npm / pbf
pbf
What changed in pbf 4 to 5, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-17.
3 breaking2 security1 new APIs and options4 performance3 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli initpbf 512 changes
Breaking changes 3
The Pbf class is split into PbfReader and PbfWriter classes, allowing bundlers to tree-shake the half you don't use.
The Pbf class is split into PbfReader and PbfWriter classes, allowing bundlers to tree-shake the half you don't use.
The legacy readVarint64 method is removed; use readVarint(true) for signed 64-bit reads.
Security 1
Fixes a minor compiler vulnerability that could allow code injection via an unsafe schema.
New APIs and options 1
Added PbfReader.nextField(end) for more compact, readable, and bulletproof decoding while preserving performance.
Performance 4
A fast path improves performance by 20% on the vector tiles encoding benchmark.
A single-byte fast path improves performance for the common case, including tags and small integers.
Uses typedArray.set instead of a manual copy loop.
A single-byte fast path improves performance for the common case, including tags and small integers.
Fixes and other changes 3
Now honors a non-zero byteOffset of the backing buffer.
Now honors a non-zero byteOffset of the backing buffer.
Fixes a bug in compiled packed sfixed64 fields.
pbf 41 changes
Security 1
Field names are sanitized to protect against injection via malicious proto schemas.