json-repair 0.11.0 → 0.11.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0c130bbea1b9299e31e5bfa8db873b09fd911715b7125fda6ee60a101353be5f
-  data.tar.gz: 80f6e2fe16669210505e45c99a443eaa3ce6b8b3c10e3967633885f91a9d057b
+  metadata.gz: 2d7b2f30c2451f62471beabed342ff8360f644e4ae703fa3e0f5490e44d4f0d1
+  data.tar.gz: 254abaa4ab104a0cc6650d02f099ebb00b0600ef213b00866da266159b6c1a37
 SHA512:
-  metadata.gz: 4e2c05c45ebf1cf149705021faa611c22e6e2e0de48d15d2496da4e935291abe6bf185cde756263c6aad210f73ca2e54e4c965826b14bdbb0fa9ffa47bf1684f
-  data.tar.gz: 180b477cea0b27c813b664bfcda75eb28b59453d1fe4ce90781cf298c870aa8518411e689a37ddc30882aa5f376c351ff718600411d97df845f67fd87b593d92
+  metadata.gz: bfd417574888a7ff44a03870f48ab6e02c7bb7ae80189262e093425ba52e3943982f6ab36170c1cac6a3871e3d3379469b8319bbaa6defe8a0d473a7be6fe2a9
+  data.tar.gz: 208611ef2a09d4e3a5c91afe98334dfc7443a3db56de9624cfa82a3dea1e0c0480de18227646a96dac3c46f64af526e229f70dd9de4cd41cc1160a703b132a0b

data/.rubocop.yml

@@ -1,5 +1,15 @@
+# Merge our Exclude lists with RuboCop's defaults (vendor/**/*, tmp/**/*, …)
+# instead of replacing them — CI vendors gems into vendor/bundle, which
+# RuboCop must keep skipping.
+inherit_mode:
+  merge:
+    - Exclude
+
 AllCops:
   TargetRubyVersion: 3.0
+  Exclude:
+    # gitignored local planning notes and scratch tooling (see CLAUDE.md)
+    - docs/**/*
 
 Style/Documentation:
   Enabled: false

data/CHANGELOG.md

@@ -1,5 +1,37 @@
 # Changes
 
+### 2026-06-12 (0.11.2)
+
+* Fix the 0.11.0 doubled-colon repair silently mangling objects with a
+  stray junk word between pairs. `{"value_1": true, COMMENT "value_2":
+  "data"}` returned `{"value_1":true,"COMMENT":"value_2\": \"data"}`
+  (the junk word became a key and swallowed the real pair), and
+  `{ "key": "value" COMMENT "key2": "value2" }` returned a single
+  glued string value. Both shapes now raise "Object key expected"
+  again at the same positions as upstream
+  [jsonrepair](https://github.com/josdejong/jsonrepair) v3.14.0,
+  restoring the pre-0.11.0 behavior: the merge is skipped when the
+  pair already needed a missing-colon repair or the value string was
+  itself salvaged by the unescaped-quote repair — signals that the
+  pair was malformed in a way the merge would compound, not fix. The
+  salvage signal survives string concatenation: in
+  `{"a": "b" x "c" + "d": "e"}` the `+ "d"` segment no longer clears
+  it (caught in review by Copilot). All
+  0.11.0 repairs (canonical, greedy, escaped quotes, unquoted
+  keys/values) are unchanged. Go and Python `json_repair` instead
+  drop the junk word; we deliberately keep raising rather than
+  silently discarding input (see the 0.11.0 note).
+
+* Fix a `TypeError` crash on input ending in a lone backslash inside a
+  string: `"abc\` now repairs to `"abc"` (likewise `"\` → `""`,
+  `["abc\` → `["abc"]`, `{"a": "b\` → `{"a":"b"}`), matching upstream
+  [jsonrepair](https://github.com/josdejong/jsonrepair) v3.14.0. This
+  was a porting bug — JS `charAt` past EOF returns `''` where Ruby
+  `String#[]` returns `nil`, so the invalid-escape repair in
+  `parse_string` crashed on `str << nil` instead of ending the string,
+  violating the contract that `JSONRepairError` is the only error
+  raised. Found by differential fuzzing during the 0.11.0 review.
+
 ### 2026-06-12 (0.11.0)
 
 * Repair object string values with unescaped quotes around a colon

data/CLAUDE.md

@@ -14,7 +14,7 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co
 - `bundle exec rake install` / `bundle exec rake release` — local install / publish to rubygems.org (release prompts for a rubygems MFA OTP).
 - Type checking: `Steepfile` checks `lib/` against `sig/`. `bundle exec steep check` (typecheck) and `bundle exec rbs validate` (sig syntax) both run in CI and as part of the default rake task. `steep` and `rbs` are dev dependencies in the `Gemfile`.
 
-Ruby `>= 3.0.0` is required (per gemspec). CI runs against Ruby 3.3.1.
+Ruby `>= 3.0.0` is required (per gemspec). CI runs against all currently maintained Ruby branches (3.3, 3.4, 4.0).
 
