Changes for version 1.08 - 2026-11-01
- Security release
- A number of potentially vulnerable bugs were found by an AI-assisted review, then, independently, several CVEs were issued against Cpanel::JSON::XS, several of which where found to be applicable to this module. Most of the fixes are relevant to the legacy or incremental decoder, none of them affect encoding/decoding JSON with the default configuration.
- Breaking changes:
- croak when boolean_values is called with one argument
- require an explicit allow_nonref(1) to accept top-level scalars in the incremental parser
- [incr_parse] -Fix: quadratic rescanning during incremental parsing (similar to CVE-2026-110688) [allow_tags] -Fix: free arguments when THAW dies (CVE-2026-110685) [incr_parse] -Fix: require explicit allow_nonref for bare scalars (CVE-2026-110682) [legacy decoder] -Fix: filter_object: retain filter callbacks while active (CVE-2026-110686) [incr_parse] -Fix: enforce max_size on buffered text (CVE-2026-110678) [legacy decoder] -Fix: decode_tag: charge tagged values against max_depth (CVE-2026-110673) [legacy decoder] -Fix: decode_str() could allocate an accumulated string, then return from its failure path without decrementing it [legacy decoder] -Fix: decode_hv: free slow-path keys on errors (CVE-2026-110672) -Fix: don't leak scalars in boolean_values, core_bools; croak when boolean_values is called with one argument [legacy decoder] -Add: complete rewrite of the emulated decode_at_pointer functionality for the legacy decoder (hallucinated by AI), add tests -Change: disable simdjson mode with filter_json_object and filter_json_object_key -Fix: actually use simdjson's bigint parsing, fix the 1.e2 bad floating point number case in our own validate_large_number, add some test cases for bad numbers -Change: import simdjson 5.0.5, work around the changes in its api
Documentation
JSON::SIMD commandline utility
Modules
JSON serialising/deserialising, done correctly and faster
dummy module providing JSON::SIMD::Boolean