3405 Commits

Author SHA1 Message Date
Jakob Kordež
38df29380a [Dart] Fix namespace alias from union type (#9088)
* Fix namespace alias from union type

* Fix namespace alias from union type
2026-05-24 21:13:42 -04:00
Ali Sherif
1f438bd40f [Swift] Fix verifier accepting truncated scalar vectors (OOB read/write, RCE) (#9081) 2026-05-08 10:16:10 +02:00
mustiikhalil
392165432a [Swift] Migrate to use Swift Testing (#9076)
* Migrating from Xctests to swift testing

This migrates to the new Swift testing framework,
which would allow us to always use the latest tech
from swift moving forward.

* Updates flag to make sure that Wasm testing works
2026-05-07 21:49:41 -04:00
mustiikhalil
e6bbb3d22e [Swift] Migrate to swift 6.0 and Implements support gRPC v2 (#8983)
* Migrate to swift 6.0 & swift-gRPC 2.0

The following migrates to swift 6.0, and also
migrate to swift-grpc 2.0 that uses swift-nio
under the hood to provide nicer API and async await

Adds sendable to enum & update @_implementationOnly imports to use internal imports

* Address PR comments regarding misspelling & proper method naming.
2026-05-06 04:39:53 +02:00
Rifat Al Jubayer
a6979fe14a Fix logic inversion in FlexBuffers VerifyKey() (#9072)
VerifyKey() returns true on the first non-zero byte instead of
checking for a null terminator. This causes VerifyBuffer() to accept
FlexBuffers with non-null-terminated keys. Subsequent access to those
keys via strlen()/strcmp() reads out of bounds.

The condition if (*p++) should be if (!*p++) — return true
when a null terminator is found, not when any non-zero byte is found.

Confirmed with AddressSanitizer: heap-buffer-overflow in strlen()
after VerifyBuffer() returns true on a corrupted buffer.
2026-05-04 22:11:30 -04:00
Zen Dodd
bab10754d9 Stage the Python license file during builds (#9015)
Copy the repo-root LICENSE into the Python package directory for the duration of setup() so license_files = LICENSE remains valid without using deprecated parent-directory paths.

Remove the staged copy after the build completes.
2026-04-17 20:30:06 -04:00
Felix
ac7ef1176a Fix typo in generated header name (#9034) 2026-04-18 00:09:10 +00:00
Felix
d6444fb7fc Fix indention level for --no-python-gen-numpy (#9049) 2026-04-17 16:50:03 -04:00
Felix
e223d69b36 [Python] Extend GRPC Typing (#9007)
Extend function calls with optional type infos for checking
and discovering.

e838ba8a71/src/python/grpcio/grpc/__init__.py (L680)
2026-04-03 14:12:08 +00:00
Tulgaaaaaaaa
05cc7a2eff fix: correct operator precedence in ForAllFields reverse iteration (#8991)
* fix: correct operator precedence in ForAllFields reverse iteration

The expression `size() - i + 1` evaluates as `(size() - i) + 1` due to
left-to-right associativity, producing an out-of-bounds index when
reverse=true. For a vector of size N, the first iteration (i=0) accesses
index N+1, which is 2 past the last valid index.

Changed to `size() - (i + 1)` to match the correct implementation
already present in bfbs_gen.h:192.

Bug: CWE-125 (Out-of-bounds Read), CWE-783 (Operator Precedence Error)

* test: add ForAllFieldsReverseTest for reverse iteration correctness

Verify that ForAllFields with reverse=true iterates fields in
descending ID order. Tests both Stat (3 fields) and Monster
(many fields with non-sequential definition order) tables.

