# What changed in pbf

> 13 changes in pbf 4 to 5 from its official release notes, upgrade guides and advisories: 3 breaking, 2 security, 1 new APIs and options. Each one cited. Sources checked 2026-10-17. HTML: https://unstale.sh/npm/pbf/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## pbf 5

### Breaking changes

- The Pbf class is split into PbfReader and PbfWriter classes, allowing bundlers to tree-shake the half you don't use. (5.0.0) — [release notes](https://github.com/mapbox/pbf/releases/tag/v5.0.0)
- The Pbf class is split into PbfReader and PbfWriter classes, allowing bundlers to tree-shake the half you don't use. (5.0.0) — [release notes](https://github.com/mapbox/pbf/releases/tag/v5.0.0)
- The legacy readVarint64 method is removed; use readVarint(true) for signed 64-bit reads. (5.0.0) — [release notes](https://github.com/mapbox/pbf/releases/tag/v5.0.0)

### Security

- Fixes a minor compiler vulnerability that could allow code injection via an unsafe schema. (5.1.2) — [release notes](https://github.com/mapbox/pbf/releases/tag/v5.1.2)

### New APIs and options

- Added PbfReader.nextField(end) for more compact, readable, and bulletproof decoding while preserving performance. (5.1.0) — [release notes](https://github.com/mapbox/pbf/releases/tag/v5.1.0)

### Performance

- A fast path improves performance by 20% on the vector tiles encoding benchmark. (5.1.1) — [release notes](https://github.com/mapbox/pbf/releases/tag/v5.1.1)
- A single-byte fast path improves performance for the common case, including tags and small integers. (5.0.0) — [release notes](https://github.com/mapbox/pbf/releases/tag/v5.0.0)
- Uses typedArray.set instead of a manual copy loop. (5.0.0) — [release notes](https://github.com/mapbox/pbf/releases/tag/v5.0.0)
- A single-byte fast path improves performance for the common case, including tags and small integers. (5.0.0) — [release notes](https://github.com/mapbox/pbf/releases/tag/v5.0.0)

### Fixes and other changes

- Now honors a non-zero byteOffset of the backing buffer. (5.1.1) — [release notes](https://github.com/mapbox/pbf/releases/tag/v5.1.1)
- Now honors a non-zero byteOffset of the backing buffer. (5.1.1) — [release notes](https://github.com/mapbox/pbf/releases/tag/v5.1.1)
- Fixes a bug in compiled packed sfixed64 fields. (5.0.0) — [release notes](https://github.com/mapbox/pbf/releases/tag/v5.0.0)

## pbf 4

### Security

- Field names are sanitized to protect against injection via malicious proto schemas. (4.0.2) — [release notes](https://github.com/mapbox/pbf/releases/tag/v4.0.2)