|
| 1 | +--- |
| 2 | +title: "Cross-Version Runtime Guarantee" |
| 3 | +weight: 930 |
| 4 | +toc_hide: false |
| 5 | +linkTitle: "Cross-Version Runtime Guarantee" |
| 6 | +no_list: "true" |
| 7 | +type: docs |
| 8 | +description: "The guarantees that the language has for cross-version runtime compatibility." |
| 9 | +--- |
| 10 | + |
| 11 | + |
| 12 | +<link rel="stylesheet" href="/includes/version-tables.css"> |
| 13 | + |
| 14 | +Protobuf language bindings have two components. The generated code (typically |
| 15 | +produced from `protoc`) and the runtime libraries that must be included when |
| 16 | +using the generated code. When these come from different releases of protobuf, |
| 17 | +we are in a "cross version runtime" situation. |
| 18 | + |
| 19 | +Historically, protobuf has not documented its cross-version runtime |
| 20 | +compatibility guarantees and has been inconsistent about enforcing what |
| 21 | +guarantees it provides. Moving forward, we intend to offer the following |
| 22 | +guarantees across all languages except C++. These are the default guarantees; |
| 23 | +however, owners of protobuf code generators and runtimes may explicitly override |
| 24 | +them with more specific guarantees for that language. |
| 25 | + |
| 26 | +## Major Versions {#major} |
| 27 | + |
| 28 | +Protobuf will not support mixing generated code and runtimes across major |
| 29 | +version boundaries. We will add “poison pills” where possible to detect these |
| 30 | +mismatches. |
| 31 | + |
| 32 | +## Minor Versions {#minor} |
| 33 | + |
| 34 | +Within a single major runtime version, generated code from an older version of |
| 35 | +`protoc` will run on a newer runtime. |
| 36 | + |
| 37 | +Within a single major runtime version, generated code from a newer version of |
| 38 | +`protoc` is not guaranteed to run on an older runtime. We will add “poison |
| 39 | +pills” where possible to detect these mismatches. |
| 40 | + |
| 41 | +## Security Exception {#exception} |
| 42 | + |
| 43 | +We reserve the right to violate the above promises if needed for security |
| 44 | +reasons. We expect these exceptions to be rare, but will always prioritize |
| 45 | +security above these guarantees. For example, |
| 46 | +[footmitten](https://cve.report/CVE-2022-3510) required paired updates to both |
| 47 | +the runtime and the generated code for Java. As a result, code generated by |
| 48 | +3.20.3 (which contained the footmitten fix) would not load with runtime library |
| 49 | +3.21.6 (which predates the footmitten fix), creating the following compatibility |
| 50 | +matrix: |
| 51 | + |
| 52 | +<table> |
| 53 | + <tr> |
| 54 | + <td colspan="2" rowspan="2"></td> |
| 55 | + <td colspan="4">Generated Code Version</td> |
| 56 | + </tr> |
| 57 | + <tr> |
| 58 | + <td class="gray">3.20.2</td> |
| 59 | + <td class="gray">3.20.3</td> |
| 60 | + <td class="gray">3.21.6</td> |
| 61 | + <td class="gray">3.21.7</td> |
| 62 | + </tr> |
| 63 | + <tr> |
| 64 | + <td rowspan="4">Runtime<br>Version</td> |
| 65 | + <td class="gray">3.20.2</td> |
| 66 | + <td class="yellow">Vuln</td> |
| 67 | + <td class="red"><b>Broken</b></td> |
| 68 | + <td class="yellow"><b>Vuln</b></td> |
| 69 | + <td class="red"><b>Broken</b></td> |
| 70 | + </tr> |
| 71 | + <tr> |
| 72 | + <td class="gray">3.20.3</td> |
| 73 | + <td class="yellow">Vuln</td> |
| 74 | + <td class="green">Works</td> |
| 75 | + <td class="yellow"><b>Vuln</b></td> |
| 76 | + <td class="green"><b>Works?</b></td> |
| 77 | + </tr> |
| 78 | + <tr> |
| 79 | + <td class="gray">3.21.6</td> |
| 80 | + <td class="yellow">Vuln</td> |
| 81 | + <td class="red">Broken</td> |
| 82 | + <td class="yellow">Vuln</td> |
| 83 | + <td class="red"><b>Broken</b></td> |
| 84 | + </tr> |
| 85 | + <tr> |
| 86 | + <td class="gray">3.21.7</td> |
| 87 | + <td class="yellow">Vuln</td> |
| 88 | + <td class="green">Works</td> |
| 89 | + <td class="yellow">Vuln</td> |
| 90 | + <td class="green">Works</td> |
| 91 | + </tr> |
| 92 | +</table> |
| 93 | + |
| 94 | +* “Vuln” indicates that the combination will successfully start, but the |
| 95 | + security vulnerability still exists. |
| 96 | +* “Works” indicates that the combination will successfully start and does not |
| 97 | + have the vulnerability. |
| 98 | +* “Broken” indicates that the combination will not successfully start. |
| 99 | +* **Bold** indicates configurations that were never deliberately intended to |
| 100 | + function together given the guarantees outlined in this topic. |
| 101 | + |
| 102 | +## No Coexistence of Multiple Major Runtime Versions {#coexist} |
| 103 | + |
| 104 | +Coexistence of multiple major versions in the same process is **not** supported. |
| 105 | + |
| 106 | +## C++ Specific Guarantees {#cpp} |
| 107 | + |
| 108 | +Protobuf C++ disclaims all cross-runtime support and requires an exact match |
| 109 | +between its generated code version and its runtime version at all times. |
| 110 | +Additionally, Protobuf C++ makes no guarantees about ABI stability across any |
| 111 | +releases (major, minor, or micro). |
0 commit comments