 ## Architecture
 

data/lib/json/repair/version.rb

@@ -2,6 +2,6 @@
 
 module JSON
   module Repair
-    VERSION = '0.11.0'
+    VERSION = '0.11.2'
   end
 end

data/lib/json/repairer.rb

@@ -32,6 +32,7 @@ module JSON
       @json = json
       @index = 0
       @output = +''
+      @repaired_unescaped_quote = false
     end
 
     def repair
@@ -68,7 +69,7 @@ module JSON
       end
 
       # repair redundant end quotes
-      while @json[@index] == CLOSING_BRACE || @json[@index] == CLOSING_BRACKET
+      while [CLOSING_BRACE, CLOSING_BRACKET].include?(@json[@index])
         @index += 1
         parse_whitespace_and_skip_comments
       end
@@ -236,7 +237,6 @@ module JSON
 
       initial = true
       while @index < @json.length && @json[@index] != CLOSING_BRACE
-        processed_comma = true
         if initial
           initial = false
         else
@@ -296,8 +296,14 @@ module JSON
         end
 
         # repair: an object string value with unescaped quotes around a
-        # colon, like {"a": "b": "c"}
-        repair_doubled_colon if processed_value
+        # colon, like {"a": "b": "c"}. Skipped when this pair already
+        # needed a repair that makes the merge compound garbage: a
+        # missing colon (the "key" was a stray junk word, like
+        # {"v1": true, COMMENT "v2": "data"}) or a value glued together
+        # by the unescaped-quote repair (like
+        # {"k": "v" COMMENT "k2": "v2"}); both keep raising, matching
+        # upstream
+        repair_doubled_colon if processed_value && processed_colon && !@repaired_unescaped_quote
       end
 
       if @json[@index] == CLOSING_BRACE
@@ -316,9 +322,13 @@ module JSON
     # (the unescaped-quotes reading of the input). Greedy: keeps merging
     # while another `: "..."` follows. Only the string-colon-string
     # shape is repaired; anything else falls through to the regular
-    # error paths. Divergence from upstream (which raises "Object key
-    # expected" as of v3.14.0), matching the Go and Python json-repair
-    # libraries on the canonical case.
+    # error paths. The call site additionally requires the pair's colon
+    # to be present in the input and the value string to have parsed
+    # without the unescaped-quote repair (@repaired_unescaped_quote) —
+    # when either repair already fired, the pair was malformed in a way
+    # this merge would compound, not fix. Divergence from upstream
+    # (which raises "Object key expected" as of v3.14.0), matching the
+    # Go and Python json-repair libraries on the canonical case.
     def repair_doubled_colon
       loop do
         colon = @index
@@ -400,6 +410,9 @@ module JSON
     #   and fixing the string by inserting a quote there, or stopping at a
     #   stop index detected in the first iteration.
     def parse_string(stop_at_delimiter: false, stop_at_index: -1)
+      # fresh parse (the backtracking re-invocations below rebuild the
+      # string from scratch, so they reset too); see repair_doubled_colon
+      @repaired_unescaped_quote = false
       skip_escape_chars = @json[@index] == BACKSLASH
       if skip_escape_chars
         # repair: remove the first escape character
@@ -509,6 +522,7 @@ module JSON
 
           # repair unescaped quote
           str = "#{str[...o_quote]}\\#{str[o_quote..]}"
+          @repaired_unescaped_quote = true
         elsif stop_at_delimiter && unquoted_string_delimiter?(@json[@index])
           # we're in the mode to stop the string at the first delimiter
           # because there is an end quote missing
@@ -531,7 +545,9 @@ module JSON
           return true
         elsif @json[@index] == BACKSLASH
           # handle escaped content like \n or ★
-          char = @json[@index + 1]
+          # nil at EOF: '' mirrors JS charAt, making the invalid-escape
+          # repair below a no-op that ends the string
+          char = @json[@index + 1] || ''
           escape_char = ESCAPE_CHARACTERS[char]
           if escape_char
             str << @json[@index, 2]
@@ -806,7 +822,12 @@ module JSON
         # repair: remove the end quote of the first string
         @output = strip_last_occurrence(@output, '"', strip_remaining_text: true)
         start = @output.length
+        # the segments form one logical string value: keep the doubled-colon
+        # guard's flag set when an earlier segment needed the unescaped-quote
+        # repair (parse_string resets it on entry)
+        repaired_earlier_segment = @repaired_unescaped_quote
         parsed_str = parse_string
+        @repaired_unescaped_quote ||= repaired_earlier_segment
         @output = if parsed_str
                     # repair: remove the start quote of the second string
                     remove_at_index(@output, start, 1)

data/sig/json/repairer.rbs

@@ -15,6 +15,8 @@ module JSON
 
     @output: ::String
 
+    @repaired_unescaped_quote: bool
+
     include Repair::StringUtils
 
     CONTROL_CHARACTERS: ::Hash[::String, "\\b" | "\\f" | "\\n" | "\\r" | "\\t"]

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: json-repair
 version: !ruby/object:Gem::Version
-  version: 0.11.0
+  version: 0.11.2
 platform: ruby
 authors:
 - Aleksandr Zykov