{with java}
-BuildRequires:  java-devel >= 1.8
-BuildRequires:  javapackages-local >= 6
-%endif
-
-%if 0%{?suse_version} >= 1500
-# generate subpackages for every python3 flavor
-%define python_subpackage_only 1
-%python_subpackages
-%else
-# same "defaults" for all distributions, used in files section
-%define python_files() -n python3-%{**}
-%define python_sitelib %{python3_sitelib}
-%endif
 
 %description
 Protocol Buffers are a way of encoding structured data in an efficient yet
@@ -95,97 +157,49 @@ Protocol Buffers are a way of encoding structured data in an efficient yet
 extensible format. Google uses Protocol Buffers for almost all of its internal
 RPC protocols and file formats.
 
+%package -n libutf8_range-%{sover}
+Summary:        UTF-8 validation libraries from Protobuf
+Group:          System/Libraries
+
+%description -n libutf8_range-%{sover}
+UTF-8 string validation library with optional SIMD acceleration (armv8a NEON,
+SSE4 and AVX2).
+
 %package devel
 Summary:        Header files, libraries and development documentation for %{name}
 Group:          Development/Libraries/C and C++
-Requires:       abseil-cpp-devel >= 20230125
-Requires:       gcc-c++
-Requires:       libprotobuf%{sover} = %{VERSION}
-Requires:       libprotobuf-lite%{sover}
-Requires:       pkgconfig(zlib)
+Requires:       libprotobuf%{sover} = %{version}
+Requires:       libprotobuf-lite%{sover} = %{version}
+Requires:       libutf8_range-%{sover} = %{version}
 Conflicts:      protobuf2-devel
 Conflicts:      protobuf21-devel
-Provides:       libprotobuf-devel = %{VERSION}
+Provides:       libprotobuf-devel = %{version}
+# Not generated automatically without javapackages-local as dependency
+Provides:       mvn(com.google.protobuf:protoc:exe:linux-%{protoc_arch}:)
 
 %description devel
 Protocol Buffers are a way of encoding structured data in an efficient yet
 extensible format. Google uses Protocol Buffers for almost all of its internal
 RPC protocols and file formats.
 
-%if 0%{?python_subpackage_only}
-%package -n python-%{name}
-Version:        4.%{VERSION}
-Summary:        Python Bindings for Google Protocol Buffers
-Group:          Development/Libraries/Python
-BuildArch:      noarch
-
-%description -n python-%{name}
-This package contains the Python bindings for Google Protocol Buffers.
-
-%else
-
-%package -n python3-%{name}
-Version:        4.%{VERSION}
-Summary:        Python3 Bindings for Google Protocol Buffers
-Group:          Development/Libraries/Python
-BuildArch:      noarch
-
-%description -n python3-%{name}
-This package contains the Python bindings for Google Protocol Buffers.
-%endif
-
-%package -n %{name}-java
-Summary:        Java Bindings for Google Protocol Buffers
-Group:          Development/Libraries/Java
-Requires:       java >= 1.6.0
-BuildArch:      noarch
-
-%description -n %{name}-java
-This package contains the Java bindings for Google Protocol Buffers.
-
 %prep
-%autosetup -p1 -n %{tarname}-%{VERSION}
+%autosetup -p1 -n %{tarname}-%{version}
 
-# python module have their own version specified in python/google/protobuf/__init__.py
-grep -qF "'4.%{VERSION}'" python/google/protobuf/__init__.py
-
-# The previous blank line is crucial for older system being able
-# to use the autosetup macro
 mkdir gmock
 
-%if %{with python3}
-# only needed for test suite which we don't call anyways.
-# googleapis is broken on sle12
-sed -i '/apputils/d' python/setup.py
-sed -i '/google_test_dir/d' python/setup.py
-%endif
-# kill shebang that we do not really want
-sed -i -e '/env python/d' python/google/protobuf/internal/*.py
-
 %build
 %global _lto_cflags %{_lto_cflags} -ffat-lto-objects
 