---------

Co-authored-by: Tulgaa <tulgaa.kek@gmail.com>
2026-04-02 10:14:27 +00:00
Noam ismach moshe
8a12183c3b Fix out-of-bounds vector access in StructDef::Deserialize (#8988)
* Fix out-of-bounds vector access in StructDef::Deserialize

* Fix syntax: use error_ instead of error()
2026-04-02 08:03:03 +00:00
Renzo
21b706b62d fix: swapped argument order in new_inconsistent_union calls (#9001) (#9010) 2026-04-02 07:05:58 +00:00
Tomasz Andrzejak
c5f151ab33 Add fallible try_* API for rust FlatBufferBuilder (#8918)
* Add fallible try_* API for FlatBufferBuilder

This is to support error propagation from Allocator trait. The Allocator
grow_downwards() method returns Result<(), Self::Error>, but
FlatBufferBuilder panics via .expect() when allocation fails instead of
propagating the error.

* Add rust fallible API docs
2026-04-02 06:49:51 +00:00
Björn Harrtell
3860f1cf7f [TS] Fixup TS test run at CI (#9004) 2026-03-30 13:32:24 +01:00
Thomas Köppe
4e582b0c1d [flexbuffers] Add "AlignedBlob", a version of "Blob" with explicit alignment. (#8993)
A blob is an array of bytes and has no intrinsic alignment (i.e. the
alignment is 1). The alignment of the existing flexbuffers blob is
solely affected by the width of the integer needed to store the blob's
size: that integer's width becomes the alignment of the blob.

The proposed AlignedBlob function here piggybacks on this effect and
simply uses a user-defined alignment for the width of the integer that
stores the blob's size; this automatically imparts that same alignment
on the blob itself. (The width is bounded below by the actual width
needed to store the blob's size.)

The ability to control the alignment of a blob is important for use
cases in which the blob itself stores structured data that we want to
access without further copies (e.g. other flatbuffer messages).
2026-03-23 10:28:03 -07:00
Fedor Osetrov
8396e00dd8 allow to use reflection in constant time evaluation (#8978)
* Update reflection.h

allow to use reflection in constant time evaluation

* make GetTypeSize constexpr

* fix clang-format
2026-03-20 02:01:45 +00:00
dependabot[bot]
48babd417d Bump flatted in the npm_and_yarn group across 1 directory (#8989)
Bumps the npm_and_yarn group with 1 update in the / directory: [flatted](https://github.com/WebReflection/flatted).


Updates `flatted` from 3.3.1 to 3.4.2
- [Commits](https://github.com/WebReflection/flatted/compare/v3.3.1...v3.4.2)

---
updated-dependencies:
- dependency-name: flatted
  dependency-version: 3.4.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-19 21:48:28 -04:00
tmimmanuel
22770f7e85 Fix inconsistent Python union creator function naming (#8981) 2026-03-19 12:36:37 +00:00
Dexter.k
21b033227e Add bounds check for root offset in AddFlatBuffer (#8982) 2026-03-19 08:22:26 -04:00
dataCenter430
93f587a6d3 fix: annotated output for size-prefixed binaries (#8976) 2026-03-18 22:54:46 -04:00
Kevin Zhao
8afb68f074 codegen: escape string default values to prevent code injection (#8964)
String default values parsed from .fbs schemas are un-escaped by the IDL
parser (e.g., \x22 becomes a raw " byte), but code generators embed these
raw values directly into generated source code string literals. This allows
specially crafted .fbs files to break out of string literals and inject
arbitrary code into generated C++, Rust, TypeScript, and Swift source.

Fix by adding EscapeCodeGenString() helper that re-escapes string content
before embedding, and applying it to all 7 affected injection points across
5 code generators (C++, Rust, TypeScript, Swift, FBS).

Resolves the TODO comments in idl_gen_cpp.cpp and idl_gen_rust.cpp.
2026-03-18 22:01:23 -04:00
Derek Bailey
2e07f269b9 Update build.yml
Remove 64-core windows github action runner as it is a charged product we need to do expense
2026-03-17 09:58:26 -07:00
Renzo
10c994155c Fix: allow flexbuffers alloc check test (#8972)
* Fix: allow flexbuffers alloc check test

* fix: flaky CI failure

* fix: set flexbuffers alloc check false
2026-03-12 09:44:32 -04:00
dataCenter430
fc9909c30a fix: infinite loop in proto reserved range parser (CWE-835) (#8966) 2026-03-11 22:23:32 -04:00
tmimmanuel
e35817577c Fix missing namespace qualifier in Pack() (#8967)
* Fix missing namespace qualifier in Pack() for cross-namespace table references

