You closed my other issue without allowing me to even respond and I believe this needs to be resolved and not ignored. There is the potential for a massive source of confusion because of the existence of both libraries and IMO one or the other needs to be removed/retired as we are duplicating work that is not necessary and confusing the entire user base.
protoc-gen-js (https://github.com/yinzara/protoc-gen-js) has existed for more than 4 years and has more than 40k weekly downloads across all supported versions. I recently updated the entire codebase to resolve all existing issues and pull requests, released versions 4.0.0/4.0.1/4.0.2, introduced a massive testing suite verifying all functionality against NodeJS 18 to 26 with support for every platform/architecture protobuf-javascript supports, resolved all potential security vulnerability warnings, added support for HTTP proxies for all NodeJS versions, distributed the library with complete documentation to its use in all supported NodeJS versions and package managers, enabled provenance tracking, added automatic dependency management with RenovateBot (and even Gemini Agent management of the testing harness), and published to NpmJS using OIDC (a requirement that will be enforced by NpmJS later this year). Because of the naming of the package it can be executed as npx protoc-gen-js as the library name matches the name of the executable exposed by the library.
@protocolbuffers/protoc-gen-js was created 7 months ago because protoc-gen-js did not release a new version when 4.0.0/4.0.1/4.0.2 of protobuf-javascript was released. While I absolutely agree this was an oversight (my RenovateBot stopped running automatically), instead of filing a ticket with the library issue tracker, the maintainers of protobuf-javascript decided to make an entirely independent version of the library, duplicating some of the functionality. Since the release it has around 1000 weekly downloads across all released versions. It has no testing (which is why the missing 4.0.1 Win64 binary release was missed), limited documentation, an open security vulnerability (GHSA-vwc7-r8mq-g2x9) which cannot be fixed without swapping out the 'adm-zip' library completely, no automatic dependency management, no HTTP proxy support, no provenance, and does not publish to NpmJS with OIDC. It cannot be executed with npx without specifying the full package name (i.e. npx --package @protocolbuffers/protoc-gen-js -- protoc-gen-js).
The maintainers of this library state in the README.md:
We currently do not have staffing for more than minimal support for this open source project. We will answer questions and triage any issues.
This would imply to me that they should do everything possible to minimize the support necessary for the future of the library.
So I offer two options of which I will actually do the PR work for either:
- Update the documentation of protobuf-javascript to reference the
protoc-gen-js library at https://github.com/yinzara/protoc-gen-js and direct all requests for fixes/functionality to my issue tracker. I will commit to maintaining the library, responding to those issues, and releasing new versions to match released versions of protobuf-javascript within 24 hours of their release. I will even triage issues that are wrongly filed with my library (though it's never happened). This would mean the deprecation of the @protocolbuffers/protoc-gen-js NpmJS library. As protoc-gen-js already has released versions mirroring all released versions of @protocolbuffers/protoc-gen-js, the README could be updated to mention the deprecation and move to the other library. This would mean the maintainers of this library would no longer have to devote resources to support of that published library. When NPMJS disables the ability to publish new versions without OIDC/provenance they will not have to do additional work.
- Merge the codebase of
protoc-gen-js to the https://github.com/protocolbuffers/protobuf-javascript repository including HTTP proxy support, vulnerability fixes, and documentation. I would be happy to move the Github actions as well to add the testing suite but I know that libraries managed internally by Google use Bazel and I'm unsure if you would even want the Github actions. I would transfer ownership of the protoc-gen-js library on NpmJS to the Google support team, deprecate my entire repository, and update my documentation to point to the Google repository. Unfortunately I can't fix the "provenance" and "OIDC" publishing requirement of NpmJS (I have no idea how you will fix that with Bazel either) nor can I add automatic dependency management unless you want to support RenovateBot as well so you'll need to "fix" those before your nnext release more than likely. Your team would then be responsible for all future releases, features, vulnerabilities and bug fixes. We could then update the documentation of both repositories to reference protoc-gen-js NpmJS library and deprecate the @protocolbuffers/protoc-gen-js library.
I'm happy to do either so just tell me which you prefer and I'll begin the work.
