json 2.21.1 → 3.0.0.rc1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: bd45f22d143e0edbca7ee9ba8209d10fd58f1b21f5e095d7a4c2938d12ea1041
-  data.tar.gz: 7104d723fe198b21508897a5583fcb513407595df0fdb0240c0343481cac7e06
+  metadata.gz: 297c71ea2d3c5ecf3b479b5b3708cb36ff532bd700e05e7eea48c53c0e79d96f
+  data.tar.gz: ca9386834406f49385b0e6e091f3f9db7ef66ccfe2632b3c87d340d212872d4d
 SHA512:
-  metadata.gz: 554e73a89035e122a9643ecdd611ca893dbcfee74d86b9dd1ed8ea1fb2d0ddfc84416458efeff5b71925922e8e59c1c60aa90a172a411c6a33e3069a41e328d5
-  data.tar.gz: 4746639e1e86fff01e23ecbc036bae1410e6e944687ad576daf297f4d50f792334d0bef5a2864b0f2fe7e32495d7c205be2b666c811985f7168d0c2c8b1892f8
+  metadata.gz: 616c27a9a4ca01fce4bc13dc85da3e38bfbc8c13daa57c56396b77e61dcc215b1a6cf2994e1b7ba3c7bdbacf9c6b21ce7b7a147a057c9968d447ebe2f19039ba
+  data.tar.gz: 3f79549799744cfcc517fedcd722e1644fe44e8497176b5864f882174b48247e2b5c89e14f68acae527c3ee807908b20dc799daf04071acdf3ce363f235b492c

data/CHANGES.md

@@ -2,6 +2,51 @@
 
 ### Unreleased
 
+### 2026-08-11 (3.0.0.rc1)
+
+With the removal of the insecure `create_additions` option, `JSON.load` and `JSON.dump` are
+now safe to use. Them being unsafe by default caused multiple security vulnerabilites in the past.
+
+If you did depend on `create_additions`, the recommended migration is to [implement a custom serializer using
+`JSON::Coder`](https://byroot.github.io/ruby/json/2025/08/02/whats-wrong-with-the-json-gem-api.html#the-create_additions-option).
+
+All the mutable default options, such as `JSON.load_default_options` have been removed.
+They were preventing Ractor compatiblity, and causing bug in libraries using JSON expecting the default behavior.
+`JSON` methods now always behave the same unless monkey patched.
+
+All methods options are now either keyword arguments or checked like keyword arguments, meaning
+unknown options such as typos raise `ArgumentError`.
+
+Duplicated keys are now rejected by default.
+
+JavaScript comments in documents are no longer supported by default.
+
+Numerous rarely used aliases have been removed.
+
+* `JSON.load` defaults are now safe to use.
+* All unknown options are now cause an `ArgumentError` rather than to be ignored.
+* The `allow_comments` parsing option now default to `false`.
+* The `allow_duplicate_key` option now defaults to `false`, for both parsing and generating JSON.
+* Removed the `limit` positional argument of `JSON.dump`.
+* Removed the `escape_slash` alias of `script_safe`.
+* Removed `Kernel#j` and `Kernel#jj`.
+* Removed `JSON.load_default_options`.
+* Removed `JSON.unsafe_load_default_options`.
+* Removed `JSON.dump_default_options`.
+* Removed `JSON::State#[]` and `JSON::State#[]=`.
+* Removed `JSON.unparse`.
+* Removed `JSON.fast_generate`.
+* Removed `JSON.fast_unparse`.
+* Removed `JSON.pretty_unparse`.
+* Removed `JSON.restore`.
+* Removed `JSON::PRETTY_STATE_PROTOTYPE`.
+* Removed the insecure `create_additions` option.
+* Removed `JSON::GenericObject`.
+
+### 2026-07-31 (2.21.2)
+
+* Fix a use-after-free bug in `JSON::ResumableParser`. [GHSA-9hj4-r449-hfvc][CVE-2026-71847].
+
 ### 2026-07-13 (2.21.1)
 
 * Fix a compilation issue on Window and Microsoft Visual C++.

data/README.md

@@ -14,10 +14,7 @@ UTF-16 surrogate pairs in order to be able to generate the whole range of
 unicode code points.
 
