[dependabot]

Bumps com.cedarsoftware:json-io from 4.117.0 to 4.118.0.

Release notes

Sourced from com.cedarsoftware:json-io's releases.

json-io 4.118.0

Maven Central:

• com.cedarsoftware:json-io:4.118.0
• com.cedarsoftware:json-io-spring-boot-starter:4.118.0
• com.cedarsoftware:json-io-spring-ai-toon:4.118.0

It depends on java-util 4.118.0. The test suite passes on JDK 8, 17 and 25.

Upgrading from 4.117.0: 31 results can change, most of them in Map mode. The table at the top of the changelog lists each with an example, pinned by UpgradeTo4118NotesTest.

Map mode (toMaps()) has one set of rules. It reads any JSON without the classes the JSON names, and the user guide's new section "What a Map Mode Tree Holds" gives the rules in one place. MapsModeContractTest pins them in 143 cases, each run with the classes present and absent.

• No class the JSON names is built or initialized, at the root or below it. The same JSON gives the same tree with or without its classes, except for three named cases.
• A value the JSON names is that value wherever it stands: a date, a UUID, an Integer, or a simple enum on the classpath, in a field, a list, a typed list, a map key or at the root. A value that doesn't convert stays as written, and the read goes on.
• asClass(Map.class) is the tree's own root, which you can change and write back. A JsonObject follows the Map contract.
• The root is the type you ask for, or an error naming why. A tree can be read as a class in a second step: JsonIo.toJava(tree, options).asClass(Person.class).
• Typed getters and a JSON-form setter on JsonObject: get("qty", int.class), get("due", new TypeHolder<List<LocalDate>>() {}), a default-value form, and putAsJson(key, value). Each uses the read's Converter.
• Plain JSON passes through: its big numbers are written back as JSON numbers, and references stay references, in typed collections too.
• A conversion you register from Map to a class (addConverterOverride) builds that class from a JSON object, in either mode.

Reading

• A failed read says where: "... (at $.lines[1].qty)".
• A key repeated in one object is held once, with its last value. strictJson() refuses it.
• strictJson() refuses what RFC 8259 does: leading zeros, -.5, 1.e20, unescaped control characters, \'.
• @IoValue, @IoCreator, records and their Jackson equivalents read back in many more shapes: values that are objects, lists or maps, enums, creators given maps, record components of every kind.
• A JSON object where an Optional is declared is what the Optional holds, as Jackson reads it.

Writing

• A ZonedDateTime is written as ISO-8601 writes it (...Z, ...+05:00, ...-05:00[America/New_York]), and every zone reads back equal.
• An enum in a declared list, set or map is written as its name. A constant with a body is named by its enum.
• Fixes: showTypeInfoAlways() types a declared collection's elements; a BigDecimal keeps a negative scale; a Character in a map is valid JSON under showTypeInfoNever(); an unpaired surrogate is escaped.

TOON

• Numbers keep their text and type with type info on.

... (truncated)

Changelog

Sourced from com.cedarsoftware:json-io's changelog.

4.118.0 - 2026-10-26

Upgrading from 4.117.0 -- what can change a result. Each row is pinned by UpgradeTo4118NotesTest; every example gave the 4.117.0 answer shown. json-io reads and converts through java-util, whose 4.118.0 has its own table (ZonedDateTime zones, parseToMinimalNumericType, an object's reference loop as a Map): see java-util's changelog. Map mode's rules are in the user guide's "What a Map Mode Tree Holds". The entries below have the details.