You closed my other issue without allowing me to even respond and I believe this needs to be resolved and not ignored. There is the potential for a massive source of confusion because of the existence of both libraries and IMO one or the other needs to be removed/retired as we are duplicating work that is not necessary and confusing the entire user base.
protoc-gen-js(https://github.com/yinzara/protoc-gen-js) has existed for more than 4 years and has more than 40k weekly downloads across all supported versions. I recently updated the entire codebase to resolve all existing issues and pull requests, released versions 4.0.0/4.0.1/4.0.2, introduced a massive testing suite verifying all functionality against NodeJS 18 to 26 with support for every platform/architecture protobuf-javascript supports, resolved all potential security vulnerability warnings, added support for HTTP proxies for all NodeJS versions, distributed the library with complete documentation to its use in all supported NodeJS versions and package managers, enabled provenance tracking, added automatic dependency management with RenovateBot (and even Gemini Agent management of the testing harness), and published to NpmJS using OIDC (a requirement that will be enforced by NpmJS later this year). Because of the naming of the package it can be executed asnpx protoc-gen-jsas the library name matches the name of the executable exposed by the library.@protocolbuffers/protoc-gen-jswas created 7 months ago becauseprotoc-gen-jsdid not release a new version when 4.0.0/4.0.1/4.0.2 of protobuf-javascript was released. While I absolutely agree this was an oversight (my RenovateBot stopped running automatically), instead of filing a ticket with the library issue tracker, the maintainers ofprotobuf-javascriptdecided to make an entirely independent version of the library, duplicating some of the functionality. Since the release it has around 1000 weekly downloads across all released versions. It has no testing (which is why the missing 4.0.1 Win64 binary release was missed), limited documentation, an open security vulnerability (GHSA-vwc7-r8mq-g2x9) which cannot be fixed without swapping out the 'adm-zip' library completely, no automatic dependency management, no HTTP proxy support, no provenance, and does not publish to NpmJS with OIDC. It cannot be executed withnpxwithout specifying the full package name (i.e.npx --package @protocolbuffers/protoc-gen-js -- protoc-gen-js).The maintainers of this library state in the README.md:
We currently do not have staffing for more than minimal support for this open source project. We will answer questions and triage any issues.
This would imply to me that they should do everything possible to minimize the support necessary for the future of the library.
So I offer two options of which I will actually do the PR work for either:
protoc-gen-jslibrary at https://github.com/yinzara/protoc-gen-js and direct all requests for fixes/functionality to my issue tracker. I will commit to maintaining the library, responding to those issues, and releasing new versions to match released versions of protobuf-javascript within 24 hours of their release. I will even triage issues that are wrongly filed with my library (though it's never happened). This would mean the deprecation of the @protocolbuffers/protoc-gen-js NpmJS library. Asprotoc-gen-jsalready has released versions mirroring all released versions of @protocolbuffers/protoc-gen-js, the README could be updated to mention the deprecation and move to the other library. This would mean the maintainers of this library would no longer have to devote resources to support of that published library. When NPMJS disables the ability to publish new versions without OIDC/provenance they will not have to do additional work.protoc-gen-jsto the https://github.com/protocolbuffers/protobuf-javascript repository including HTTP proxy support, vulnerability fixes, and documentation. I would be happy to move the Github actions as well to add the testing suite but I know that libraries managed internally by Google use Bazel and I'm unsure if you would even want the Github actions. I would transfer ownership of theprotoc-gen-jslibrary on NpmJS to the Google support team, deprecate my entire repository, and update my documentation to point to the Google repository. Unfortunately I can't fix the "provenance" and "OIDC" publishing requirement of NpmJS (I have no idea how you will fix that with Bazel either) nor can I add automatic dependency management unless you want to support RenovateBot as well so you'll need to "fix" those before your nnext release more than likely. Your team would then be responsible for all future releases, features, vulnerabilities and bug fixes. We could then update the documentation of both repositories to referenceprotoc-gen-jsNpmJS library and deprecate the @protocolbuffers/protoc-gen-js library.I'm happy to do either so just tell me which you prefer and I'll begin the work.