Migrate from protoc-gen-validate to protovalidate v1.0.0

api/bazel/api_build_system.bzl

@@ -1,4 +1,4 @@
-load("@com_envoyproxy_protoc_gen_validate//bazel:pgv_proto_library.bzl", "pgv_cc_proto_library")
+load("@com_google_protobuf//bazel:cc_proto_library.bzl", "cc_proto_library")
 load("@com_github_grpc_grpc//bazel:cc_grpc_library.bzl", "cc_grpc_library")
 load("@com_github_grpc_grpc//bazel:python_rules.bzl", _py_proto_library = "py_proto_library")
 load("@com_google_protobuf//bazel:proto_library.bzl", "proto_library")
@@ -36,7 +36,7 @@ _COMMON_PROTO_DEPS = [
     "@com_google_googleapis//google/api:httpbody_proto",
     "@com_google_googleapis//google/api:annotations_proto",
     "@com_google_googleapis//google/rpc:status_proto",
-    "@com_envoyproxy_protoc_gen_validate//validate:validate_proto",
+    "@com_github_bufbuild_protovalidate//proto/protovalidate/buf/validate:validate_proto",
 ]
 
 def _proto_mapping(dep, proto_dep_map, proto_suffix):
@@ -67,7 +67,6 @@ def api_cc_py_proto_library(
         visibility = ["//visibility:private"],
         srcs = [],
         deps = [],
-        linkstatic = 0,
         has_services = 0,
         java = True):
     relative_name = ":" + name
@@ -89,15 +88,8 @@ def api_cc_py_proto_library(
     )
 
     cc_proto_library_name = name + _CC_PROTO_SUFFIX
-    pgv_cc_proto_library(
+    cc_proto_library(
         name = cc_proto_library_name,
-        linkstatic = linkstatic,
-        cc_deps = [_cc_proto_mapping(dep) for dep in deps] + [
-            "@com_google_googleapis//google/api:http_cc_proto",
-            "@com_google_googleapis//google/api:httpbody_cc_proto",
-            "@com_google_googleapis//google/api:annotations_cc_proto",
-            "@com_google_googleapis//google/rpc:status_cc_proto",
-        ],
         deps = [relative_name],
         visibility = ["//visibility:public"],
     )
@@ -155,14 +147,14 @@ def api_proto_package(
         has_services = has_services,
     )
 
-    compilers = ["@io_bazel_rules_go//proto:go_proto", "@com_envoyproxy_protoc_gen_validate//bazel/go:pgv_plugin_go", "@envoy_api//bazel:vtprotobuf_plugin_go"]
+    compilers = ["@io_bazel_rules_go//proto:go_proto", "@envoy_api//bazel:vtprotobuf_plugin_go"]
     if has_services:
-        compilers = ["@io_bazel_rules_go//proto:go_proto", "@io_bazel_rules_go//proto:go_grpc_v2", "@com_envoyproxy_protoc_gen_validate//bazel/go:pgv_plugin_go", "@envoy_api//bazel:vtprotobuf_plugin_go"]
+        compilers = ["@io_bazel_rules_go//proto:go_proto", "@io_bazel_rules_go//proto:go_grpc_v2", "@envoy_api//bazel:vtprotobuf_plugin_go"]
 
     deps = (
         [_go_proto_mapping(dep) for dep in deps] +
         [
-            "@com_envoyproxy_protoc_gen_validate//validate:go_default_library",
+            "@build_buf_gen_go_bufbuild_protovalidate_protocolbuffers_go//buf/validate",
             "@org_golang_google_genproto_googleapis_api//annotations:annotations",
             "@org_golang_google_genproto_googleapis_rpc//status:status",
             "@org_golang_google_protobuf//types/known/anypb:go_default_library",

api/bazel/external_proto_deps.bzl

@@ -13,6 +13,7 @@ EXTERNAL_PROTO_IMPORT_BAZEL_DEP_MAP = {
     "google/api/expr/v1alpha1/syntax.proto": "@com_google_googleapis//google/api/expr/v1alpha1:syntax_proto",
     "io/prometheus/client/metrics.proto": "@prometheus_metrics_model//:client_model",
     "opentelemetry/proto/common/v1/common.proto": "@opentelemetry_proto//:common_proto",
+    "buf/validate/validate.proto": "@com_github_bufbuild_protovalidate//proto/protovalidate/buf/validate:validate_proto",
 }
 