 # tests are not part of offical tar ball
+%if 0%{?with_gcc}
+export CXX=g++-%{with_gcc}
+export CC=gcc-%{with_gcc}
+%endif
 %cmake \
   -Dprotobuf_BUILD_TESTS=OFF \
   -Dprotobuf_ABSL_PROVIDER=package
 %cmake_build
 
-%if %{with java}
-pushd ../java
-../build/protoc --java_out=core/src/main/java -I../src ../src/google/protobuf/descriptor.proto
-mkdir classes
-javac %{extra_java_flags} -d classes core/src/main/java/com/google/protobuf/*.java
-sed -e 's/@VERSION@/%{version}/' < %{SOURCE1} > manifest.txt
-jar cfm %{name}-java-%{version}.jar manifest.txt -C classes com
-popd
-%endif
-
-pushd ../python
-export PROTOC=../build/protoc
-%python_build
-popd
-
 %if %{with check}
 %check
 %make_build check
@@ -194,41 +208,62 @@ popd
 %install
 %cmake_install
 install -Dm 0644 editors/proto.vim %{buildroot}%{_datadir}/vim/site/syntax/proto.vim
+# manual ln that we could not manage to get into versionize-shlibs.patch
+ln -s libutf8_range-%{version}.0.so %{buildroot}/%{_libdir}/libutf8_range.so
+ln -s libutf8_validity-%{version}.0.so %{buildroot}/%{_libdir}/libutf8_validity.so
 
-%if %{with java}
-pushd java
-install -d -m 0755 %{buildroot}%{_javadir}
-install -p -m 0644 %{name}-java-%{version}.jar %{buildroot}%{_javadir}/%{name}-java.jar
-ln -s %{name}-java.jar %{buildroot}%{_javadir}/%{name}.jar
-install -d -m 0755 %{buildroot}%{_mavenpomdir}
-%{mvn_install_pom} core/pom.xml %{buildroot}%{_mavenpomdir}/%{name}-java.pom
-%add_maven_depmap %{name}-java.pom %{name}-java.jar
-popd
-%endif
-
-pushd python
-export PROTOC=../build/protoc
-%python_install
-popd
-%python_expand %fdupes %{buildroot}%{$python_sitelib}
+# create maven metadata for the protoc executable
+install -dm 0755 %{buildroot}%{_datadir}/maven-metadata
+cat <<__PROTOBUF__ >>%{buildroot}%{_datadir}/maven-metadata/%{name}-protoc.xml
+<metadata xmlns="http://fedorahosted.org/xmvn/METADATA/2.3.0">
+  <artifacts>
+    <artifact>
+      <groupId>com.google.protobuf</groupId>
+      <artifactId>protoc</artifactId>
+      <extension>exe</extension>
+      <classifier>linux-%{protoc_arch}</classifier>
+      <version>4.%{version}</version>
+      <path>%{_bindir}/protoc</path>
+    </artifact>
+  </artifacts>
+</metadata>
+__PROTOBUF__
 
 %fdupes %{buildroot}%{_prefix}
 
+# SLE12 does not define this macro
+%if %{undefined ldconfig_scriptlets}
+%post -n libprotobuf%{sover} -p /sbin/ldconfig
+%postun -n libprotobuf%{sover} -p /sbin/ldconfig
+%post -n libprotoc%{sover} -p /sbin/ldconfig
+%postun -n libprotoc%{sover} -p /sbin/ldconfig
+%post -n libprotobuf-lite%{sover} -p /sbin/ldconfig
+%postun -n libprotobuf-lite%{sover} -p /sbin/ldconfig
+%post -n libutf8_range-%{sover} -p /sbin/ldconfig
+%postun -n libutf8_range-%{sover} -p /sbin/ldconfig
+%else
 %ldconfig_scriptlets -n libprotobuf%{sover}
 %ldconfig_scriptlets -n libprotoc%{sover}
 %ldconfig_scriptlets -n libprotobuf-lite%{sover}
+%ldconfig_scriptlets -n libutf8_range-%{sover}
+%endif
 
