nosj 0.3.0-x86_64-linux → 0.3.1-x86_64-linux

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 734f363fe006f81b64302674599f01f78239515aba0111125b2db71a8ea70022
-  data.tar.gz: 2f13bcd853bd227de0420cc3c86c8452a2201705ea51192ac083c25fe0bf925b
+  metadata.gz: a03b7acd00b05ca48947bf80319648b4042b3e62d50094d4d075b35eaedccec5
+  data.tar.gz: 4fcf70e0bb3e57b5ce15449363d3ab14d02721ffbbe724cc95bb15a1e48da2f6
 SHA512:
-  metadata.gz: 35091b15c193843620049fbc191beaad540c0774b3e6da311bf51dfdbf72f462e517ff3b527a474b0b62686d3ed4d828a4e610c9f5e6707055d19d61e7532327
-  data.tar.gz: 909edb0644da114fb00eba22c4c3d9a4d4e09a853b6f4652b28f62bb986f9342f5c7d91803126f213c3af8c4cc3070230f3bba222de1a7087cd47ccafa48d21b
+  metadata.gz: 177ccd493e943f35b96da5ac6aa1cef5ff72f757194d97130e34ed0c7141aae99f06b0d5bf6d141ff3222f8fb50e6f26c68ad93890b618c6526da384dd6e293c
+  data.tar.gz: 706499dbb44d2f09209735702e9d7e0421279a0fd7d71626878d545669dc34c9267d4fb11de51d07b16f75940d73511fae934365abb4cffca82bef6e53f974ce

data/CHANGELOG.md

@@ -1,3 +1,27 @@
+## [0.3.1] - 2026-07-17
+
+- Fixed: `NOSJ.minify` / `NOSJ.reformat` produced unparseable output
+  for a float that overflows to Infinity—a huge-exponent literal like
+  `1e999`, or a ~300-digit integer with an exponent (such literals
+  parse to Infinity even in strict mode, matching the `json` gem).
+  The pipe emitted a bare `Infinity` token; it now raises the same
+  `GeneratorError` that `generate` would
+  (`"Infinity not allowed in JSON"`). With `allow_nan: true` the
+  literal still passes through as `Infinity`. Found by fuzzing.
+- Fixed (second manifestation, also found by fuzzing): the same
+  unparseable output could appear with the overflowing literal hidden
+  behind a duplicate object key. Because the reformat pipe
+  deliberately preserves duplicate-key entries, it now refuses such
+  documents with the same `GeneratorError` even though
+  `generate(parse(x))` succeeds there (last-key-wins parsing discards
+  the shadowed value)—a documented divergence.
+- Differential fuzzing for the native extension (`ext/nosj/fuzz`):
+  three cargo-fuzz targets—reformat, NDJSON framing, and
+  byte-splicing/JSON Patch—each drive the real entry points on an
+  embedded Ruby VM and compare every input against pure-Ruby
+  reference implementations, with committed seed corpora and a weekly
+  CI workflow (`fuzz.yml`).
+
 ## [0.3.0] - 2026-07-17
 
 - Reformat without parsing. `NOSJ.minify(json, opts)` and

data/README.md

@@ -434,6 +434,11 @@ bundle exec rake bench:fast             # the sweep without retraining
 bundle exec rake "bench:ips[twitter]"   # multi-gem shoot-out (benchmark-ips); no args = full corpus
 ```
 
+The native layer is differentially fuzzed on an embedded VM
+(reformat pipe, NDJSON framing, splice/patch span arithmetic against
+pure-Ruby reference implementations)—see
+[ext/nosj/fuzz/README.md](ext/nosj/fuzz/README.md).
+
 ## Acknowledgements
 
 Thanks to [Jean Boussier](https://github.com/byroot), [Florian Frank](https://github.com/flori), [Hiroshi Shibata](https://github.com/hsbt), [Nobuyoshi Nakada](https://github.com/nobu), [Étienne Barrié](https://github.com/etiennebarrie), and the other authors and maintainers of the [json gem](https://github.com/ruby/json)—for their work on the gem itself, for optimization ideas, and for some of the JSON documents in the benchmark corpus.

data/lib/nosj/version.rb

@@ -2,5 +2,5 @@
 
 module NOSJ
   # The gem version.
-  VERSION = "0.3.0"
+  VERSION = "0.3.1"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: nosj
 version: !ruby/object:Gem::Version
-  version: 0.3.0
+  version: 0.3.1
 platform: x86_64-linux
 authors:
 - Yaroslav Markin