 # This maps from the Bazel proto_library target to the Go language binding target for external dependencies.
@@ -35,6 +36,7 @@ EXTERNAL_PROTO_GO_BAZEL_DEP_MAP = {
     "@opentelemetry_proto//:metrics_proto": "@opentelemetry_proto//:metrics_proto_go",
     "@opentelemetry_proto//:metrics_service_proto": "@opentelemetry_proto//:metrics_service_grpc_go",
     "@opentelemetry_proto//:common_proto": "@opentelemetry_proto//:common_proto_go",
+    "@com_github_bufbuild_protovalidate//proto/protovalidate/buf/validate:validate_proto": "@build_buf_gen_go_bufbuild_protovalidate_protocolbuffers_go//buf/validate",
 }
 
 # This maps from the Bazel proto_library target to the C++ language binding target for external dependencies.
@@ -48,4 +50,5 @@ EXTERNAL_PROTO_CC_BAZEL_DEP_MAP = {
     "@opentelemetry_proto//:metrics_proto": "@opentelemetry_proto//:metrics_proto_cc",
     "@opentelemetry_proto//:metrics_service_proto": "@opentelemetry_proto//:metrics_service_grpc_cc",
     "@opentelemetry_proto//:common_proto": "@opentelemetry_proto//:common_proto_cc",
+    "@com_github_bufbuild_protovalidate//proto/protovalidate/buf/validate:validate_proto": "@com_github_bufbuild_protovalidate//proto/protovalidate/buf/validate:validate_proto_cc",
 }

api/bazel/repositories.bzl

@@ -20,9 +20,12 @@ def api_dependencies():
         name = "rules_jvm_external",
     )
     external_http_archive(
-        name = "com_envoyproxy_protoc_gen_validate",
+        name = "com_github_bufbuild_protovalidate",
+    )
+    external_http_archive(
+        name = "com_github_bufbuild_protovalidate_cc",
         patch_args = ["-p1"],
-        patches = ["@envoy_api//bazel:pgv.patch"],
+        patches = ["@envoy//bazel:protovalidate_cc.patch"],
     )
     external_http_archive(
         name = "com_google_googleapis",

