https://github.com/ohler55/oj - v3.17.5

What's Changed

Most of this release comes out of a security review of the C extension. There are no API changes.

Memory safety

• Fix hash flooding by seeding the key hash per process by @Watson1978 in https://github.com/ohler55/oj/pull/1053
• Fix a one byte buffer over-read on a trailing backslash by @Watson1978 in https://github.com/ohler55/oj/pull/1054
• Fix two length underflows that cause an unbounded buffer over-read by @Watson1978 in https://github.com/ohler55/oj/pull/1055
• Fix a SEGV from type confusion in class path resolution by @Watson1978 in https://github.com/ohler55/oj/pull/1056
• Fix uninitialized stack memory leaking into the class name error by @Watson1978 in https://github.com/ohler55/oj/pull/1057
• Fix output buffer overflows when writing indentation by @Watson1978 in https://github.com/ohler55/oj/pull/1058
• Fix doc path limit by @ohler55 in https://github.com/ohler55/oj/pull/1061
• Fix the use-after-free of a key when the value stack grows by @Watson1978 in https://github.com/ohler55/oj/pull/1062
• Fix the buffer over-read when a document ends where a key belongs by @Watson1978 in https://github.com/ohler55/oj/pull/1063
• Fix the id from a circular reference being used unchecked by @Watson1978 in https://github.com/ohler55/oj/pull/1064
• Fix the SEGV dumping an exception that was never raised by @Watson1978 in https://github.com/ohler55/oj/pull/1068
• Fix the stack buffer overflow writing the error location by @Watson1978 in https://github.com/ohler55/oj/pull/1071
• Fix the read error in Oj::Parser#file being taken as a huge read by @Watson1978 in https://github.com/ohler55/oj/pull/1072
• Fix the truncated float format copying stack bytes into the output by @Watson1978 in https://github.com/ohler55/oj/pull/1073
• Fix the double free of the default create_id when a call passes nil by @Watson1978 in https://github.com/ohler55/oj/pull/1074
• Fix the buffer over-read of an odd attribute name and the leak of its args by @Watson1978 in https://github.com/ohler55/oj/pull/1075
• Fix the SEGV reading a truncated document with Oj::Parser#file and the descriptor it leaks by @Watson1978 in https://github.com/ohler55/oj/pull/1076
• Fix the SEGV from a malformed number in Oj::Doc by @Watson1978 in https://github.com/ohler55/oj/pull/1077
• Fix the stack overflow from a long key with :only or :except by @Watson1978 in https://github.com/ohler55/oj/pull/1078
• Fix the odd module match being decided by uninitialized memory by @Watson1978 in https://github.com/ohler55/oj/pull/1079
• Fix :float_format taking directives it has no argument for by @Watson1978 in https://github.com/ohler55/oj/pull/1083

Memory leaks

• Fix the leak of an escaped hash key in the streaming parser by @Watson1978 in https://github.com/ohler55/oj/pull/1067
• Fix memory leak of the parser create_id when it is set again by @Watson1978 in https://github.com/ohler55/oj/pull/1085
• Fix memory leak of the parser when Oj::Parser.new or .safe raises by @Watson1978 in https://github.com/ohler55/oj/pull/1086

Parsing and dumping

• Fix a safe parser limit of 4 being ignored by @Watson1978 in https://github.com/ohler55/oj/pull/1065
• Fix the exponent bound being checked after it is narrowed by @Watson1978 in https://github.com/ohler55/oj/pull/1066
• Fix a long first token being rejected and the grown reader buffer leaking by @Watson1978 in https://github.com/ohler55/oj/pull/1069
• Fix the safe parser limits being dropped when an option is set by @Watson1978 in https://github.com/ohler55/oj/pull/1070
• Fix the custom mode dump of an unraised exception opening with "{," by @Watson1978 in https://github.com/ohler55/oj/pull/1082
• Fix the wab mode time load being an offset out on Windows by @Watson1978 in https://github.com/ohler55/oj/pull/1088
• Fix Oj::Doc dropping the exponent of a number with no decimal point by @Watson1978 in https://github.com/ohler55/oj/pull/1089