* Fix missing namespace qualifier in Pack()

* Add cross_namespace_pack_test to Bazel build
2026-03-11 22:11:06 -04:00
Moritz Walker
9e3fe5d3f6 rust: add secondary function with preallocated internal vecs (#8936)
* rust: add secondary function with preallocated internal vecs

* docs: document pre allocation feature for rust implementation
2026-03-11 15:26:23 +00:00
statxc
dc9217347e fix: add missing bracket (#8969) 2026-03-11 02:42:46 +00:00
statxc
a7fed2ce67 feat: add lookup_index_by_key to Rust Vector for index-based search (#8959)
* feat: add lookup_index_by_key to Rust Vector for index-based binary search

* fix: remove duplicated code
2026-03-11 02:15:21 +00:00
statxc
de3b97355d feat: use HashMap for create_shared_string to fix O(N²) performance (#8958)
* feat: use HashMap for create_shared_string to fix O(N²) performance

* refactor: clean up no_std binary_search_by with direct slice comparison
2026-03-10 21:56:34 -04:00
Renzo
8aa7084f01 Fix flaky flexbuffers_alloc_check test in cargo test (#8965) 2026-03-08 23:43:07 -04:00
Justin Davis
0f469cad54 Revert "fix using null string in vector (#7872)" (#8879)
This reverts commit 1cb1c4baee.
2026-03-07 13:19:34 +00:00
dependabot[bot]
72e51c61f7 Bump actions/upload-artifact from 6 to 7 (#8963)
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 6 to 7.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](https://github.com/actions/upload-artifact/compare/v6...v7)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-06 22:18:54 -05:00
Sutou Kouhei
31590a8a3b Enable Dependabot for GitHub Actions (#8778)
Our workflows use old GitHub Actions. For example, we use
`actions/checkout@v3` but `actions/checkout@v5` is the latest version:

599847236c/.github/workflows/build.yml (L33)

https://github.com/actions/checkout/releases

How about enabling Dependabot? If we enable Dependabot, Dependabot
opens PRs that update old GitHub Actions.

Dependabot document:
https://docs.github.com/en/code-security/dependabot

Dependabot configuration document:
https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference
2026-03-06 22:12:18 -05:00
Felix
24c2432d99 [Python]: Modernize setup and drop Python 2 (#8955) 2026-03-06 20:49:58 +00:00
Renzo
292870612c fix(flatbuffers): use manual impl Default for struct object types (#8947)
* fix(flatbuffers): use manual impl Default for struct object types

* fix: handle bool and float zero literals in struct object Default impl

* fix: regenerate all test bindings with generate_code.py

* fix: data type check on swift build

* fix: test large array on struct and enum
2026-03-06 11:20:32 -08:00
Cameron Mulhern
57659d9f38 Updates Rust codegen to use proper indentation (#8952)
* Fixes identation of generated Rust code

* Regenerates generated schemas
2026-03-05 14:04:55 +00:00
Udaya Prakash
2b8e4d3af0 build: Upgrade rules_swift to 3.1.2 and grpc to 1.76.0 (#8909) 2026-03-05 13:26:33 +00:00
Cameron Mulhern
08b6372a36 Generate better formatted Rust code (#8919)
* Cleans up Rust formatting

* Regenerates generated schemas
2026-03-05 02:49:46 +00:00
dependabot[bot]
9c383559e0 Bump minimatch in the npm_and_yarn group across 1 directory (#8951)
Bumps the npm_and_yarn group with 1 update in the / directory: [minimatch](https://github.com/isaacs/minimatch).