api/bazel/repository_locations.bzl

@@ -12,27 +12,31 @@ REPOSITORY_LOCATIONS_SPEC = dict(
         license = "Apache-2.0",
         license_url = "https://github.com/bazelbuild/bazel-skylib/blob/{version}/LICENSE",
     ),
-    com_envoyproxy_protoc_gen_validate = dict(
-        project_name = "protoc-gen-validate (PGV)",
-        project_desc = "protoc plugin to generate polyglot message validators",
-        project_url = "https://github.com/bufbuild/protoc-gen-validate",
+    com_github_bufbuild_protovalidate = dict(
+        project_name = "protovalidate",
+        project_desc = "Protocol Buffer Validation",
+        project_url = "https://github.com/bufbuild/protovalidate",
         use_category = ["api"],
-        sha256 = "9372f9ecde8fbadf83c8c7de3dbb49b11067aa26fb608c501106d0b4bf06c28f",
-        version = "1.0.4",
-        urls = ["https://github.com/bufbuild/protoc-gen-validate/archive/refs/tags/v{version}.zip"],
-        strip_prefix = "protoc-gen-validate-{version}",
-        release_date = "2024-01-17",
-        implied_untracked_deps = [
-            "com_github_iancoleman_strcase",
-            "com_github_lyft_protoc_gen_star_v2",
-            "com_github_spf13_afero",
-            "org_golang_google_genproto",
-            "org_golang_x_text",
-            "org_golang_x_mod",
-            "org_golang_x_sys",
-        ],
+        sha256 = "28d37f49b4d26c8eac0d31af61db570c8e998b87289f69ceb792682fa7a1c1bd",
+        version = "1.0.0",
+        urls = ["https://github.com/bufbuild/protovalidate/archive/refs/tags/v{version}.zip"],
+        strip_prefix = "protovalidate-{version}",
+        release_date = "2024-12-06",
+        license = "Apache-2.0",
+        license_url = "https://github.com/bufbuild/protovalidate/blob/v{version}/LICENSE",
+    ),
+    com_github_bufbuild_protovalidate_cc = dict(
+        project_name = "protovalidate-cc",
+        project_desc = "C++ Protocol Buffer Validation Library",
+        project_url = "https://github.com/bufbuild/protovalidate-cc",
+        use_category = ["api"],
+        sha256 = "4270d3babf1d883fd89139d80d002ad0b2dd1f16656c905514ee2d41cf9a2cb8",
+        version = "1.0.0",
+        urls = ["https://github.com/bufbuild/protovalidate-cc/archive/refs/tags/v{version}.tar.gz"],
+        strip_prefix = "protovalidate-cc-{version}",
+        release_date = "2025-09-18",
         license = "Apache-2.0",
-        license_url = "https://github.com/bufbuild/protoc-gen-validate/blob/v{version}/LICENSE",
+        license_url = "https://github.com/bufbuild/protovalidate-cc/blob/v{version}/LICENSE",
     ),
     rules_jvm_external = dict(
         project_name = "Java Rules for Bazel",
@@ -50,16 +54,16 @@ REPOSITORY_LOCATIONS_SPEC = dict(
     com_github_cncf_xds = dict(
         project_name = "xDS API",
         project_desc = "xDS API Working Group (xDS-WG)",
-        project_url = "https://github.com/cncf/xds",
+        project_url = "https://github.com/mmorel-35/xds",
         # During the UDPA -> xDS migration, we aren't working with releases.
-        version = "2ac532fd44436293585084f8d94c6bdb17835af0",
-        sha256 = "790c4c83b6950bb602fec221f6a529d9f368cdc8852aae7d2592d0d04b015f37",
-        release_date = "2025-05-01",
+        version = "dc55ea33097c5b576d6f39d9b13a9419813a9e76",
+        sha256 = "154c2473d7ad7c17a679f68e9bc268874b729181b08557e64a9ae190ee48c23a",
+        release_date = "2025-10-18",
         strip_prefix = "xds-{version}",
-        urls = ["https://github.com/cncf/xds/archive/{version}.tar.gz"],
+        urls = ["https://github.com/mmorel-35/xds/archive/{version}.tar.gz"],
         use_category = ["api"],
         license = "Apache-2.0",
-        license_url = "https://github.com/cncf/xds/blob/{version}/LICENSE",
+        license_url = "https://github.com/mmorel-35/xds/blob/{version}/LICENSE",
     ),
     com_github_openzipkin_zipkinapi = dict(
         project_name = "Zipkin API",

api/buf.lock

@@ -1,14 +1,14 @@
 # Generated by buf. DO NOT EDIT.
 version: v1
 deps:
+  - remote: buf.build
+    owner: bufbuild
+    repository: protovalidate
+    commit: 52f32327d4b04c9d843195a7d72f135e
   - remote: buf.build
     owner: cncf
     repository: xds
     commit: c313df85559e44248d0115969f2c8c24
-  - remote: buf.build
-    owner: envoyproxy
-    repository: protoc-gen-validate
-    commit: 6607b10f00ed4a3d98f906807131c44a
   - remote: buf.build
     owner: gogo
     repository: protobuf

api/buf.yaml

@@ -5,7 +5,7 @@ deps:
 - buf.build/opentelemetry/opentelemetry
 - buf.build/gogo/protobuf
 - buf.build/cncf/xds
-- buf.build/envoyproxy/protoc-gen-validate
+- buf.build/bufbuild/protovalidate
 breaking:
   ignore_unstable_packages: true
   use:

api/contrib/envoy/extensions/compression/qatzip/compressor/v3alpha/qatzip.proto

@@ -5,7 +5,7 @@ package envoy.extensions.compression.qatzip.compressor.v3alpha;
 import "google/protobuf/wrappers.proto";
 
 import "udpa/annotations/status.proto";
-import "validate/validate.proto";
+import "buf/validate/validate.proto";
 
 option java_package = "io.envoyproxy.envoy.extensions.compression.qatzip.compressor.v3alpha";
 option java_outer_classname = "QatzipProto";
@@ -31,22 +31,22 @@ message Qatzip {
 
