OxiProto 0.1.5 Released — Protobuf Editions Actually Work Now (prost-reflect Used to Panic on the Word)

prost-reflect 0.16.5 doesn’t just reject a Protobuf Editions file — it panics while formatting the error message that was supposed to explain why.

Today we released OxiProto 0.1.5 — the COOLJAPAN Pure-Rust Protocol Buffers stack. This release brings Protobuf Editions (edition = "2023";) support the rest of the way: full spec-compliant feature resolution, decode-time enforcement, and — because the facade library everyone’s reflection path runs through can’t handle Editions files at all — a rewrite step that downlevels an Editions file into the proto2 equivalent it can.

No C++. No protoc binary on PATH. OxiProto’s native .proto parser and codegen stay Pure Rust; this release makes them correct for a syntax that Protobuf’s own reference tooling shipped over a year ago and most of the Rust ecosystem still can’t read.

Why OxiProto 0.1.5 is a game changer

Editions replaced proto2/proto3’s fixed syntax choice with six independently resolvable features — but getting from a parsed .proto file to something usable turned out to require solving three separate problems:

• Feature resolution itself. field_presence, enum_type, repeated_field_encoding, utf8_validation, message_encoding, and json_format each resolve through an inheritance chain — file → message → nested message → oneof → field, and enum → enum value — against per-edition baselines. Getting this wrong doesn’t fail loudly; it silently changes wire bytes.
• prost-reflect recognizes exactly two syntax values. Anything else — including "editions" — is refused, and in 0.16.5 the refusal itself panics while formatting the error. Every consumer of oxiproto_reflect::pool_from_fds (the re-exported DynamicMessage, oxiproto-json, the CLI’s encode/decode) was unusable for an Editions schema.
• Enforcement, not just parsing. utf8_validation = NONE and enum_type = CLOSED are proto2-era behaviors Editions makes explicit and selectable — resolving the feature is only half the job if decode doesn’t actually act on it.

OxiProto 0.1.5 solves all three:

• A new oxiproto_build::parser::features module resolves the full six-feature set through the correct inheritance chain, rejects removed constructs (optional/required/group in an Editions file) and misapplied features (presence on a repeated field, packing on a non-repeated one) with typed errors, and materializes the resolved features back into descriptor.proto-compatible form (since prost-types 0.14 doesn’t model Editions at all) as uninterpreted_option entries that survive the FileDescriptorSet boundary.
• A new oxiproto_reflect::editions module (downlevel_editions) rewrites an Editions file into its proto2 equivalent — the syntax baseline that actually preserves LABEL_REQUIRED, TYPE_GROUP, and explicit presence — with an explicit FieldOptions.packed written wherever proto2’s default (expanded) would otherwise diverge from Editions’ default (packed). Both reflection pool constructors apply it automatically; non-Editions files pass through byte-identically.
• utf8_validation and enum_type are now enforced at decode time everywhere, not just parsed and ignored — NONE-validation strings land in a new typed Value::UnvalidatedString that round-trips byte-identically, and closed-enum unrecognized values move to the unknown-field set exactly as proto2 implementations have always done.

Technical Deep Dive: three bugs the Editions work surfaced elsewhere

1. Generated code packed proto2 repeated scalars, diverging from protoc on the wire. oxiproto-codegen defaulted every unpacked-by-omission repeated scalar to packed, but protoc emits the expanded form for proto2. Fine for decoding (both forms are accepted either way) but wrong for anything doing byte-comparison, signing, or deterministic serialization against a real protoc-generated peer. The generator now classifies the file’s syntax and applies the correct per-syntax default.
2. Generated packed-repeated decode read from the wrong buffer. The packed element loop tested the nested packed buffer for emptiness but read from the enclosing message’s buffer — silently consuming the next fields on the wire or throwing UnexpectedEof. The identical bug hit map-entry key/value decoding. Found by the new proto2 packing tests, now fixed with the buffer name threaded explicitly.
3. Nested types referenced an undefined name in flat codegen layout. A field referring to .pkg.Outer.Inner generated code referencing the bare Inner instead of the flattened Outer_Inner codegen actually emits — code that didn’t compile whenever a schema had a nested message or enum field. This is unavoidable to trip for group fields, which always synthesize a nested message.

