This release contains security hardening measures based on recommendations
by a security audit sponsored by OSTIF and conducted by X41 D-Sec GmbH.
Several of these measures include changing defaults to be more strict,
by default simplejson will now only consume and produce compliant JSON,
but the flags still exist for any backwards compatibility needs.
No high priority issues were discovered, the reference count
leak is thought to be unreachable since the digits of the float are
checked before PyOS_string_to_double is called.
A link to the public version of this report will be included in a
future release of simplejson. The following fixes were implemented in
one PR: #313
Fix invalid handling of unicode escape sequences in the pure Python
implementation of the decoder (SJ-PT-23-01)
Fix missing reference count decrease if PyOS_string_to_double raises
an exception in Python 2.x; was probably unreachable (SJ-PT-23-02)
Backport the integer string length limitation from Python 3.11 to
limit quadratic number parsing (SJ-PT-23-03)
Fix inconsistencies with error messages between the C and Python
implementations (SJ-PT-23-100)
Remove unused unichr import from encoder (SJ-PT-23-101)
Remove unused namedtuple_as_object and tuple_as_array arguments from
simplejson.load (SJ-PT-23-102)
Remove vestigial _one_shot code from iterencode (SJ-PT-23-103)
Change default of allow_nan from True to False and add allow_nan
to decoder (SJ-PT-23-107)
Fix the C extension module to harden is_namedtuple against looks-a-likes such
as Mocks. Also prevent dict encoding from causing an unraised SystemError when
encountering a non-Dict. Noticed by running user tests against a CPython
interpreter with C asserts enabled (COPTS += -UNDEBUG). #284
Updated documentation to be Python 3 first, and
have removed documentation notes about version changes
that occurred more than five years ago. #257 #254
This PR contains the following updates:
| Package | Update | Change |
|---|---|---|
| [simplejson](https://github.com/simplejson/simplejson) | minor | `==3.10` → `==3.20.2` |
---
### Release Notes
<details>
<summary>simplejson/simplejson (simplejson)</summary>
### [`v3.20.2`](https://github.com/simplejson/simplejson/releases/tag/v3.20.2)
[Compare Source](https://github.com/simplejson/simplejson/compare/v3.20.1...v3.20.2)
#### What's Changed
- Add a test for the min and max floats by [@​etrepum](https://github.com/etrepum) in [#​337](https://github.com/simplejson/simplejson/pull/337)
- Disable speedups on GraalPy same as on PyPy by [@​timfel](https://github.com/timfel) in [#​339](https://github.com/simplejson/simplejson/pull/339)
- Update changelog and version for v3.20.2 by [@​etrepum](https://github.com/etrepum) in [#​340](https://github.com/simplejson/simplejson/pull/340)
#### New Contributors
- [@​timfel](https://github.com/timfel) made their first contribution in [#​339](https://github.com/simplejson/simplejson/pull/339)
**Full Changelog**: <https://github.com/simplejson/simplejson/compare/v3.20.1...v3.20.2>
### [`v3.20.1`](https://github.com/simplejson/simplejson/releases/tag/v3.20.1)
[Compare Source](https://github.com/simplejson/simplejson/compare/v3.19.3...v3.20.1)
Version 3.20.1 released 2025-02-14
- Do not memoize keys before they are coerced to string
[#​329](https://github.com/simplejson/simplejson/pull/329)
**Full Changelog**: <https://github.com/simplejson/simplejson/compare/v3.19.3...v3.20.1>
### [`v3.19.3`](https://github.com/simplejson/simplejson/releases/tag/v3.19.3)
[Compare Source](https://github.com/simplejson/simplejson/compare/v3.19.2...v3.19.3)
Version 3.19.3 released 2024-08-14
- Updated test & build matrix to include Python 3.13.
Dropped wheel support for Python 2.7 on macOS.
[#​326](https://github.com/simplejson/simplejson/pull/326)
### [`v3.19.2`](https://github.com/simplejson/simplejson/releases/tag/v3.19.2)
[Compare Source](https://github.com/simplejson/simplejson/compare/v3.19.1...v3.19.2)
Version 3.19.2 released 2023-10-05
- Updated test & build matrix to include Python 3.12 and use
GitHub Actions as a Trusted Publisher (OIDC)
[#​317](https://github.com/simplejson/simplejson/pull/317)
### [`v3.19.1`](https://github.com/simplejson/simplejson/releases/tag/v3.19.1)
[Compare Source](https://github.com/simplejson/simplejson/compare/v3.18.4...v3.19.1)
Version 3.19.1 released 2023-04-06
- This release contains security hardening measures based on recommendations
by a security audit sponsored by OSTIF and conducted by X41 D-Sec GmbH.