Rails

• Fix Rails to_json(only:/except:) dropping the include_root wrapper (#1020) and methods: keys (#1008) by @Watson1978 in https://github.com/ohler55/oj/pull/1039
• Pass the as_json options to every element of a container (#1008) by @Watson1978 in https://github.com/ohler55/oj/pull/1040
• Share the global rails state with an encoder instead of copying it per encoder by @Watson1978 in https://github.com/ohler55/oj/pull/1049
• Hand as_json a copy of the options instead of the encoder's own hash by @Watson1978 in https://github.com/ohler55/oj/pull/1050

Documentation

• Rename the documented :skip_null_byte option to :omit_null_byte by @Watson1978 in https://github.com/ohler55/oj/pull/1041
• Update InstallOptions doc: SIMD is auto-detected, drop --with-sse42 by @Watson1978 in https://github.com/ohler55/oj/pull/1042
• Fix the documented minimum Ruby version (2.4+ -> 2.7+) by @Watson1978 in https://github.com/ohler55/oj/pull/1043
• Fix Parser.md benchmark conclusions to reference :usual, not :saj by @Watson1978 in https://github.com/ohler55/oj/pull/1044
• Fix docs that called :custom the default mode by @Watson1978 in https://github.com/ohler55/oj/pull/1045
• Fix the documented type of the :safe option (String -> Boolean) by @Watson1978 in https://github.com/ohler55/oj/pull/1046
• Fix the claim that no methods are called on a loaded Object by @Watson1978 in https://github.com/ohler55/oj/pull/1080
• Fix the 3.17.5 changelog entry saying only "Fixed multiple issues" by @Watson1978 in https://github.com/ohler55/oj/pull/1091

Tests and CI

• Add the ActiveSupport 8 test suite so the rails_8 CI job runs it by @Watson1978 in https://github.com/ohler55/oj/pull/1047
• Add the ActiveSupport 8.1 test suite and guard the #985 regression by @Watson1978 in https://github.com/ohler55/oj/pull/1051
• Fix rake never running the test/test_*.rb suite by @Watson1978 in https://github.com/ohler55/oj/pull/1084
• Add a job timeout to the workflows by @Watson1978 in https://github.com/ohler55/oj/pull/1087
• Fix the pre-1970 time tests being skipped on Windows for a limit that no longer applies by @Watson1978 in https://github.com/ohler55/oj/pull/1090
• Fix the SyntaxError in test_object.rb that fails every CI job by @Watson1978 in https://github.com/ohler55/oj/pull/1060

Full Changelog: https://github.com/ohler55/oj/compare/v3.17.4...v3.17.5

- C
Published by Watson1978 16 days ago

https://github.com/ohler55/oj - v3.17.4

- C
Published by ohler55 about 1 month ago

https://github.com/ohler55/oj - v3.17.3

What's Changed

• Fix stack limits by @ohler55 in https://github.com/ohler55/oj/pull/1014
• Fix intern.c and fast.c by @ohler55 in https://github.com/ohler55/oj/pull/1015

Full Changelog: https://github.com/ohler55/oj/compare/v3.17.1...v3.17.3

- C
Published by ohler55 2 months ago

https://github.com/ohler55/oj - v3.17.1

What's Changed

• Add max_integer_digits limit for legacy integer parsing by @meinac in https://github.com/ohler55/oj/pull/1009
• fix: remove unsafe exec() in fast.c by @orbisai0security in https://github.com/ohler55/oj/pull/1011
• Revert "fix: remove unsafe exec() in fast.c" by @ohler55 in https://github.com/ohler55/oj/pull/1012
• Fix reentrant parser by @ohler55 in https://github.com/ohler55/oj/pull/1013

New Contributors

• @orbisai0security made their first contribution in https://github.com/ohler55/oj/pull/1011

Full Changelog: https://github.com/ohler55/oj/compare/v3.17.0...v3.17.1

- C
Published by ohler55 3 months ago

https://github.com/ohler55/oj - v3.17.0

What's Changed

• Implement Oj::Parser.safe with configurable JSON safety limits by @meinac in https://github.com/ohler55/oj/pull/1007