 %files -n libprotobuf%{sover}
 %license LICENSE
-%{_libdir}/libprotobuf.so.%{VERSION}.0
+%{_libdir}/libprotobuf.so.%{version}.0
 
 %files -n libprotoc%{sover}
 %license LICENSE
-%{_libdir}/libprotoc.so.%{VERSION}.0
+%{_libdir}/libprotoc.so.%{version}.0
 
 %files -n libprotobuf-lite%{sover}
 %license LICENSE
-%{_libdir}/libprotobuf-lite.so.%{VERSION}.0
+%{_libdir}/libprotobuf-lite.so.%{version}.0
+
+%files -n libutf8_range-%{sover}
+%license LICENSE
+%{_libdir}/libutf8_range-%{version}.0.so
+%{_libdir}/libutf8_validity-%{version}.0.so
 
 %files devel
 %license LICENSE
@@ -239,11 +274,13 @@ popd
 %dir %{_includedir}/java/core
 %dir %{_includedir}/java/core/src
 %dir %{_includedir}/java/core/src/main
-%dir %{_includedir}/java/core/src/main/java
-%dir %{_includedir}/java/core/src/main/java/com
-%dir %{_includedir}/java/core/src/main/java/com/google
-%dir %{_includedir}/java/core/src/main/java/com/google/protobuf
-%{_includedir}/java/core/src/main/java/com/google/protobuf/java_features.proto
+%dir %{_includedir}/java/core/src/main/resources
+%dir %{_includedir}/java/core/src/main/resources/
+%dir %{_includedir}/java/core/src/main/resources/google
+%dir %{_includedir}/java/core/src/main/resources/google/protobuf
+%{_includedir}/java/core/src/main/resources/google/protobuf/java_features.proto
+%{_includedir}/upb
+%{_includedir}/upb_generator
 %{_includedir}/*.h
 %{_libdir}/cmake/protobuf
 %{_libdir}/cmake/utf8_range
@@ -251,23 +288,10 @@ popd
 %{_libdir}/libprotobuf-lite.so
 %{_libdir}/libprotobuf.so
 %{_libdir}/libprotoc.so
-%{_libdir}/libutf8_range.a
-%{_libdir}/libutf8_validity.a
+%{_libdir}/libupb.a
+%{_libdir}/libutf8_range.so
+%{_libdir}/libutf8_validity.so
 %{_datadir}/vim
-
-%if %{with java}
-%files -n %{name}-java -f java/.mfiles
-%license LICENSE
-%{_javadir}/%{name}.jar
-%endif
-
-%if %{with python3}
-%files %{python_files %{name}}
-%license LICENSE
-%dir %{python_sitelib}/google
-%{python_sitelib}/google/protobuf
-%{python_sitelib}/protobuf*nspkg.pth
-%{python_sitelib}/protobuf*info
-%endif
+%{_datadir}/maven-metadata
 