 All strings, that are to be encoded as JSON strings, should be UTF-8 byte
-sequences on the Ruby side. To encode raw binary strings, that aren't UTF-8
-encoded, please use the to\_json\_raw\_object method of String (which produces
-an object, that contains a byte array) and decode the result on the receiving
-endpoint.
+sequences on the Ruby side.
 
 ## Installation
 
@@ -49,8 +46,7 @@ JSON.generate(data)
 ```
 
 You can also use the `pretty_generate` method (which formats the output more
-verbosely and nicely) or `fast_generate` (which doesn't do any of the security
-checks generate performs, e. g. nesting deepness checks).
+verbosely and nicely).
 
 ## Casting non native types
 
@@ -143,84 +139,12 @@ posts_json.map! { |post_json| JSON::Fragment.new(post_json) }
 JSON.generate({ posts: posts_json, count: posts_json.count })
 ```
 
-## Round-tripping arbitrary types
-
-> [!CAUTION]
-> You should never use `JSON.unsafe_load` nor `JSON.parse(str, create_additions: true)` to parse untrusted user input,
-> as it can lead to remote code execution vulnerabilities.
-
-To create a JSON document from a ruby data structure, you can call
-`JSON.generate` like that:
-
-```ruby
-json = JSON.generate [1, 2, {"a"=>3.141}, false, true, nil, 4..10]
-# => "[1,2,{\"a\":3.141},false,true,null,\"4..10\"]"
-```
-
-To get back a ruby data structure from a JSON document, you have to call
-JSON.parse on it:
-
-```ruby
-JSON.parse json
-# => [1, 2, {"a"=>3.141}, false, true, nil, "4..10"]
-```
-
-Note, that the range from the original data structure is a simple
-string now. The reason for this is, that JSON doesn't support ranges
-or arbitrary classes. In this case the json library falls back to call
-`Object#to_json`, which is the same as `#to_s.to_json`.
-
-It's possible to add JSON support serialization to arbitrary classes by
-simply implementing a more specialized version of the `#to_json method`, that
-should return a JSON object (a hash converted to JSON with `#to_json`) like
-this (don't forget the `*a` for all the arguments):
-
-```ruby
-class Range
-  def to_json(*a)
-    {
-      'json_class'   => self.class.name, # = 'Range'
-      'data'         => [ first, last, exclude_end? ]
-    }.to_json(*a)
-  end
-end
-```
-
-The hash key `json_class` is the class, that will be asked to deserialise the
-JSON representation later. In this case it's `Range`, but any namespace of
-the form `A::B` or `::A::B` will do. All other keys are arbitrary and can be
-used to store the necessary data to configure the object to be deserialised.
-
-If the key `json_class` is found in a JSON object, the JSON parser checks
-if the given class responds to the `json_create` class method. If so, it is
-called with the JSON object converted to a Ruby hash. So a range can
-be deserialised by implementing `Range.json_create` like this:
-
-```ruby
-class Range
-  def self.json_create(o)
-    new(*o['data'])
-  end
-end
-```
-
-Now it possible to serialise/deserialise ranges as well:
-
-```ruby
-json = JSON.generate [1, 2, {"a"=>3.141}, false, true, nil, 4..10]
-# => "[1,2,{\"a\":3.141},false,true,null,{\"json_class\":\"Range\",\"data\":[4,10,false]}]"
-JSON.parse json
-# => [1, 2, {"a"=>3.141}, false, true, nil, 4..10]
-json = JSON.generate [1, 2, {"a"=>3.141}, false, true, nil, 4..10]
-# => "[1,2,{\"a\":3.141},false,true,null,{\"json_class\":\"Range\",\"data\":[4,10,false]}]"
-JSON.unsafe_load json
-# => [1, 2, {"a"=>3.141}, false, true, nil, 4..10]
-```
+## Pretty Printing
 
