)]}'
{
  "commit": "0c4f6c30346d76c0c0b0d5de67137180f23c2634",
  "tree": "a3aa0023fe33d6f516990812e0f723a4b22502dc",
  "parents": [
    "0886b7fe7e0520a8f60741e90a5652e72245c602"
  ],
  "author": {
    "name": "Niels Lohmann",
    "email": "mail@nlohmann.me",
    "time": "Tue Sep 15 18:45:41 2026"
  },
  "committer": {
    "name": "GitHub",
    "email": "noreply@github.com",
    "time": "Tue Sep 15 18:45:41 2026"
  },
  "message": ":bug: reject ill-formed UTF-8 in CBOR/MessagePack/BSON text strings at decode time (#5531)\n\nfrom_cbor()/from_msgpack()/from_bson() copied the raw bytes of a decoded\ntext string into the resulting json value without any UTF-8 validation,\neven though RFC 8949 §3.1 (CBOR) and the MessagePack/BSON specifications\nall require text strings to be valid UTF-8. Malformed input only failed\nlater, if the value was dump()\u0027d, with a type_error.316 - so the\nallow_exceptions\u003dfalse pattern used specifically to get a discarded\nsentinel instead of an exception did not discard this category of\nmalformed input, unlike every other kind of malformed binary input this\nlibrary rejects at decode time (see #5529).\n\nFix this at the single choke point shared by BSON/CBOR/MessagePack/UBJSON\nstring reads, binary_reader::get_string(): validate the bytes with the\nUTF-8 DFA right after they are read, and report failures the same way as\nevery other binary_reader error (parse_error.113), so allow_exceptions\nand strict discarding behave consistently. get_binary()/binary blob reads\nare untouched and still accept arbitrary bytes, since only text strings\nare required to be UTF-8.\n\nThere were two independent implementations of a UTF-8 validator: the\nlexer\u0027s streaming scanner, and the serializer\u0027s Hoehrmann DFA used by\ndump_escaped_impl(). Rather than write a third, the serializer\u0027s decode()\nfunction, its utf8d table and the UTF8_ACCEPT/UTF8_REJECT constants are\nextracted into detail/string_utils.hpp (a low-level header already\nincluded before both detail/input/ and detail/output/), alongside a new\nis_valid_utf8() helper built on the same decode() step. serializer.hpp\u0027s\ndump_escaped_impl() now calls the shared decode(), so there is exactly\none UTF-8 validator in the codebase; dump()\u0027s exact type_error.316\nmessages and byte-index reporting are unchanged (see the added\nregression-guard test in unit-serialization.cpp).\n\n\n\nClaude-Session: https://claude.ai/code/session_01N4RQ1Ahan5YAGbnAQGjZTY\n\nSigned-off-by: Niels Lohmann \u003cniels.lohmann@gmail.com\u003e\nCo-authored-by: Claude Sonnet 5 \u003cnoreply@anthropic.com\u003e",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "95c82e873f47ab0652217b9fee521ea7847aceb5",
      "old_mode": 33188,
      "old_path": "docs/mkdocs/docs/features/binary_formats/bson.md",
      "new_id": "6f5603c8c33add4f4a9f8344139fc51719862fc5",
      "new_mode": 33188,
      "new_path": "docs/mkdocs/docs/features/binary_formats/bson.md"
    },
    {
      "type": "modify",
      "old_id": "670a234551529c054ac73c608422bf055a9088f5",
      "old_mode": 33188,
      "old_path": "docs/mkdocs/docs/features/binary_formats/cbor.md",
      "new_id": "e4c257e274f59f7217bce090c3e7f60b9d311a26",
      "new_mode": 33188,
      "new_path": "docs/mkdocs/docs/features/binary_formats/cbor.md"
    },
    {
      "type": "modify",
      "old_id": "bd0c840f2a67a17ece73568f670bdacd448176fe",
      "old_mode": 33188,
      "old_path": "docs/mkdocs/docs/features/binary_formats/messagepack.md",
      "new_id": "a434909c4a84a6073aa924aea3fc2c31d14661c7",
      "new_mode": 33188,
      "new_path": "docs/mkdocs/docs/features/binary_formats/messagepack.md"
    },
    {
      "type": "modify",
      "old_id": "09cc8e178302d50efee59b887f46acde2f29b2a7",
      "old_mode": 33188,
      "old_path": "docs/mkdocs/docs/home/exceptions.md",
      "new_id": "fd3a732e26123e252c34610a48e6bece56b76227",
      "new_mode": 33188,
      "new_path": "docs/mkdocs/docs/home/exceptions.md"
    },
    {
      "type": "modify",
      "old_id": "7ba7b3ab5a524c52ffb49ca1c6c7d5c9496431c4",
      "old_mode": 33188,
      "old_path": "include/nlohmann/detail/input/binary_reader.hpp",
      "new_id": "7a77edd7e314f3efd44a0aa41a8fd76c42c71dc4",
      "new_mode": 33188,
      "new_path": "include/nlohmann/detail/input/binary_reader.hpp"
    },
    {
      "type": "modify",
      "old_id": "9560729adbcfbbe2d902b21c61668a1700d20486",
      "old_mode": 33188,
      "old_path": "include/nlohmann/detail/output/serializer.hpp",
      "new_id": "4213383db7b9fef5145083f03c7ef8a59747bf90",
      "new_mode": 33188,
      "new_path": "include/nlohmann/detail/output/serializer.hpp"
    },
    {
      "type": "modify",
      "old_id": "fe2f9109dda9da7beff1fabc78dd3213e47e3eb8",
      "old_mode": 33188,
      "old_path": "include/nlohmann/detail/string_utils.hpp",
      "new_id": "064d5ccf9cc11b6efd2cb5e17de009e626249405",
      "new_mode": 33188,
      "new_path": "include/nlohmann/detail/string_utils.hpp"
    },
    {
      "type": "modify",
      "old_id": "0c3f56d435532c1844c5a1ecb00be2a2bd91eff8",
      "old_mode": 33188,
      "old_path": "single_include/nlohmann/json.hpp",
      "new_id": "fa9ec890c6673392d6af6962ee943fc9196b70a0",
      "new_mode": 33188,
      "new_path": "single_include/nlohmann/json.hpp"
    },
    {
      "type": "modify",
      "old_id": "4c9107517f5764419e150953cdcc2b926cbf55c5",
      "old_mode": 33188,
      "old_path": "tests/src/unit-cbor.cpp",
      "new_id": "fc7fc614aac7d76a7a67dcae0f795a6c7c27721a",
      "new_mode": 33188,
      "new_path": "tests/src/unit-cbor.cpp"
    },
    {
      "type": "modify",
      "old_id": "74f7f49692652d1d53e9c705257098f20844d42b",
      "old_mode": 33188,
      "old_path": "tests/src/unit-msgpack.cpp",
      "new_id": "7dd3f3cf049811c2e79284817bf0baa7ea77d9fa",
      "new_mode": 33188,
      "new_path": "tests/src/unit-msgpack.cpp"
    },
    {
      "type": "modify",
      "old_id": "511108c647974f63dae5028ca9bea0e116846939",
      "old_mode": 33188,
      "old_path": "tests/src/unit-serialization.cpp",
      "new_id": "dfb392bd4b5ac6fd82b40192a1ec61b17e31daa3",
      "new_mode": 33188,
      "new_path": "tests/src/unit-serialization.cpp"
    }
  ]
}