nosj 0.3.0-x86_64-linux → 0.3.2-x86_64-linux

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 734f363fe006f81b64302674599f01f78239515aba0111125b2db71a8ea70022
-  data.tar.gz: 2f13bcd853bd227de0420cc3c86c8452a2201705ea51192ac083c25fe0bf925b
+  metadata.gz: ebfb1f3235c863a322c75dcbfa3b7ea1514787d3d20ec4aac4dcee4df7fc4288
+  data.tar.gz: 75141c5cd1f8aeed9c637895d70a390ea8a50f6839223a24f5a9845c29b6a173
 SHA512:
-  metadata.gz: 35091b15c193843620049fbc191beaad540c0774b3e6da311bf51dfdbf72f462e517ff3b527a474b0b62686d3ed4d828a4e610c9f5e6707055d19d61e7532327
-  data.tar.gz: 909edb0644da114fb00eba22c4c3d9a4d4e09a853b6f4652b28f62bb986f9342f5c7d91803126f213c3af8c4cc3070230f3bba222de1a7087cd47ccafa48d21b
+  metadata.gz: 276f5b7c940d0472c1aa6be96a36291a06c30732a39b1b6410625a4194e5803731c0c89823ea076df7c4e0505b5e7944f614ae135039b3cd73bcc8ee9a5ebe8e
+  data.tar.gz: 56c66d7600e92632d5f310bc01ecb8e8d3416c38be081f128b09949d58927fc03e513426b5de7f30cbfeeba171d6ba061f117256176a4506df5741ed9e1e2300

data/CHANGELOG.md

@@ -1,3 +1,41 @@
+## [0.3.2] - 2026-07-19
+
+- **IMPORTANT**—Fixed: the precompiled platform gems linked `libruby`
+  into the extension. The arm64-darwin binaries recorded the build runner's
+  absolute Ruby path, so `require "nosj"` failed with `Library not
+  loaded: /Users/runner/hostedtoolcache/...` on any machine with Ruby
+  installed elsewhere (#2), and the Linux binaries carried a
+  `libruby.so` runtime dependency that a statically built Ruby (the
+  ruby-build default) cannot satisfy. The cause was magnus's `embed`
+  feature—needed only by the fuzz harness, which now enables it
+  itself—pulling `rb-sys/link-ruby` into the gem build. Extension
+  symbols now resolve from the host process at load time, and the
+  release build refuses to stage a binary that links libruby.
+
+## [0.3.1] - 2026-07-17
+
+- Fixed: `NOSJ.minify` / `NOSJ.reformat` produced unparseable output
+  for a float that overflows to Infinity—a huge-exponent literal like
+  `1e999`, or a ~300-digit integer with an exponent (such literals
+  parse to Infinity even in strict mode, matching the `json` gem).
+  The pipe emitted a bare `Infinity` token; it now raises the same
+  `GeneratorError` that `generate` would
+  (`"Infinity not allowed in JSON"`). With `allow_nan: true` the
+  literal still passes through as `Infinity`. Found by fuzzing.
+- Fixed (second manifestation, also found by fuzzing): the same
+  unparseable output could appear with the overflowing literal hidden
+  behind a duplicate object key. Because the reformat pipe
+  deliberately preserves duplicate-key entries, it now refuses such
+  documents with the same `GeneratorError` even though
+  `generate(parse(x))` succeeds there (last-key-wins parsing discards
+  the shadowed value)—a documented divergence.
+- Differential fuzzing for the native extension (`ext/nosj/fuzz`):
+  three cargo-fuzz targets—reformat, NDJSON framing, and
+  byte-splicing/JSON Patch—each drive the real entry points on an
+  embedded Ruby VM and compare every input against pure-Ruby
+  reference implementations, with committed seed corpora and a weekly
+  CI workflow (`fuzz.yml`).
+
 ## [0.3.0] - 2026-07-17
 
 - Reformat without parsing. `NOSJ.minify(json, opts)` and

data/README.md

@@ -434,6 +434,11 @@ bundle exec rake bench:fast             # the sweep without retraining
 bundle exec rake "bench:ips[twitter]"   # multi-gem shoot-out (benchmark-ips); no args = full corpus
 ```
 
+The native layer is differentially fuzzed on an embedded VM
+(reformat pipe, NDJSON framing, splice/patch span arithmetic against
+pure-Ruby reference implementations)—see
+[ext/nosj/fuzz/README.md](ext/nosj/fuzz/README.md).
+
 ## Acknowledgements
 
 Thanks to [Jean Boussier](https://github.com/byroot), [Florian Frank](https://github.com/flori), [Hiroshi Shibata](https://github.com/hsbt), [Nobuyoshi Nakada](https://github.com/nobu), [Étienne Barrié](https://github.com/etiennebarrie), and the other authors and maintainers of the [json gem](https://github.com/ruby/json)—for their work on the gem itself, for optimization ideas, and for some of the JSON documents in the benchmark corpus.

data/lib/nosj/version.rb

@@ -2,5 +2,5 @@
 
 module NOSJ
   # The gem version.
-  VERSION = "0.3.0"
+  VERSION = "0.3.2"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: nosj
 version: !ruby/object:Gem::Version
-  version: 0.3.0
+  version: 0.3.2
 platform: x86_64-linux
 authors:
 - Yaroslav Markin