 `JSON.generate` always creates the shortest possible string representation of a
 ruby data structure in one line. This is good for data storage or network
 protocols, but not so good for humans to read. Fortunately there's also
-`JSON.pretty_generate` (or `JSON.pretty_generate`) that creates a more readable
+`JSON.pretty_generate` that creates a more readable
 output:
 
 ```ruby
@@ -245,10 +169,6 @@ output:
  ]
 ```
 
-There are also the methods `Kernel#j` for generate, and `Kernel#jj` for
-`pretty_generate` output to the console, that work analogous to Core Ruby's `p` and
-the `pp` library's `pp` methods.
-
 ## Security
 
 When parsing or serializing untrusted input, parser and generator options should never be user controlled.

data/ext/json/ext/generator/generator.c

@@ -9,12 +9,6 @@
 
 /* ruby api and some helpers */
 
-enum duplicate_key_action {
-    JSON_DEPRECATED = 0,
-    JSON_IGNORE,
-    JSON_RAISE,
-};
-
 typedef struct JSON_Generator_StateStruct {
     VALUE indent;
     VALUE space;
@@ -27,8 +21,7 @@ typedef struct JSON_Generator_StateStruct {
     long depth;
     long buffer_initial_length;
 
-    enum duplicate_key_action on_duplicate_key;
-
+    bool allow_duplicate_key;
     bool as_json_single_arg;
     bool allow_nan;
     bool ascii_only;
@@ -41,7 +34,7 @@ static VALUE mJSON, cState, cFragment, eGeneratorError, eNestingError, Encoding_
 
 static ID i_to_s, i_to_json, i_new, i_encode;
 static VALUE sym_indent, sym_space, sym_space_before, sym_object_nl, sym_array_nl, sym_max_nesting, sym_allow_nan, sym_allow_duplicate_key,
-             sym_ascii_only, sym_depth, sym_buffer_initial_length, sym_script_safe, sym_escape_slash, sym_strict, sym_as_json, sym_sort_keys;
+             sym_ascii_only, sym_depth, sym_buffer_initial_length, sym_script_safe, sym_strict, sym_as_json, sym_sort_keys;
 
 
 #define GET_STATE_TO(self, state) \
@@ -956,9 +949,8 @@ json_inspect_hash_with_mixed_keys(struct hash_foreach_arg *arg)
     arg->mixed_keys_encountered = true;
 
     JSON_Generator_State *state = arg->data->state;
-    if (state->on_duplicate_key != JSON_IGNORE) {
-        VALUE do_raise = state->on_duplicate_key == JSON_RAISE ? Qtrue : Qfalse;
-        rb_funcall(mJSON, rb_intern("on_mixed_keys_hash"), 2, arg->hash, do_raise);
+    if (!state->allow_duplicate_key) {
+        rb_funcall(mJSON, rb_intern("on_mixed_keys_hash"), 1, arg->hash);
     }
 }
 
@@ -1784,14 +1776,7 @@ static VALUE cState_sort_keys_set(VALUE self, VALUE value)
 static VALUE cState_allow_duplicate_key_p(VALUE self)
 {
     GET_STATE(self);
-    switch (state->on_duplicate_key) {
-        case JSON_IGNORE:
-            return Qtrue;
-        case JSON_DEPRECATED:
-            return Qnil;
-        default:
-            return Qfalse;
-    }
+    return state->allow_duplicate_key ? Qtrue : Qfalse;
 }
 
