chore(deps): bump pbf from 4.0.2 to 5.1.2 by dependabot[bot] · Pull Request #4091 · Yeraze/meshmonitor

dependabot · 2026-07-13T04:18:44Z

Bumps pbf from 4.0.2 to 5.1.2.

Release notes

v5.1.2

Fix a minor vulnerability in the compiler (potential code injection via unsafe schema) #149

v5.1.1

Add a fast path for writePackedVarint (20% speedup on the vector tiles encoding benchmark) (h/t @dcodeIO)

Fix PbfReader and PbfWriter to honor non-zero byteOffset of the backing buffer (h/t @mattico #147)

v5.1.0

Added a new PbfReader nextField(end) method that allows writing more compact, readable and bulletproof decoding code while preserving performance. #144

Updated pbf/compile to take advantage of nextField.

v5.0.0

Breaking changes

The Pbf class is split into separate PbfReader and PbfWriter classes, so bundlers can tree-shake the half you don't use.

Removed the legacy readVarint64 method — use readVarint(true) for signed 64-bit reads.

Performance

On the Mapbox vector-tile benchmark (439 tiles, 37.5 MB), v5 is ~25% faster to decode and ~27% faster to encode than v4. Highlights:

Generated reader code was rewritten from a callback-based style into inlined while loops with direct field-number dispatch, letting V8 fully inline each reader (biggest decode win).

writeVarint / readVarint got single-byte fast paths for the common case (tags, small ints).

Buffer growth in makeRoomForExtraLength now uses Uint8Array.copyWithin instead of a manual byte-shift loop (biggest encode win).

writeBytes uses typedArray.set instead of a manual copy loop.

Other improvements

The schema compiler (compile.js) was significantly simplified — generated code is cleaner and easier to read.

Fixed a bug in compiled packed sfixed64 fields.

Commits

4424eec 5.1.2
7b1f6ce fix for potential code injection via compile with unsafe schema (#149)
88580bc 5.1.1
3531450 update CI permissions
5a6165b release on NPM via GHA Trusted Publishing
d3e5c1d fast path for encoding packed varints (18% faster)
9565c01 update bench numbers
e82dfbd update perf numbers (protobuf.js now ahead!)
ce5dc51 upgrade dev deps
0ff9187 Update protobuf.js version (#148)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for pbf since your current version.

dependabot · 2026-07-13T04:18:44Z

Labels

The following labels could not be found: npm. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

github-actions · 2026-07-13T06:10:15Z