Several of these measures include changing defaults to be more strict,
by default simplejson will now only consume and produce compliant JSON,
but the flags still exist for any backwards compatibility needs.
No high priority issues were discovered, the reference count
leak is thought to be unreachable since the digits of the float are
checked before PyOS\_string\_to\_double is called.
A link to the public version of this report will be included in a
future release of simplejson. The following fixes were implemented in
one PR: [#​313](https://github.com/simplejson/simplejson/pull/313)
- Fix invalid handling of unicode escape sequences in the pure Python
implementation of the decoder (SJ-PT-23-01)
- Fix missing reference count decrease if PyOS\_string\_to\_double raises
an exception in Python 2.x; was probably unreachable (SJ-PT-23-02)
- Backport the integer string length limitation from Python 3.11 to
limit quadratic number parsing (SJ-PT-23-03)
- Fix inconsistencies with error messages between the C and Python
implementations (SJ-PT-23-100)
- Remove unused unichr import from encoder (SJ-PT-23-101)
- Remove unused namedtuple\_as\_object and tuple\_as\_array arguments from
simplejson.load (SJ-PT-23-102)
- Remove vestigial \_one\_shot code from iterencode (SJ-PT-23-103)
- Change default of allow\_nan from True to False and add allow\_nan
to decoder (SJ-PT-23-107)
### [`v3.18.4`](https://github.com/simplejson/simplejson/releases/tag/v3.18.4)
[Compare Source](https://github.com/simplejson/simplejson/compare/v3.18.3...v3.18.4)
Version 3.18.4 released 2023-03-14
- Test the sdist to prevent future regressions
[#​311](https://github.com/simplejson/simplejson/pull/311)
- Enable ppc64le wheels
[#​312](https://github.com/simplejson/simplejson/pull/312)
### [`v3.18.3`](https://github.com/simplejson/simplejson/releases/tag/v3.18.3)
[Compare Source](https://github.com/simplejson/simplejson/compare/v3.18.2...v3.18.3)
Version 3.18.3 released 2023-02-05
- Fix regression in sdist archive
[#​310](https://github.com/simplejson/simplejson/pull/310)
### [`v3.18.2`](https://github.com/simplejson/simplejson/releases/tag/v3.18.2)
[Compare Source](https://github.com/simplejson/simplejson/compare/v3.18.1...v3.18.2)
Version 3.18.2 released 2023-02-04
- Distribute a pure python wheel for Pyodide
[#​308](https://github.com/simplejson/simplejson/pull/308)
### [`v3.18.1`](https://github.com/simplejson/simplejson/releases/tag/v3.18.1)
[Compare Source](https://github.com/simplejson/simplejson/compare/v3.18.0...v3.18.1)
Version 3.18.1 released 2023-01-03
- Remove unnecessary `i` variable from encoder module namespace
[#​303](https://github.com/simplejson/simplejson/pull/303)
- Declare support for Python 3.11 and add wheels
[#​305](https://github.com/simplejson/simplejson/pull/305)
### [`v3.18.0`](https://github.com/simplejson/simplejson/releases/tag/v3.18.0)
[Compare Source](https://github.com/simplejson/simplejson/compare/v3.17.6...v3.18.0)
Version 3.18.0 released 2022-11-14
- Allow serialization of classes that implement for\_json or \_asdict by
ignoring TypeError when those methods are called
[#​302](https://github.com/simplejson/simplejson/pull/302)
- Raise JSONDecodeError instead of ValueError in invalid unicode escape
sequence edge case
[#​298](https://github.com/simplejson/simplejson/pull/298)
### [`v3.17.6`](https://github.com/simplejson/simplejson/releases/tag/v3.17.6)
[Compare Source](https://github.com/simplejson/simplejson/compare/v3.17.5...v3.17.6)
Version 3.17.6 released 2021-11-15
- Declare support for Python 3.10 and add wheels
[#​291](https://github.com/simplejson/simplejson/pull/291)
[#​292](https://github.com/simplejson/simplejson/pull/292)
### [`v3.17.5`](https://github.com/simplejson/simplejson/releases/tag/v3.17.5)
[Compare Source](https://github.com/simplejson/simplejson/compare/v3.17.4...v3.17.5)
Version 3.17.5 released 2021-08-23
- Fix the C extension module to harden is\_namedtuple against looks-a-likes such
as Mocks. Also prevent dict encoding from causing an unraised SystemError when
encountering a non-Dict. Noticed by running user tests against a CPython
interpreter with C asserts enabled (COPTS += -UNDEBUG).