Area	4.117.0	4.118.0
Map mode: asClass(Map.class)	a LinkedHashMap copy of the tree's root	the root JsonObject itself: change it and write it back
Map mode: a JsonObject compared with a Map	not equal to a LinkedHashMap with the same entries; another hash	equal, in any order, with the same hash (the Map contract)
Map mode: a typed value in a list, a typed list or a map key ([{"@type":"UUID","value":"..."}])	a JsonObject holding value	the UUID, as in a field
Map mode: a simple enum on the classpath, written with its type, in a list	a JsonObject holding name	the constant, as in a field
Map mode: an object of a class on the classpath inside a typed collection ({"@type":"ArrayList","@items":[{"@type":"com.acme.Person","age":3}]})	typed by its class: age an Integer	JSON, as in a field: age a Long
Map mode: the root's @type class	constructed; one that could not be built failed the read	never constructed (its fields still take the class's types)
Map mode: a JSON object with fields asked for as a List, Set or array	an empty list	JsonIoException
Map mode: asType(List<LocalDate>) on ["2024-01-15"]	Strings	LocalDates: the root's type arguments convert its values
Map mode: a value below the root that does not convert ({"@type":"BigDecimal","value":"abc"})	the read failed	the JSON stays as written; the read goes on
Map mode: a @ref inside a typed collection	an empty JsonObject	the object it names
Map mode: JsonIo.toJava(tree, options).asClass(Person.class)	"Return type mismatch"	the Person Java mode reads from the tree
Map mode, written back: a number past a long (or a decimal read with floatPointBigDecimal()) in a tree read from plain JSON	{"@type":"BigInteger","value":"..."} (a JSON string with showTypeInfoNever())	the JSON number it was read from
A conversion registered from Map to a class (addConverterOverride(Map.class, Policy.class, ..))	never used for a JSON object: the class's constructors ran	used first, before the class factory
A key repeated in one object ({"a":1,"b":2,"a":3})	held twice (size 3, written back twice)	once: the last value where the key first stood; strictJson() refuses it
A JSON object with fields where a list, set or array is declared	an empty list	JsonIoException "... (at $.lines)"
A read that fails	the message named the class and field	its first line ends with where: "(at $.lines[1].qty)"
A JSON object where an Optional is declared ({"who":{"name":"Ann"}})	Optional.empty()	the Optional holding it, as Jackson reads it
Blank text in a list of a class ({"people":[""]})	dropped: an empty list	null in its place
Java mode, failOnUnknownType(false): an unknown class holding @items	an empty map, the items lost	its items, by the type its place declares
strictJson(): 007, -.5, 1.e20, an unescaped tab, \'	accepted	refused, as RFC 8259 does
floatPointBoth() (and TOON) on 0.30000000000000004	a BigDecimal	a Double (java-util's parseToMinimalNumericType)
A ZonedDateTime written by 4.x with an offset zone ("...+05:00[+05:00]"), at the root or where Object is declared	JsonIoException	read
A ZonedDateTime in an offset zone, written	"...Z[UTC]" for Z (read back as the region UTC), "...+05:00[+05:00]"	"...Z", "...+05:00": as ISO-8601 and toString() write it
An Integer (Short, Byte, Float, Character, AtomicInteger) put into a JsonObject where no class declares the field	{"n":5}, read back as a Long	{"n":{"@type":"Integer","value":5}}; putAsJson() stores the JSON form
An enum in a declared List<Status> (a set, a map's values or @keys)	[{"@type":"com.acme.Status","name":"NEW"}]	["NEW"]
An enum constant with a body (A { .. })	named by its own class (Rich$1), with @id/@ref	named by its enum
showTypeInfoAlways(): the elements of a declared collection	no @type	@type on each
A BigDecimal with a negative scale (1E+3)	"1000"	"1E+3"
A Character in a Map or Collection with showTypeInfoNever()	{"v":x}, not JSON	{"v":"x"}
A String with an unpaired surrogate	written as ?	escaped ("\ud800"); reads back
TOON with type info: a whole-number Double where nothing declares the type	1, read back a Long	carries $type; reads back a Double