   // Value from 1 to 9 that controls the main compression speed-density lever.
   // The higher quality, the slower compression. The default value is 1.
-  google.protobuf.UInt32Value compression_level = 1 [(validate.rules).uint32 = {lte: 9 gte: 1}];
+  google.protobuf.UInt32Value compression_level = 1 [(buf.validate.field).uint32 = {lte: 9 gte: 1}];
 
   // A size of qat hardware buffer. This field will be set to "DEFAULT" if not specified.
-  HardwareBufferSize hardware_buffer_size = 2 [(validate.rules).enum = {defined_only: true}];
+  HardwareBufferSize hardware_buffer_size = 2 [(buf.validate.field).enum = {defined_only: true}];
 
   // Threshold of compression service’s input size for software failover.
   // If the size of input request less than the threshold, qatzip will route the request to software
   // compressor. The default value is 1024. The maximum value is 512*1024.
   google.protobuf.UInt32Value input_size_threshold = 3
-      [(validate.rules).uint32 = {lte: 524288 gte: 128}];
+      [(buf.validate.field).uint32 = {lte: 524288 gte: 128}];
 
   // A size of stream buffer. The default value is 128 * 1024. The maximum value is 2*1024*1024 -
   // 5*1024
   google.protobuf.UInt32Value stream_buffer_size = 4
-      [(validate.rules).uint32 = {lte: 2092032 gte: 1024}];
+      [(buf.validate.field).uint32 = {lte: 2092032 gte: 1024}];
 
   // Value for compressor's next output buffer. If not set, defaults to 4096.
-  google.protobuf.UInt32Value chunk_size = 5 [(validate.rules).uint32 = {lte: 65536 gte: 4096}];
+  google.protobuf.UInt32Value chunk_size = 5 [(buf.validate.field).uint32 = {lte: 65536 gte: 4096}];
 }

api/contrib/envoy/extensions/compression/qatzstd/compressor/v3alpha/qatzstd.proto

@@ -5,7 +5,7 @@ package envoy.extensions.compression.qatzstd.compressor.v3alpha;
 import "google/protobuf/wrappers.proto";
 
 import "udpa/annotations/status.proto";
-import "validate/validate.proto";
+import "buf/validate/validate.proto";
 
 option java_package = "io.envoyproxy.envoy.extensions.compression.qatzstd.compressor.v3alpha";
 option java_outer_classname = "QatzstdProto";
@@ -42,7 +42,7 @@ message Qatzstd {
   // to default. Setting this will however eventually dynamically impact the compression
   // parameters which have not been manually set. The manually set
   // ones will 'stick'.
-  google.protobuf.UInt32Value compression_level = 1 [(validate.rules).uint32 = {lte: 22 gte: 1}];
+  google.protobuf.UInt32Value compression_level = 1 [(buf.validate.field).uint32 = {lte: 22 gte: 1}];
 
   // A 32-bits checksum of content is written at end of frame. If not set, defaults to false.
   bool enable_checksum = 2;
@@ -51,10 +51,10 @@ message Qatzstd {
   // resulting in stronger and slower compression.
   //
   // Special: value 0 means "use default strategy".
-  Strategy strategy = 3 [(validate.rules).enum = {defined_only: true}];
+  Strategy strategy = 3 [(buf.validate.field).enum = {defined_only: true}];
 
   // Value for compressor's next output buffer. If not set, defaults to 4096.
-  google.protobuf.UInt32Value chunk_size = 5 [(validate.rules).uint32 = {lte: 65536 gte: 4096}];
+  google.protobuf.UInt32Value chunk_size = 5 [(buf.validate.field).uint32 = {lte: 65536 gte: 4096}];
 