[#​284](https://github.com/simplejson/simplejson/pull/284)
### [`v3.17.4`](https://github.com/simplejson/simplejson/releases/tag/v3.17.4)
[Compare Source](https://github.com/simplejson/simplejson/compare/v3.17.3...v3.17.4)
Version 3.17.4 released 2021-08-19
- Upgrade cibuildwheel
[#​287](https://github.com/simplejson/simplejson/pull/287)
### [`v3.17.3`](https://github.com/simplejson/simplejson/releases/tag/v3.17.3)
[Compare Source](https://github.com/simplejson/simplejson/compare/v3.17.2...v3.17.3)
Version 3.17.3 released 2021-07-09
- Replaced Travis-CI and AppVeyor with Github Actions,
adding wheels for Python 3.9.
[#​283](https://github.com/simplejson/simplejson/pull/283)
### [`v3.17.2`](https://github.com/simplejson/simplejson/releases/tag/v3.17.2)
[Compare Source](https://github.com/simplejson/simplejson/compare/v3.17.0...v3.17.2)
Version 3.17.2 released 2020-07-16
- Added arm64 to build matrix and reintroduced
manylinux wheels
[#​264](https://github.com/simplejson/simplejson/pull/264)
- No more bdist\_wininst builds per PEP 527
[#​260](https://github.com/simplejson/simplejson/pull/260)
- Minor grammatical issue fixed in README
[#​261](https://github.com/simplejson/simplejson/pull/261)
### [`v3.17.0`](https://github.com/simplejson/simplejson/releases/tag/v3.17.0)
[Compare Source](https://github.com/simplejson/simplejson/compare/v3.16.0...v3.17.0)
- Updated documentation to be Python 3 first, and
have removed documentation notes about version changes
that occurred more than five years ago.
[#​257](https://github.com/simplejson/simplejson/pull/257)
[#​254](https://github.com/simplejson/simplejson/pull/254)
- Update build matrix for Python 3.8
[#​255](https://github.com/simplejson/simplejson/pull/255)
[#​256](https://github.com/simplejson/simplejson/pull/256)
### [`v3.16.0`](https://github.com/simplejson/simplejson/releases/tag/v3.16.0)
[Compare Source](https://github.com/simplejson/simplejson/compare/v3.15.0...v3.16.0)
- Restore old behavior with regard to the type of decoded empty
strings with speedups enabled on Python 2.x
[#​225](https://github.com/simplejson/simplejson/pull/225)
- Add python\_requires to setup.py to help pip
[#​224](https://github.com/simplejson/simplejson/pull/224)
- Fix CSS in docs when built locally
[#​222](https://github.com/simplejson/simplejson/pull/222)
### [`v3.15.0`](https://github.com/simplejson/simplejson/releases/tag/v3.15.0)
[Compare Source](https://github.com/simplejson/simplejson/compare/v3.14.0...v3.15.0)
- Clean up the C code
[#​220](https://github.com/simplejson/simplejson/pull/220)
- Bypass the decode() method in bytes subclasses
[#​219](https://github.com/simplejson/simplejson/pull/219)
- Support builds without cStringIO
[#​217](https://github.com/simplejson/simplejson/pull/217)
- Allow to disable serializing bytes by default in Python 3
[#​216](https://github.com/simplejson/simplejson/pull/216)
- Simplify the compatibility code
[#​215](https://github.com/simplejson/simplejson/pull/215)
- Fix tests in Python 2.5
[#​214](https://github.com/simplejson/simplejson/pull/214)
### [`v3.14.0`](https://github.com/simplejson/simplejson/releases/tag/v3.14.0)
[Compare Source](https://github.com/simplejson/simplejson/compare/v3.13.2...v3.14.0)
- Defer is\_raw\_json test (performance improvement)
[#​212](https://github.com/simplejson/simplejson/pull/212)
- Avoid escaping U+2028 and U+2029 without ensure\_ascii
[#​211](https://github.com/simplejson/simplejson/pull/211)
- Fix an incorrect type test in Python 2, avoiding an unnecessary unicode copy.
[#​210](https://github.com/simplejson/simplejson/pull/210)
### [`v3.13.2`](https://github.com/simplejson/simplejson/releases/tag/v3.13.2)
[Compare Source](https://github.com/simplejson/simplejson/compare/v3.13.0...v3.13.2)
- Fix additional Python 2.x compilation issue on Windows
### [`v3.13.0`](https://github.com/simplejson/simplejson/releases/tag/v3.13.0)
[Compare Source](https://github.com/simplejson/simplejson/compare/v3.12.0...v3.13.0)
- Workarounds for NamedTemporaryFile issues with Windows for tool tests
- Make TypeError messages contain type name instead of a repr.