• BUILD: java-util 4.117.0 → 4.118.0, released the same day: json-io depends on the java-util of its own version number. From it json-io uses Converter.convert(Object, Type) (the typed getters), the ISO zoned reading and the bracketed offset (every ZonedDateTime zone reads back), the object-to-Map loop (putAsJson refuses one), parseToMinimalNumericType (floatPointBoth(), TOON) and FastReader.readUntil with a stop below a character (strict mode).
• BUG FIX: Strict JSON mode now rejects numbers such as 1.e20, where an exponent with multiple digits previously hid the missing fractional digit. Both the streaming tokenizer and object reader enforce this check; permissive JSON5 parsing is unchanged.
• BUG FIX: Strict JSON mode refuses leading zeros and -.5. RFC 8259 writes the integer part of a number as 0 alone or as a digit 1-9 followed by digits, with a digit right after the minus sign. strictJson() accepted 01, -01, 00, 007 and 00.5 (reading 1, -1, 0, 7 and 0.5), and accepted -.5 while refusing .5. Now each is a parse error, "Leading zeros not allowed in strict JSON mode" or "Leading decimal point not allowed in strict JSON mode", through JsonIo.createTokenizer() and JsonIo.toJava() alike. Non-strict reading is unchanged: 01 is 1 and -.5 is -0.5. Found while reviewing #439 (the entry above).
  • Tests. JsonTokenizerTest: the refused forms through the tokenizer and through toJava() in arrays and objects; what strict mode still accepts (0, -0, 0.5, 0.05, 0e5, 10, -1000, 100.001, [0,0 , 0]); and non-strict reading unchanged. 15 of them fail on 4.117.0, and removing either check fails a test.
• BUG FIX: Strict JSON mode refuses unescaped control characters and the \' escape in strings. RFC 8259 allows U+0000 through U+001F inside a string only escaped, and its escapes are \" \\ \/ \b \f \n \r \t \uXXXX. strictJson() accepted a raw tab, line feed or any other control character in a string or a field name, and the JSON5 escape \'. Now each is a parse error naming the character ("Unescaped control character U+0009 not allowed in strict JSON mode", "Escaped single quote (') not allowed in strict JSON mode"), wherever it falls: in the first 256 characters of a string or past them, before or after an escape, read from a String, an InputStream or the tokenizer. Jackson refuses both by default. Non-strict reading is unchanged (measured within 2%). Strict mode looks at each plain character of a string once more, which costs 10-17% on string-heavy JSON (2,000 objects of 12 strings, toMaps(), JDK 21 and 25).
  • Tests. StrictJsonStringsTest (18): all 32 control characters; a tab in each place a string is read in runs (a short string, the first run of a long one, a later run, after an escape, a later run after an escape, a field name), through toJava(String), toJava(InputStream) and the tokenizer; escaped control characters, characters from U+0020 up (DEL, Latin-1, the euro sign, an emoji) and the other escapes kept; \' refused in values and keys; non-strict reading unchanged. 8 of them fail on 4.117.0, and removing any one of the five checks fails a test.
• BUG FIX: floatPointBoth() and the TOON reader keep the number in the text (with java-util 4.118.0). Both choose Double or BigDecimal through java-util's MathUtilities.parseToMinimalNumericType(), which 4.118.0 corrects: a decimal is a Double when the double reads back as the same number, and otherwise a BigDecimal holding that number. Before it, 99e307 read as Infinity, 8.000000000000001 read as the Double 8.000000000000002, and a double json-io had written with 17 digits (0.30000000000000004, about a third of all doubles) read back as a BigDecimal, as did doubles near the ends of the range (1e308, Double.MAX_VALUE). What the user guide says of floatPointBoth(), Double "except when precision would be lost", now holds. The default, floatPointDouble(), is untouched. The TOON reader's comment on this is corrected and moved to the method it describes.
  • Tests. DecimalReadsBackTest (4): floatPointBoth() and TOON on the values above, and doubles json-io writes, as JSON and as TOON, reading back as the same Double. All 4 fail with java-util 4.117.0. (TOON writes numbers without an exponent, so a double such as 1e23 is written, and read back, as an integer: unchanged.)
• DOCS: The user guide and the strictJson() Javadoc list what strict mode refuses, now including leading zeros, -.5, 1.e5, unescaped control characters in a string and the \' escape (the three fixes above).

... (truncated)

Commits

• 893e7db Release: json-io 4.118.0 dated 2026-10-26 in the changelog
• efdc467 Docs: README ratio table re-measured for 4.118.0, all three columns
• 4430966 Performance: a repeated-key check builds no hash index for an object of up to...
• d51f9b4 Docs: two README snippets named methods that do not exist
• 5924ab3 Docs: 4.118.0 upgrade table -- what can change a result -- pinned by UpgradeT...
• d4cdd48 Docs: docs/json-io-5.0.md lists what changes in 5.0 and how to prepare on 4.x
• c151c07 Docs: Map mode's rules in one place in the user guide; failOnUnknownType and ...
• 3950152 Test: MapsModeContractTest pins the Map mode contract, 143 cases, classes pre...
• 56163cb Test: every ZonedDateTime zone reads back equal wherever it stands (java-util...
• 42dcd7f Fix: putAsJson refuses an object whose fields loop back to it, naming its class
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)