 %changelog

python-protobuf.spec

@@ -0,0 +1,75 @@
+#
+# spec file for package python-protobuf
+#
+# Copyright (c) 2026 SUSE LLC and contributors
+# Copyright (c) 2024 Andreas Stieger <Andreas.Stieger@gmx.de>
+#
+# All modifications and additions to the file contributed by third parties
+# remain the property of their copyright owners, unless otherwise agreed
+# upon. The license for this file, and modifications and additions to the
+# file, is the same license as for the pristine package itself (unless the
+# license for the pristine package is not an Open Source License, in which
+# case the license is the MIT License). An "Open Source License" is a
+# license that conforms to the Open Source Definition (Version 1.9)
+# published by the Open Source Initiative.
+
+# Please submit bugfixes or comments via https://bugs.opensuse.org/
+#
+
+
+%define baseversion 28.3
+%{?sle15_python_module_pythons}
+Name:           python-protobuf
+Version:        5.%{baseversion}
+Release:        0
+Summary:        Python Bindings for Google Protocol Buffers
+License:        BSD-3-Clause
+Group:          Development/Libraries/Python
+URL:            https://github.com/protocolbuffers/protobuf
+Source0:        https://files.pythonhosted.org/packages/source/p/protobuf/protobuf-%{version}.tar.gz
+Patch0:         https://github.com/protocolbuffers/protobuf/commit/8351926380c7cc91aae6df5695c91426e209f958.patch#/protobuf-fix-google-imports.patch
+# PATCH-FIX-UPSTREAM - Fix google.protobuf.Any recursion depth bypass in Python json_format.ParseDict (CVE-2026-0994)
+Patch1:         CVE-2026-0994.patch
+BuildRequires:  %{python_module devel}
+BuildRequires:  %{python_module pip}
+BuildRequires:  %{python_module python-dateutil}
+BuildRequires:  %{python_module setuptools}
+BuildRequires:  %{python_module wheel}
+BuildRequires:  fdupes
+%python_subpackages
+
+%description
+Protocol Buffers are a way of encoding structured data in an efficient yet
+extensible format. Google uses Protocol Buffers for almost all of its internal
+RPC protocols and file formats.
+
+This package contains the Python bindings for Google Protocol Buffers.
+
+%prep
+%autosetup -p2 -n protobuf-%{version}
+rm -f google/__init__.py
+
+# The previous blank line is crucial for older system being able
+# to use the autosetup macro
+
+grep -qF "'%{version}'" google/protobuf/__init__.py
+
+# kill shebang that we do not really want
+sed -i -e '/env python/d' google/protobuf/internal/*.py
+
+%build
+%pyproject_wheel
+
+%install
+%pyproject_install
+%python_expand %fdupes %{buildroot}%{$python_sitearch}
+
+%fdupes %{buildroot}%{_prefix}
+
+%files %{python_files}
+%license LICENSE
+%{python_sitearch}/google
+%{python_sitearch}/protobuf*nspkg.pth
+%{python_sitearch}/protobuf-%{version}.dist-info
+
+%changelog

versionize-shlibs.patch

@@ -0,0 +1,32 @@
+From: Jan Engelhardt <jengelh@inai.de>
+Date: 2024-10-28 10:10:20.918922623 +0100
+References: https://github.com/protocolbuffers/protobuf/pull/19009
+
+Unversioned libraries are strongly discouraged. Use
+https://en.opensuse.org/openSUSE:Shared_library_packaging_policy#When_there_is_no_versioning
+method 1 to remedy. Though utf8_range has a version of its own ("1.0"
+visible through the .pc file) and gets third_party/-like treatment,
+protobuf is the authoritative repository for it, using the protobuf
+version for our SONAME seems acceptable.
+
+This openSUSE patch follows SLPP's naming provisions and so is
+slightly different from PR19009 while the PR is unmerged.
+
+---
+ third_party/utf8_range/CMakeLists.txt |    8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+Index: protobuf-28.3/third_party/utf8_range/CMakeLists.txt
+===================================================================
+--- protobuf-28.3.orig/third_party/utf8_range/CMakeLists.txt
++++ protobuf-28.3/third_party/utf8_range/CMakeLists.txt
+@@ -19,6 +19,9 @@ add_library (utf8_range
+ # A heavier-weight C++ wrapper that supports Abseil.
+ add_library (utf8_validity utf8_validity.cc utf8_range.c)
+ 
++set_target_properties(utf8_range PROPERTIES OUTPUT_NAME ${LIB_PREFIX}utf8_range-${protobuf_VERSION})
++set_target_properties(utf8_validity PROPERTIES OUTPUT_NAME ${LIB_PREFIX}utf8_validity-${protobuf_VERSION})
++
+ # Load Abseil dependency.
+ if (NOT TARGET absl::strings)
+   if (NOT ABSL_ROOT_DIR)