Both new nesting-depth DoS bounds — a 100-level cap on the text-format parser/encoder and a matching cap on the .proto source parser — close the same unbounded-recursion class the 0.1.4 wire-decode fixes addressed, now covering the two paths that were still open: DynamicMessage::from_text/to_text, and every CLI subcommand that reads a user-supplied .proto file.

Getting Started

[dependencies]
oxiproto = "0.1.6"

[build-dependencies]
oxiproto-build = "0.1.6"

fn main() {
    oxiproto_build::compile_protos(&["proto/my_service.proto"], &["proto/"]).unwrap();
}

Or reflect over an Editions file directly — the downlevel rewrite happens automatically:

use oxiproto_reflect::pool_from_fds_bytes;

// Works even though the source .proto declares `edition = "2023";` --
// pool_from_fds_bytes downlevels it to proto2 internally before handing
// it to the prost-reflect facade, which cannot parse "editions" at all.
let pool = pool_from_fds_bytes(&file_descriptor_set_bytes)?;

What’s New in 0.1.5

• Added: Editions 2023 support end to end (feature resolution, enforcement, prost-reflect downlevel facade); features.utf8_validation and features.enum_type now enforced at decode time for all syntaxes, not just Editions files; native proto2 group field support in oxiproto-reflect (wire, JSON, text-format); rustfmt.toml/clippy.toml at the workspace root.
• Security: message-nesting depth bounded in both the text-format parser/encoder and the .proto source parser (100-level cap, typed errors instead of stack overflow).
• Changed: presence-aware serialization — a field with presence (proto2 optional, a oneof member, a message field, or an Editions field with EXPLICIT presence) explicitly set to its type default is now emitted on the wire, in JSON, and in text, instead of being silently dropped (proto2’s “set to 0” vs “unset” distinction, restored); optional/required/group are now hard errors in an Editions file instead of a proto3 approximation.
• Fixed: the proto2 packing-default divergence, the wrong-buffer packed-decode bug, and the flat-codegen nested-type naming bug above; 7 .expect() panic sites removed from the .proto lexer/parser hot path, including one that could panic on a bad UTF-8 char boundary before the “cannot fail” assertion was even reached.

Tips

• If you’re on an Editions schema and reflection previously failed or panicked, just upgrade — pool_from_fds/pool_from_fds_bytes handle the downlevel transparently; no call-site change needed.
• Watch for the one intentional 0.x breaking change: native::Value gained UnvalidatedString(Vec<u8>). It’s additive but the enum isn’t #[non_exhaustive], so an exhaustive match on native::Value needs a new arm — it’s only ever produced by a string field whose resolved features.utf8_validation is NONE.
• If you maintain proto2 schemas and compare serialized bytes against protoc output (signing, determinism, golden fixtures), this release’s packing-default fix changes generated-code output for repeated scalar fields without an explicit [packed = ...] — re-generate and re-diff.
• Proto2 fixtures that explicitly set a field to its zero value may see new bytes on the wire — presence-aware serialization now emits those fields instead of dropping them, which is the correct proto2 behavior but a behavior change if you had fixtures built against the old (incorrect) drop-on-default logic.
• optional/required/group in an edition = "2023" file are now compile errors, not silent proto3 approximations — if you were relying on the old synthetic-oneof behavior for optional in an Editions file, express presence via features.field_presence instead.

This is the foundation

A protobuf stack that gets Editions right — resolution, enforcement, and interop with the reflection facade everyone actually uses — matters for anything doing schema evolution across proto2, proto3, and Editions in the same fleet. OxiRPC pins oxiproto/oxiproto-core/oxiproto-build/oxiproto-reflect for its RPC wire layer, and OxiRS pins oxiproto-build for protobuf codegen without a protoc dependency.

Repository: https://github.com/cool-japan/oxiproto

Star the repo if “the reflection library panics on the word ‘editions’” is exactly the kind of gap you’d rather have closed before you hit it in production.

The era of Protobuf Editions being a syntax you could declare but not actually use is over. Pure Rust Protocol Buffers that are fast, safe, and sovereign — is here.

— KitaSan at COOLJAPAN OÜ August 6, 2026