nosj 0.3.0-aarch64-linux → 0.3.1-aarch64-linux

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a56ba077f23c260924b9e9fac44f31d3a84319e34ced9a6423b7667f4c4d0d93
-  data.tar.gz: f1c20e24f670c86d8f12ff10060c0b8644e25d7868214852b6aa2c33635ebe80
+  metadata.gz: 9d1c48677ffc867030f5f2fbf43842509cc8412415d93c16eabdfea9ec8f2e86
+  data.tar.gz: 2469b7844b7faebd71ed211e3e9b14098b6782ec1284d0a8927ae5054d99fdea
 SHA512:
-  metadata.gz: e1cb0add5e4f259aef4ba15314026bb1bab93f6bbf28371eab869030efc8631181b9316f562b42e40cba0c616eb7d7364c118ae11fa3d31df55c629791d72ba3
-  data.tar.gz: 36b242b659c734dfdbb15fa30c627b91ad33aa2de00281938f1558ae8449e22f7bd5b85ce31f74142474fafd6532bd83de4a403366c90ebc832d235afe80bf72
+  metadata.gz: 6bdf4484d310a5f0f868b13b2c7c1b3f9e57e1da773f665bcd276b52f98055428aa9c0b4d37b30c13502ff380aea3e9f520da412dae12388bb4b622e1dd9acc1
+  data.tar.gz: a874c09f066ed4d37595228e5bc91cc69b646a72ed793b73e9d3eb37f5395a234356af48bd5469dc26aac250e90b69e449377847f0b2c4587dda0a3585ce691d

data/CHANGELOG.md

@@ -1,3 +1,27 @@
+## [0.3.1] - 2026-07-17
+
+- Fixed: `NOSJ.minify` / `NOSJ.reformat` produced unparseable output
+  for a float that overflows to Infinity—a huge-exponent literal like
+  `1e999`, or a ~300-digit integer with an exponent (such literals
+  parse to Infinity even in strict mode, matching the `json` gem).
+  The pipe emitted a bare `Infinity` token; it now raises the same
+  `GeneratorError` that `generate` would
+  (`"Infinity not allowed in JSON"`). With `allow_nan: true` the
+  literal still passes through as `Infinity`. Found by fuzzing.
+- Fixed (second manifestation, also found by fuzzing): the same
+  unparseable output could appear with the overflowing literal hidden
+  behind a duplicate object key. Because the reformat pipe
+  deliberately preserves duplicate-key entries, it now refuses such
+  documents with the same `GeneratorError` even though
+  `generate(parse(x))` succeeds there (last-key-wins parsing discards
+  the shadowed value)—a documented divergence.
+- Differential fuzzing for the native extension (`ext/nosj/fuzz`):
+  three cargo-fuzz targets—reformat, NDJSON framing, and
+  byte-splicing/JSON Patch—each drive the real entry points on an
+  embedded Ruby VM and compare every input against pure-Ruby
+  reference implementations, with committed seed corpora and a weekly
+  CI workflow (`fuzz.yml`).
+
 ## [0.3.0] - 2026-07-17
 
 - Reformat without parsing. `NOSJ.minify(json, opts)` and

data/README.md

@@ -434,6 +434,11 @@ bundle exec rake bench:fast             # the sweep without retraining
 bundle exec rake "bench:ips[twitter]"   # multi-gem shoot-out (benchmark-ips); no args = full corpus
 ```
 
+The native layer is differentially fuzzed on an embedded VM
+(reformat pipe, NDJSON framing, splice/patch span arithmetic against
+pure-Ruby reference implementations)—see
+[ext/nosj/fuzz/README.md](ext/nosj/fuzz/README.md).
+
 ## Acknowledgements
 
 Thanks to [Jean Boussier](https://github.com/byroot), [Florian Frank](https://github.com/flori), [Hiroshi Shibata](https://github.com/hsbt), [Nobuyoshi Nakada](https://github.com/nobu), [Étienne Barrié](https://github.com/etiennebarrie), and the other authors and maintainers of the [json gem](https://github.com/ruby/json)—for their work on the gem itself, for optimization ideas, and for some of the JSON documents in the benchmark corpus.

data/lib/nosj/version.rb

@@ -2,5 +2,5 @@
 
 module NOSJ
   # The gem version.
-  VERSION = "0.3.0"
+  VERSION = "0.3.1"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: nosj
 version: !ruby/object:Gem::Version
-  version: 0.3.0
+  version: 0.3.1
 platform: aarch64-linux
 authors:
 - Yaroslav Markin