Updates `minimatch` from 3.1.2 to 3.1.5
- [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md)
- [Commits](https://github.com/isaacs/minimatch/compare/v3.1.2...v3.1.5)

---
updated-dependencies:
- dependency-name: minimatch
  dependency-version: 3.1.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-05 02:43:14 +00:00
Salman Chishti
c13c3bf956 Upgrade GitHub Actions for Node 24 compatibility (#8934)
Signed-off-by: Salman Muin Kayser Chishti <13schishti@gmail.com>
2026-03-04 21:36:59 -05:00
dependabot[bot]
47eeb8f4e9 Bump ajv in the npm_and_yarn group across 1 directory (#8933)
Bumps the npm_and_yarn group with 1 update in the / directory: [ajv](https://github.com/ajv-validator/ajv).


Updates `ajv` from 6.12.6 to 6.14.0
- [Release notes](https://github.com/ajv-validator/ajv/releases)
- [Commits](https://github.com/ajv-validator/ajv/compare/v6.12.6...v6.14.0)

---
updated-dependencies:
- dependency-name: ajv
  dependency-version: 6.14.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-05 02:28:53 +00:00
Uwe (ObjectBox)
e7c6874192 [Dart] Actually use resized FlexBuffers buffer (#8935)
When building a FlexBuffer using the Builder and adding data that exceeds the default buffer size (2048 bytes), in _newOffset() a larger buffer is created, but never used. This results in a RangeError.

Resolve by actually replacing the too small with the new larger buffer. Add a test that verifies this by adding multiple large strings to a vector.
2026-03-05 02:15:45 +00:00
RCRalph
8d2c333b36 fix: Added return value to non type-prefixed create vector function (#8945)
* fix: Added return value to non type-prefixed create vector function

* chore: Added generated code
2026-03-05 02:09:09 +00:00
Damian Sypniewski
abc9bfebff Update Go support for Optional Scalars (#8946) 2026-03-04 21:03:49 -05:00
Abhay Agarwal
94d6b8086b Ensure optional arrays, arrays with defaults, and strings with defaults are supported (#8896)
Fixing issues with generated ts/js
2026-02-23 08:55:37 +01:00
dependabot[bot]
fa709636b4 Bump lodash (#8913)
Bumps the npm_and_yarn group with 1 update in the /tests/ts/bazel_repository_test_dir directory: [lodash](https://github.com/lodash/lodash).


Updates `lodash` from 4.17.21 to 4.17.23
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](https://github.com/lodash/lodash/compare/4.17.21...4.17.23)

---
updated-dependencies:
- dependency-name: lodash
  dependency-version: 4.17.23
  dependency-type: direct:development
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-02-19 01:09:46 +00:00
Stevan Coroller
60463e25a8 Remove empty 'required' section from schema.md (#8900)
There is a typo in the schema.md file in documentation. An empty 'required' section was added right before the 'required' item in the middle of the attributes list. It even appears in the table of content, which might confuse readers, making it look like following attributes might be required while they are not. You can notice the issue there: https://flatbuffers.dev/schema/#attributes.

I did check that `mkdocs serve -f mkdocs.yml` does produce the expected output (the same attributes list without that extra empty `required` section in the middle) with my changes.
2026-02-18 20:03:01 -05:00
Austin Chick
b8e3d215b8 [TS] Fix relative import paths of generated TypeScript code (#8880)
* Refactor logic that generates import paths in AddImport

* Add new tests to validate relative import path fix

* Generate goldens

* Generate example code

* Format TS generator file

* Revert "Format TS generator file"

This reverts commit 0f0b24aee9.

* Fix merge conflicts

---------

Co-authored-by: Björn Harrtell <bjornharrtell@users.noreply.github.com>
2026-02-17 10:22:32 +01:00
mustiikhalil
d71c0ab4ac Moves the internal stack to use a pointer stack instead of the native array for improved performance (#8891)
Remove custom flags for native arrays when using flexbuffers on Wasm

Co-authored-by: Wouter van Oortmerssen <aardappel@gmail.com>
2026-02-12 19:42:21 +01:00
mustiikhalil
fcf75449b8 [Swift] Moves VTs from enums to structs to prevent empty enum generation
Moves VTs from enums to structs to prevent empty enum generation, which would usually cause a compilation error.
2026-02-12 08:04:26 -10:00