 /*
@@ -1856,6 +1841,7 @@ static VALUE cState_buffer_initial_length_set(VALUE self, VALUE buffer_initial_l
 struct configure_state_data {
     JSON_Generator_State *state;
     VALUE vstate;  // Ruby object that owns the state, or Qfalse if stack-allocated
+    VALUE unknown_keywords;
 };
 
 static inline void state_write_value(struct configure_state_data *data, VALUE *field, VALUE value)
@@ -1883,9 +1869,8 @@ static int configure_state_i(VALUE key, VALUE val, VALUE _arg)
     else if (key == sym_depth)                 { state->depth = depth_config(val); }
     else if (key == sym_buffer_initial_length) { buffer_initial_length_set(state, val); }
     else if (key == sym_script_safe)           { state->script_safe = RTEST(val); }
-    else if (key == sym_escape_slash)          { state->script_safe = RTEST(val); }
     else if (key == sym_strict)                { state->strict = RTEST(val); }
-    else if (key == sym_allow_duplicate_key)   { state->on_duplicate_key = RTEST(val) ? JSON_IGNORE : JSON_RAISE; }
+    else if (key == sym_allow_duplicate_key)   { state->allow_duplicate_key = RTEST(val); }
     else if (key == sym_as_json)               {
         VALUE proc = RTEST(val) ? rb_convert_type(val, T_DATA, "Proc", "to_proc") : Qfalse;
         state->as_json_single_arg = proc && rb_proc_arity(proc) == 1;
@@ -1894,6 +1879,12 @@ static int configure_state_i(VALUE key, VALUE val, VALUE _arg)
     else if (key == sym_sort_keys)             {
         state_write_value(data, &state->sort_keys, normalize_sort_keys(val));
     }
+    else {
+        if (!data->unknown_keywords) {
+            data->unknown_keywords = rb_obj_hide(rb_ary_new());
+        }
+        rb_ary_push(data->unknown_keywords, key);
+    }
     return ST_CONTINUE;
 }
 
@@ -1907,12 +1898,15 @@ static void configure_state(JSON_Generator_State *state, VALUE vstate, VALUE con
 
     struct configure_state_data data = {
         .state = state,
-        .vstate = vstate
+        .vstate = vstate,
+        .unknown_keywords = Qfalse,
     };
 
     // We assume in most cases few keys are set so it's faster to go over
     // the provided keys than to check all possible keys.
     rb_hash_foreach(config, configure_state_i, (VALUE)&data);
+
+    raise_argument_error_on_unknown_keywords(data.unknown_keywords);
 }
 
 static VALUE cState_configure(VALUE self, VALUE opts)
@@ -2006,9 +2000,6 @@ void Init_generator(void)
     rb_define_method(cState, "script_safe", cState_script_safe, 0);
     rb_define_method(cState, "script_safe?", cState_script_safe, 0);
     rb_define_method(cState, "script_safe=", cState_script_safe_set, 1);
-    rb_define_alias(cState, "escape_slash", "script_safe");
-    rb_define_alias(cState, "escape_slash?", "script_safe?");
-    rb_define_alias(cState, "escape_slash=", "script_safe=");
     rb_define_method(cState, "strict", cState_strict, 0);
     rb_define_method(cState, "strict?", cState_strict, 0);
     rb_define_method(cState, "strict=", cState_strict_set, 1);
@@ -2050,7 +2041,6 @@ void Init_generator(void)
     sym_depth = ID2SYM(rb_intern("depth"));
     sym_buffer_initial_length = ID2SYM(rb_intern("buffer_initial_length"));
     sym_script_safe = ID2SYM(rb_intern("script_safe"));
-    sym_escape_slash = ID2SYM(rb_intern("escape_slash"));
     sym_strict = ID2SYM(rb_intern("strict"));
     sym_as_json = ID2SYM(rb_intern("as_json"));
     sym_allow_duplicate_key = ID2SYM(rb_intern("allow_duplicate_key"));

data/ext/json/ext/json.h

@@ -180,4 +180,17 @@ static inline VALUE json_rb_catch_obj(VALUE tag, VALUE (*func)(VALUE args), VALU
 
 #endif // JSON_TRUFFLERUBY_RB_CATCH_BUG
 
+static inline void raise_argument_error_on_unknown_keywords(VALUE unknown_keywords)
+{
+    if (RB_UNLIKELY(unknown_keywords)) {
+        if (RARRAY_LEN(unknown_keywords) == 1) {
+            rb_raise(rb_eArgError, "unknown keyword: %" PRIsVALUE, RARRAY_AREF(unknown_keywords, 0));
+        }
+        else {
+            VALUE keywords = rb_ary_join(unknown_keywords, rb_utf8_str_new_cstr(", "));
+            rb_raise(rb_eArgError, "unknown keywords: %" PRIsVALUE, keywords);
+        }
+    }
+}
+
 #endif // _JSON_H_

data/ext/json/ext/parser/extconf.rb

@@ -30,6 +30,12 @@ end
 
 append_cflags("-std=c99")
 
+# Disable function outlining on clang to prevent some of the repeated instructions
+# in json_eat_whitespace being outlined into function calls.
+# Note: This verifies '-mno-outline' is accepted as a valid compiler flag
+# and will not pass it if unsupported.
+append_cflags("-mno-outline")
+
 if enable_config('parser-use-simd', default=!ENV["JSON_DISABLE_SIMD"])
   load __dir__ + "/../simd/conf.rb"
 end

data/ext/json/ext/parser/parser.c

@@ -403,19 +403,13 @@ typedef struct json_frame_stack_struct {
     json_frame *ptr;
 } json_frame_stack;
 
-enum deprecatable_action {
-    JSON_DEPRECATED = 0,
-    JSON_IGNORE,
-    JSON_RAISE,
-};
-
 typedef struct JSON_ParserStruct {
     VALUE on_load_proc;
     VALUE decimal_class;
     ID decimal_method_id;
-    enum deprecatable_action on_duplicate_key;
-    enum deprecatable_action on_comment;
     int max_nesting;
+    bool allow_comments;
+    bool allow_duplicate_key;
     bool allow_nan;
     bool allow_trailing_comma;
     bool allow_control_characters;
@@ -435,7 +429,6 @@ typedef struct JSON_ParserStateStruct {
     rvalue_cache name_cache;
     int in_array;
     int current_nesting;
-    unsigned int emitted_deprecations;
     VALUE parser;
 } JSON_ParserState;
 
@@ -589,6 +582,8 @@ static inline char peek(JSON_ParserState *state)
 
 static void cursor_position(JSON_ParserState *state, long *line_out, long *column_out)
 {
+    JSON_ASSERT(!state->parser);
+    JSON_ASSERT(state->cursor);
     JSON_ASSERT(state->cursor <= state->end);
 
     // Redundant but helpful for hardening
@@ -617,17 +612,6 @@ static void cursor_position(JSON_ParserState *state, long *line_out, long *colum
     *column_out = column;
 }
 
-static const unsigned int MAX_DEPRECATIONS = 5;
-
-static void emit_parse_warning(const char *message, JSON_ParserState *state)
-{
-    long line, column;
-    cursor_position(state, &line, &column);
-
-    VALUE warning = rb_sprintf("%s at line %ld column %ld", message, line, column);
-    rb_funcall(mJSON, rb_intern("deprecation_warning"), 1, warning);
-}
-
 #define PARSE_ERROR_FRAGMENT_LEN 32
 
 static VALUE build_parse_error_message(const char *format, JSON_ParserState *state)
@@ -766,11 +750,10 @@ static uint32_t unescape_unicode(JSON_ParserState *state, const char *sp, const
 
 static const rb_data_type_t JSON_ParserConfig_type;
 
-const char *COMMENT_DEPRECATION_MESSAGE = "Encountered comment in JSON. This will raise an error in json 3.0 unless enabled via `allow_comments: true`";
 NOINLINE(static) void
 json_eat_comments(JSON_ParserState *state, JSON_ParserConfig *config, const char *resume_pos)
 {
-    if (config->on_comment == JSON_RAISE) {
+    if (!config->allow_comments) {
         raise_syntax_error("unexpected token %s", state);
     }
 
@@ -820,11 +803,6 @@ json_eat_comments(JSON_ParserState *state, JSON_ParserConfig *config, const char
             raise_parse_error_at("unexpected token %s", state, eos(state) ? rewind_pos : start, eos(state));
             break;
     }
-
-    if (config->on_comment == JSON_DEPRECATED && state->emitted_deprecations < MAX_DEPRECATIONS) {
-        state->emitted_deprecations++;
-        emit_parse_warning(COMMENT_DEPRECATION_MESSAGE, state);
-    }
 }
 
 ALWAYS_INLINE(static) void
@@ -1076,7 +1054,8 @@ NOINLINE(static) VALUE json_string_unescape(JSON_ParserState *state, JSON_Parser
     return result;
 }
 
-#define MAX_FAST_INTEGER_SIZE 18
+#define MAX_FAST_INTEGER_SIZE 19
+#define MAX_FAST_UINT64_SIZE  20
 #define MAX_NUMBER_STACK_BUFFER 128
 
 typedef VALUE (*json_number_decode_func_t)(const char *ptr);
@@ -1111,11 +1090,30 @@ NOINLINE(static) VALUE json_decode_large_integer(const char *start, long len)
 
 static inline VALUE json_decode_integer(uint64_t mantissa, int mantissa_digits, bool negative, const char *start, const char *end)
 {
-    if (RB_LIKELY(mantissa_digits < MAX_FAST_INTEGER_SIZE)) {
-        if (negative) {
+    if (RB_LIKELY(mantissa_digits <= MAX_FAST_INTEGER_SIZE)) {
+        if (RB_LIKELY(!negative)) {
+            return UINT64T2NUM(mantissa);
+        }
+
+        // For a negative number 19 digits in length, we only get half of the range,
+        // so ensure this negative number is less than INT64_MAX. 
+        //
+        // Note: This does miss INT64_MIN as it's value is one past INT64_MAX
+        // when converted to a uint64_t. It will still be parsed correctly by 
+        // falling through to json_decode_large_integer.
+        if (RB_LIKELY(mantissa <= (uint64_t)INT64_MAX)) {
             return INT64T2NUM(-((int64_t)mantissa));
         }
-        return UINT64T2NUM(mantissa);
+    }
+
+    if (!negative && mantissa_digits == MAX_FAST_UINT64_SIZE) {
+        // Not all 20 digit integers can be safely represented by a uint64_t but
+        // some can. The memcmp with uint64_max is safe as we've rejected leading
+        // zeros and we have guaranteed we're comparing it with a 20 digit number.
+        static const char uint64_max[] = "18446744073709551615";
+        if (memcmp(end - MAX_FAST_UINT64_SIZE, uint64_max, MAX_FAST_UINT64_SIZE) <= 0) {
+            return UINT64T2NUM(mantissa);
+        }
     }
 
     return json_decode_large_integer(start, end - start);
@@ -1193,17 +1191,6 @@ static VALUE json_find_duplicated_key(size_t count, const VALUE *pairs)
     return Qfalse;
 }
 
-NOINLINE(static) void emit_duplicate_key_warning(JSON_ParserState *state, VALUE duplicate_key)
-{
-    VALUE message = rb_sprintf(
-        "detected duplicate key %"PRIsVALUE" in JSON object. This will raise an error in json 3.0 unless enabled via `allow_duplicate_key: true`",
-        rb_inspect(duplicate_key)
-    );
-
-    emit_parse_warning(RSTRING_PTR(message), state);
-    RB_GC_GUARD(message);
-}
-
 NORETURN(static) void raise_duplicate_key_error(JSON_ParserState *state, VALUE duplicate_key)
 {
     VALUE message = rb_sprintf(
@@ -1224,23 +1211,9 @@ NORETURN(static) void raise_duplicate_key_error(JSON_ParserState *state, VALUE d
 