[#​191](https://github.com/simplejson/simplejson/pull/191)
- Ensure that encoding of text subtypes is consistent with or without speedups
[#​185](https://github.com/simplejson/simplejson/issues/185)
### [`v3.12.0`](https://github.com/simplejson/simplejson/compare/v3.11.1...v3.12.0)
[Compare Source](https://github.com/simplejson/simplejson/compare/v3.11.1...v3.12.0)
### [`v3.11.1`](https://github.com/simplejson/simplejson/compare/v3.10.0...v3.11.1)
[Compare Source](https://github.com/simplejson/simplejson/compare/v3.10.0...v3.11.1)
</details>
---
### Configuration
📅 **Schedule**: (UTC)
- Branch creation
- At any time (no schedule defined)
- Automerge
- At any time (no schedule defined)
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTUuMTIiLCJ1cGRhdGVkSW5WZXIiOiI0My4xOTUuMTIiLCJ0YXJnZXRCcmFuY2giOiJtYXN0ZXIiLCJsYWJlbHMiOltdfQ==-->
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
This PR contains the following updates:
==3.10→==3.20.2Release Notes
simplejson/simplejson (simplejson)
v3.20.2Compare Source
What's Changed
New Contributors
Full Changelog: https://github.com/simplejson/simplejson/compare/v3.20.1...v3.20.2
v3.20.1Compare Source
Version 3.20.1 released 2025-02-14
#329
Full Changelog: https://github.com/simplejson/simplejson/compare/v3.19.3...v3.20.1
v3.19.3Compare Source
Version 3.19.3 released 2024-08-14
Dropped wheel support for Python 2.7 on macOS.
#326
v3.19.2Compare Source
Version 3.19.2 released 2023-10-05
GitHub Actions as a Trusted Publisher (OIDC)
#317
v3.19.1Compare Source
Version 3.19.1 released 2023-04-06
by a security audit sponsored by OSTIF and conducted by X41 D-Sec GmbH.
Several of these measures include changing defaults to be more strict,
by default simplejson will now only consume and produce compliant JSON,
but the flags still exist for any backwards compatibility needs.
No high priority issues were discovered, the reference count
leak is thought to be unreachable since the digits of the float are
checked before PyOS_string_to_double is called.
A link to the public version of this report will be included in a
future release of simplejson. The following fixes were implemented in
one PR: #313
implementation of the decoder (SJ-PT-23-01)
an exception in Python 2.x; was probably unreachable (SJ-PT-23-02)
limit quadratic number parsing (SJ-PT-23-03)
implementations (SJ-PT-23-100)
simplejson.load (SJ-PT-23-102)
to decoder (SJ-PT-23-107)
v3.18.4Compare Source
Version 3.18.4 released 2023-03-14
#311
#312
v3.18.3Compare Source
Version 3.18.3 released 2023-02-05
#310
v3.18.2Compare Source
Version 3.18.2 released 2023-02-04
#308
v3.18.1Compare Source
Version 3.18.1 released 2023-01-03
ivariable from encoder module namespace#303
#305
v3.18.0Compare Source
Version 3.18.0 released 2022-11-14
ignoring TypeError when those methods are called
#302
sequence edge case
#298
v3.17.6Compare Source
Version 3.17.6 released 2021-11-15
#291
#292
v3.17.5Compare Source
Version 3.17.5 released 2021-08-23
as Mocks. Also prevent dict encoding from causing an unraised SystemError when
encountering a non-Dict. Noticed by running user tests against a CPython
interpreter with C asserts enabled (COPTS += -UNDEBUG).
#284
v3.17.4Compare Source
Version 3.17.4 released 2021-08-19
#287
v3.17.3Compare Source
Version 3.17.3 released 2021-07-09
adding wheels for Python 3.9.
#283
v3.17.2Compare Source
Version 3.17.2 released 2020-07-16
manylinux wheels
#264
#260
#261
v3.17.0Compare Source
have removed documentation notes about version changes
that occurred more than five years ago.
#257
#254
#255
#256
v3.16.0Compare Source
strings with speedups enabled on Python 2.x
#225
#224
#222
v3.15.0Compare Source
#220
#219
#217
#216
#215
#214
v3.14.0Compare Source
#212
#211
#210
v3.13.2Compare Source
v3.13.0Compare Source
#191
#185
v3.12.0Compare Source
v3.11.1Compare Source
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate.