Nanopb 0.4.9.2 bugfix release

[Petteri Aimonen]

Hi,

Nanopb 0.4.9.2 has been released:

https://jpa.kapsi.fi/nanopb/download/

nanopb-0.4.9.2 (2026-08-24)
 Fix callback and oneof calling attacker-controlled ptr (GHSA-p24j-vqcp-x988)
 Fix callback for message inside oneof not getting called (#1061)
 Fix setting of package name in .options file (#1131)
 Add minimal support for protobuf editions (#900)
 Fix comment parsing in options string literals (#1175)
 Add PB_MESSAGE_NESTING_MAX option for limiting recursion depth (GHSA-9w99-4pfq-6396)
 Bazel, CMake and platformio build system improvements

This is a bugfix release, which contains fixes for two potential security issues:

https://github.com/nanopb/nanopb/security/advisories/GHSA-p24j-vqcp-x988

https://github.com/nanopb/nanopb/security/advisories/GHSA-9w99-4pfq-6396

SHA-256 sums:

98b8cadce538f37230ca0d5d8796894e3067d58dd2fb2618e6712c7362bdd8bb  nanopb-0.4.9.2.tar.gz

7e05f5908f0dff5d91cb90d11ca487876de8ec274695887959b3903e4b307887  nanopb-0.4.9.2-linux-x86.tar.gz
2b849dcb6b229794b718e42e56feaf6b614521db15c1aa35549ca5fffd8f5e53  nanopb-0.4.9.2-macosx-x86.tar.gz
dcefa16f9af346be13fd1a4d49a958b228d5a61e0ab060d7bfae60172dc7223b  nanopb-0.4.9.2-windows-x86.zip

--

Petteri