 NOINLINE(static) void json_on_duplicate_key(JSON_ParserState *state, JSON_ParserConfig *config, size_t count, const VALUE *pairs)
 {
-    switch (config->on_duplicate_key) {
-        case JSON_IGNORE:
-            return;
-
-        case JSON_DEPRECATED:
-            // Only emit the first few deprecations to avoid spamming.
-            if (state->emitted_deprecations < MAX_DEPRECATIONS) {
-                state->emitted_deprecations++;
-                emit_duplicate_key_warning(state, json_find_duplicated_key(count, pairs));
-            }
-            return;
-
-        case JSON_RAISE:
-            raise_duplicate_key_error(state, json_find_duplicated_key(count, pairs));
-            return;
+    if (!config->allow_duplicate_key) {
+        raise_duplicate_key_error(state, json_find_duplicated_key(count, pairs));
     }
-    UNREACHABLE;
 }
 
 static inline VALUE json_decode_object(JSON_ParserState *state, JSON_ParserConfig *config, size_t count)
@@ -2006,13 +1979,13 @@ static int parser_config_init_i(VALUE key, VALUE val, VALUE data)
          if (key == sym_max_nesting)                { config->max_nesting = RTEST(val) ? FIX2INT(val) : 0; }
     else if (key == sym_allow_nan)                  { config->allow_nan = RTEST(val); }
     else if (key == sym_allow_trailing_comma)       { config->allow_trailing_comma = RTEST(val); }
-    else if (key == sym_allow_comments)             { config->on_comment = RTEST(val) ? JSON_IGNORE : JSON_RAISE; }
+    else if (key == sym_allow_comments)             { config->allow_comments = RTEST(val); }
     else if (key == sym_allow_control_characters)   { config->allow_control_characters = RTEST(val); }
     else if (key == sym_allow_invalid_escape)       { config->allow_invalid_escape = RTEST(val); }
     else if (key == sym_symbolize_names)            { config->symbolize_names = RTEST(val); }
     else if (key == sym_freeze)                     { config->freeze = RTEST(val); }
     else if (key == sym_on_load)                    { parser_config_wb_write(self, &config->on_load_proc, RTEST(val) ? val : Qfalse); }
-    else if (key == sym_allow_duplicate_key)        { config->on_duplicate_key = RTEST(val) ? JSON_IGNORE : JSON_RAISE; }
+    else if (key == sym_allow_duplicate_key)        { config->allow_duplicate_key = RTEST(val); }
     else if (key == sym_decimal_class)              {
         if (RTEST(val)) {
             if (rb_respond_to(val, i_try_convert)) {
@@ -2042,7 +2015,7 @@ static int parser_config_init_i(VALUE key, VALUE val, VALUE data)
             }
         }
     }
-    else if (args->strict) {
+    else {
         if (!args->unknown_keywords) {
             args->unknown_keywords = rb_obj_hide(rb_ary_new());
         }
@@ -2070,15 +2043,7 @@ static void parser_config_init(JSON_ParserConfig *config, VALUE opts, VALUE self
     // the provided keys than to check all possible keys.
     rb_hash_foreach(opts, parser_config_init_i, (VALUE)&args);
 
-    if (RB_UNLIKELY(args.unknown_keywords)) {
-        if (RARRAY_LEN(args.unknown_keywords) == 1) {
-            rb_raise(rb_eArgError, "unknown keyword: %" PRIsVALUE, RARRAY_AREF(args.unknown_keywords, 0));
-        }
-        else {
-            VALUE keywords = rb_ary_join(args.unknown_keywords, rb_utf8_str_new_cstr(", "));
-            rb_raise(rb_eArgError, "unknown keywords: %" PRIsVALUE, keywords);
-        }
-    }
+    raise_argument_error_on_unknown_keywords(args.unknown_keywords);
 }
 
 /*
@@ -2566,6 +2531,7 @@ static VALUE cResumableParser_parse(VALUE self)
     if (eos(&parser->state)) {
         json_str_clear(parser->buffer);
         parser->buffer = Qfalse;
+        parser->state.start = parser->state.cursor = parser->state.end = 0;
     }
     parser->in_use = false;
 
@@ -2639,7 +2605,6 @@ static VALUE cResumableParser_clear(VALUE self)
     parser->state.name_cache.length = 0;
     parser->state.current_nesting = 0;
     parser->state.in_array = 1;
-    parser->state.emitted_deprecations = 0;
     parser->state.start = parser->state.cursor = parser->state.end = NULL;
     return self;
 }