json 2.21.1-java → 3.0.0.rc1-java

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 557d9d9dd7d4b42baec616f7f9ad5a133489b5e339c14f0a6c6da676253ff1e1
-  data.tar.gz: e0b13c5fa3dfc826665b6116f379f675227ff027da6bf45197791d645c2a8629
+  metadata.gz: 703bfaea0f05e1db48e167cea887ae01eddac96188e31c15da20811c244c49b1
+  data.tar.gz: 782c24381bda5ee5f9b5aacc5f6dff81a997358b0a80aaa6768eaff8b12c68d5
 SHA512:
-  metadata.gz: 8366ec9b3dbd6deb74852af0b70a8b7138281f0705b6a1066ee996e577b540b275dcca9aafff6ed6f6cdaf113641482a92199cdbf25d43be80252b3edaf90295
-  data.tar.gz: 0ebfa25d2a42e5847e309d4faa6673441d821e1ab96a01c99f596f19d9f1659951ab0002dbbf00d93c66c7d290a492e98e1bc2a337378aff017bbdfa763543f7
+  metadata.gz: 16228526e82feda2b925507623b7a1fa4ea4ea370b04a9b879deea209f3fd06e18939ecf5a107bc9b6a7a2f86f5347eaaabf8e096baf34c3b82a057df34fb139
+  data.tar.gz: e11c22e4820989d2874dcec02a8a3e34dd17bbe8a73b308ac0e9694db4c86f786d34836ff0c7a01950a9989df3375b89a27a9de1a82c952bdc19c7de39c573a1

data/CHANGES.md

@@ -2,6 +2,51 @@
 
 ### Unreleased
 
+### 2026-08-11 (3.0.0.rc1)
+
+With the removal of the insecure `create_additions` option, `JSON.load` and `JSON.dump` are
+now safe to use. Them being unsafe by default caused multiple security vulnerabilites in the past.
+
+If you did depend on `create_additions`, the recommended migration is to [implement a custom serializer using
+`JSON::Coder`](https://byroot.github.io/ruby/json/2025/08/02/whats-wrong-with-the-json-gem-api.html#the-create_additions-option).
+
+All the mutable default options, such as `JSON.load_default_options` have been removed.
+They were preventing Ractor compatiblity, and causing bug in libraries using JSON expecting the default behavior.
+`JSON` methods now always behave the same unless monkey patched.
+
+All methods options are now either keyword arguments or checked like keyword arguments, meaning
+unknown options such as typos raise `ArgumentError`.
+
+Duplicated keys are now rejected by default.
+
+JavaScript comments in documents are no longer supported by default.
+
+Numerous rarely used aliases have been removed.
+
+* `JSON.load` defaults are now safe to use.
+* All unknown options are now cause an `ArgumentError` rather than to be ignored.
+* The `allow_comments` parsing option now default to `false`.
+* The `allow_duplicate_key` option now defaults to `false`, for both parsing and generating JSON.
+* Removed the `limit` positional argument of `JSON.dump`.
+* Removed the `escape_slash` alias of `script_safe`.
+* Removed `Kernel#j` and `Kernel#jj`.
+* Removed `JSON.load_default_options`.
+* Removed `JSON.unsafe_load_default_options`.
+* Removed `JSON.dump_default_options`.
+* Removed `JSON::State#[]` and `JSON::State#[]=`.
+* Removed `JSON.unparse`.
+* Removed `JSON.fast_generate`.
+* Removed `JSON.fast_unparse`.
+* Removed `JSON.pretty_unparse`.
+* Removed `JSON.restore`.
+* Removed `JSON::PRETTY_STATE_PROTOTYPE`.
+* Removed the insecure `create_additions` option.
+* Removed `JSON::GenericObject`.
+
+### 2026-07-31 (2.21.2)
+
+* Fix a use-after-free bug in `JSON::ResumableParser`. [GHSA-9hj4-r449-hfvc][CVE-2026-71847].
+
 ### 2026-07-13 (2.21.1)
 
 * Fix a compilation issue on Window and Microsoft Visual C++.

data/README.md

@@ -14,10 +14,7 @@ UTF-16 surrogate pairs in order to be able to generate the whole range of
 unicode code points.
 
 All strings, that are to be encoded as JSON strings, should be UTF-8 byte
-sequences on the Ruby side. To encode raw binary strings, that aren't UTF-8
-encoded, please use the to\_json\_raw\_object method of String (which produces
-an object, that contains a byte array) and decode the result on the receiving
-endpoint.
+sequences on the Ruby side.
 
 ## Installation
 
@@ -49,8 +46,7 @@ JSON.generate(data)
 ```
 
 You can also use the `pretty_generate` method (which formats the output more
-verbosely and nicely) or `fast_generate` (which doesn't do any of the security
-checks generate performs, e. g. nesting deepness checks).
+verbosely and nicely).
 
 ## Casting non native types
 
@@ -143,84 +139,12 @@ posts_json.map! { |post_json| JSON::Fragment.new(post_json) }
 JSON.generate({ posts: posts_json, count: posts_json.count })
 ```
 
-## Round-tripping arbitrary types
-
-> [!CAUTION]
-> You should never use `JSON.unsafe_load` nor `JSON.parse(str, create_additions: true)` to parse untrusted user input,
-> as it can lead to remote code execution vulnerabilities.
-
-To create a JSON document from a ruby data structure, you can call
-`JSON.generate` like that:
-
-```ruby
-json = JSON.generate [1, 2, {"a"=>3.141}, false, true, nil, 4..10]
-# => "[1,2,{\"a\":3.141},false,true,null,\"4..10\"]"
-```
-
-To get back a ruby data structure from a JSON document, you have to call
-JSON.parse on it:
-
-```ruby
-JSON.parse json
-# => [1, 2, {"a"=>3.141}, false, true, nil, "4..10"]
-```
-
-Note, that the range from the original data structure is a simple
-string now. The reason for this is, that JSON doesn't support ranges
-or arbitrary classes. In this case the json library falls back to call
-`Object#to_json`, which is the same as `#to_s.to_json`.
-
-It's possible to add JSON support serialization to arbitrary classes by
-simply implementing a more specialized version of the `#to_json method`, that
-should return a JSON object (a hash converted to JSON with `#to_json`) like
-this (don't forget the `*a` for all the arguments):
-
-```ruby
-class Range
-  def to_json(*a)
-    {
-      'json_class'   => self.class.name, # = 'Range'
-      'data'         => [ first, last, exclude_end? ]
-    }.to_json(*a)
-  end
-end
-```
-
-The hash key `json_class` is the class, that will be asked to deserialise the
-JSON representation later. In this case it's `Range`, but any namespace of
-the form `A::B` or `::A::B` will do. All other keys are arbitrary and can be
-used to store the necessary data to configure the object to be deserialised.
-
-If the key `json_class` is found in a JSON object, the JSON parser checks
-if the given class responds to the `json_create` class method. If so, it is
-called with the JSON object converted to a Ruby hash. So a range can
-be deserialised by implementing `Range.json_create` like this:
-
-```ruby
-class Range
-  def self.json_create(o)
-    new(*o['data'])
-  end
-end
-```
-
-Now it possible to serialise/deserialise ranges as well:
-
-```ruby
-json = JSON.generate [1, 2, {"a"=>3.141}, false, true, nil, 4..10]
-# => "[1,2,{\"a\":3.141},false,true,null,{\"json_class\":\"Range\",\"data\":[4,10,false]}]"
-JSON.parse json
-# => [1, 2, {"a"=>3.141}, false, true, nil, 4..10]
-json = JSON.generate [1, 2, {"a"=>3.141}, false, true, nil, 4..10]
-# => "[1,2,{\"a\":3.141},false,true,null,{\"json_class\":\"Range\",\"data\":[4,10,false]}]"
-JSON.unsafe_load json
-# => [1, 2, {"a"=>3.141}, false, true, nil, 4..10]
-```
+## Pretty Printing
 
 `JSON.generate` always creates the shortest possible string representation of a
 ruby data structure in one line. This is good for data storage or network
 protocols, but not so good for humans to read. Fortunately there's also
-`JSON.pretty_generate` (or `JSON.pretty_generate`) that creates a more readable
+`JSON.pretty_generate` that creates a more readable
 output:
 
 ```ruby
@@ -245,10 +169,6 @@ output:
  ]
 ```
 
-There are also the methods `Kernel#j` for generate, and `Kernel#jj` for
-`pretty_generate` output to the console, that work analogous to Core Ruby's `p` and
-the `pp` library's `pp` methods.
-
 ## Security
 
 When parsing or serializing untrusted input, parser and generator options should never be user controlled.