   // Enable QAT to accelerate Zstd compression or not. If not set, defaults to false.
   //
@@ -65,5 +65,5 @@ message Qatzstd {
   // Fallback to software for Qatzstd when input size is less than this value.
   // Valid only ``enable_qat_zstd`` is ``true``. 0 means no fallback at all. If not set, defaults to 4000.
   google.protobuf.UInt32Value qat_zstd_fallback_threshold = 7
-      [(validate.rules).uint32 = {lte: 65536 gte: 0}];
+      [(buf.validate.field).uint32 = {lte: 65536 gte: 0}];
 }

api/contrib/envoy/extensions/filters/http/checksum/v3alpha/checksum.proto

@@ -7,7 +7,7 @@ import "envoy/type/matcher/v3/string.proto";
 import "xds/annotations/v3/status.proto";
 
 import "udpa/annotations/status.proto";
-import "validate/validate.proto";
+import "buf/validate/validate.proto";
 
 option java_package = "io.envoyproxy.envoy.extensions.filters.http.checksum.v3alpha";
 option java_outer_classname = "ChecksumProto";
@@ -27,12 +27,12 @@ message ChecksumConfig {
     oneof matcher {
       // A matcher for a path that is expected to have a specific checksum, as specified
       // in the ``sha256`` field.
-      type.matcher.v3.StringMatcher path_matcher = 1 [(validate.rules).message = {required: true}];
+      type.matcher.v3.StringMatcher path_matcher = 1 [(buf.validate.field).required = true];
     }
 
     // A hex-encoded sha256 string required to match the sha256sum of the response body
     // of the path specified in the ``path_matcher`` field.
-    string sha256 = 2 [(validate.rules).string = {pattern: "^[a-fA-F0-9]{64}"}];
+    string sha256 = 2 [(buf.validate.field).string = {pattern: "^[a-fA-F0-9]{64}"}];
   }
 
   // A set of matcher and checksum pairs for which, if a path matching ``path_matcher``

api/contrib/envoy/extensions/filters/http/golang/v3alpha/golang.proto

@@ -9,7 +9,7 @@ import "google/protobuf/any.proto";
 import "xds/annotations/v3/status.proto";
 
 import "udpa/annotations/status.proto";
-import "validate/validate.proto";
+import "buf/validate/validate.proto";
 
 option java_package = "io.envoyproxy.envoy.extensions.filters.http.golang.v3alpha";
 option java_outer_classname = "GolangProto";
@@ -39,21 +39,21 @@ message Config {
   }
 
   // Globally unique ID for a dynamic library file.
-  string library_id = 1 [(validate.rules).string = {min_len: 1}];
+  string library_id = 1 [(buf.validate.field).string = {min_len: 1}];
 
   // Path to a dynamic library implementing the
   // :repo:`StreamFilter API <contrib/golang/common/go/api.StreamFilter>`
   // interface.
   // [#comment:TODO(wangfakang): Support for downloading libraries from remote repositories.]
-  string library_path = 2 [(validate.rules).string = {min_len: 1}];
+  string library_path = 2 [(buf.validate.field).string = {min_len: 1}];
 
   // Globally unique name of the Go plugin.
   //
   // This name **must** be consistent with the name registered in ``http::RegisterHttpFilterConfigFactory``,
   // and can be used to associate :ref:`route and virtualHost plugin configuration
   // <envoy_v3_api_field_extensions.filters.http.golang.v3alpha.ConfigsPerRoute.plugins_config>`.
   //
-  string plugin_name = 3 [(validate.rules).string = {min_len: 1}];
+  string plugin_name = 3 [(buf.validate.field).string = {min_len: 1}];
 
   // Configuration for the Go plugin.
   //
@@ -75,7 +75,7 @@ message Config {
   // * The filter's :ref:`plugin_config <envoy_v3_api_field_extensions.filters.http.golang.v3alpha.Config.plugin_config>`
   //
   // [#not-implemented-hide:]
-  MergePolicy merge_policy = 5 [(validate.rules).enum = {defined_only: true}];
+  MergePolicy merge_policy = 5 [(buf.validate.field).enum = {defined_only: true}];
 
   // Generic secret list available to the plugin.
   // Looks into SDS or static bootstrap configuration.
@@ -87,12 +87,12 @@ message Config {
 
 message RouterPlugin {
   oneof override {
-    option (validate.required) = true;
+    option (buf.validate.oneof).required = true;
 
     // [#not-implemented-hide:]
     // Disable the filter for this particular vhost or route.
     // If disabled is specified in multiple per-filter-configs, the most specific one will be used.
-    bool disabled = 1 [(validate.rules).bool = {const: true}];
+    bool disabled = 1 [(buf.validate.field).bool = {const: true}];
 
     // The config field is used for setting per-route and per-virtualhost plugin config.
     google.protobuf.Any config = 2;