Protocol Buffers 25.9

Apply these rules to protoc 25.9, proto2/proto3 contracts, and Java 3.25.9 full or Lite runtimes in existing Java deployments. The 25.x compiler remains maintained for Java; verify support for other language runtimes separately rather than applying Java's support window to them.

Version scope and build inputs

• Keep protoc and the applicable protobuf-java, protobuf-java-util, or protobuf-javalite artifacts on the matching release of the 25.x line, which the Java artifacts number 3.25.x, and move them together; inspect resolved transitive dependencies and deployed JARs for older copies.
• Take protoc from the protobuf GitHub releases page, checking the SHA-256 digest listed for the asset, or from the com.google.protobuf:protoc Maven artifact. Align the Java artifacts with com.google.protobuf:protobuf-bom, record the resolved versions with Gradle dependency locking where you build with Gradle, and let an update bot keep both current. Protobuf ships Java 3.x fixes only as new 25.x patch releases during its maintenance window, so run the newest one. When you can't check a version, leave a placeholder that fails the build rather than one you remember; the 25.9 in this prompt's title names the release these rules were checked against, not a build to install.
• Use a security-maintained JDK within the published Java support policy, which currently covers Java 8, 11, 17, 21, and 25; an old source/bytecode target in the release build is not a JDK support guarantee.
• Declare syntax = "proto2" or syntax = "proto3"; do not rely on experimental Editions