Full Changelog: https://github.com/ohler55/oj/compare/v3.16.17...v3.17.0

- C
Published by ohler55 4 months ago

https://github.com/ohler55/oj - v3.16.17

What's Changed

• Use fast_memcpy16 to quickly copy up to 16 bytes for tail handling in ARM Neon code and small copies when generating JSON. by @samyron in https://github.com/ohler55/oj/pull/998
• Bump jidicula/clang-format-action from 4.15.0 to 4.17.0 by @dependabot[bot] in https://github.com/ohler55/oj/pull/999
• Array hash as json by @ohler55 in https://github.com/ohler55/oj/pull/1003
• Bump jidicula/clang-format-action from 4.17.0 to 4.18.0 by @dependabot[bot] in https://github.com/ohler55/oj/pull/1001
• Handle unterminated strings in usual parser by @meinac in https://github.com/ohler55/oj/pull/1002
• Fix read() not handling partial reads for large files by @ursm in https://github.com/ohler55/oj/pull/1004
• Raise error for incomplete primitive literals by @meinac in https://github.com/ohler55/oj/pull/1005

New Contributors

• @ursm made their first contribution in https://github.com/ohler55/oj/pull/1004

Full Changelog: https://github.com/ohler55/oj/compare/v3.16.16...v3.16.17

- C
Published by ohler55 4 months ago

https://github.com/ohler55/oj - v3.16.14

What's Changed

• Change first arg to oj_parse_options by @ohler55 in https://github.com/ohler55/oj/pull/987
• Fix illegal instruction error on CPUs without SSE4.2 support by @sebyx07 in https://github.com/ohler55/oj/pull/993
• Optimize oj_dump_cstr using SSE4.2 and SSSE3. by @samyron in https://github.com/ohler55/oj/pull/973

Full Changelog: https://github.com/ohler55/oj/compare/v3.16.13...v3.16.14

- C
Published by ohler55 6 months ago

https://github.com/ohler55/oj - v3.16.13

What's Changed

• Bump actions/checkout from 4 to 5 by @dependabot[bot] in https://github.com/ohler55/oj/pull/976
• Enable SIMD optimizations by default with auto-detection by @sebyx07 in https://github.com/ohler55/oj/pull/982
• Bump actions/checkout from 5 to 6 by @dependabot[bot] in https://github.com/ohler55/oj/pull/983
• Rails encoder fix by @ohler55 in https://github.com/ohler55/oj/pull/984

New Contributors

• @sebyx07 made their first contribution in https://github.com/ohler55/oj/pull/982

Full Changelog: https://github.com/ohler55/oj/compare/v3.16.12...v3.16.13

- C
Published by ohler55 9 months ago

https://github.com/ohler55/oj - v3.16.12

What's Changed

• Fixed dump realloc bug that occurred when using the compat mode dump options.
• Fixed range encoding with the :circular option
• Restore TruffleRuby in CI by @andrykonchin in https://github.com/ohler55/oj/pull/972
• Improve worst case performance when using ARM Neon instructions by @samyron in https://github.com/ohler55/oj/pull/970

New Contributors

• @andrykonchin made their first contribution in https://github.com/ohler55/oj/pull/972

Full Changelog: https://github.com/ohler55/oj/compare/v3.16.11...v3.16.12

- C
Published by ohler55 10 months ago

https://github.com/ohler55/oj - v3.16.9

What's Changed

• Sort the conditional statements by @Watson1978 in https://github.com/ohler55/oj/pull/946
• Bump jidicula/clang-format-action from 4.13.0 to 4.14.0 by @dependabot in https://github.com/ohler55/oj/pull/942

Full Changelog: https://github.com/ohler55/oj/compare/v3.16.8...v3.16.9

- C
Published by ohler55 over 1 year ago

https://github.com/ohler55/oj - v3.16.6

What's Changed

• Do not override Object#to_json with mimic_json if ActiveSupport is existed by @Watson1978 in https://github.com/ohler55/oj/pull/936

Full Changelog: https://github.com/ohler55/oj/compare/v3.16.5...v3.16.6

- C
Published by ohler55 almost 2 years ago

https://github.com/ohler55/oj - v3.16.5

What's Changed

• Add ostruct as dependency gem for Ruby 3.5 by @Watson1978 in https://github.com/ohler55/oj/pull/928
• Parser multi load by @ohler55 in https://github.com/ohler55/oj/pull/932

Full Changelog: https://github.com/ohler55/oj/compare/v3.16.4...v3.16.5

- C
Published by ohler55 about 2 years ago

https://github.com/ohler55/oj -

- C
Published by ohler55 about 2 years ago