[dependabot]

Bumps github.com/goccy/go-json from 0.11.2 to 0.12.0.

Release notes

Sourced from github.com/goccy/go-json's releases.

v0.12.0

What's Changed

• Encoder: call a pointer-receiver marshaler with the address of a pointer-sized value by @​goccy in goccy/go-json#692
• Add github.com/goccy/go-json/jsontext, faster than encoding/json/jsontext by @​goccy in goccy/go-json#689
• Share number, string and formatting code between v1 and jsontext, and fix v1 deviations by @​goccy in goccy/go-json#693
• Look up a type the recent opcodes miss in the shared table without a call by @​goccy in goccy/go-json#674
• Prepare the encoder and jsontext for github.com/goccy/go-json/v2 by @​goccy in goccy/go-json#695
• Add the compile mode of the encoding/json/v2 semantics to the encoder by @​goccy in goccy/go-json#696
• Add github.com/goccy/go-json/v2 with Marshal, MarshalWrite and MarshalEncode by @​goccy in goccy/go-json#698
• Add MarshalOf and MarshalWriteOf to github.com/goccy/go-json/v2, and benchmark the v2 encoder by @​goccy in goccy/go-json#699
• Report the coverage by octocov instead of Codecov by @​goccy in goccy/go-json#700
• Decoder: follow an embedded pointer to an unexported struct which is set by @​minhnhathoang in goccy/go-json#697
• Encoder: read maps by values of their own size, and detect cycles through map values by @​goccy in goccy/go-json#704
• Encoder: fix crashes on maps of keys of no size and of values of an interface type with methods by @​goccy in goccy/go-json#705
• Encoder: record the values of cycle detection by their types, and a pointer in an interface by itself by @​goccy in goccy/go-json#706
• v2: fix panics on keys of an interface type with methods and on misuse of a method's encoder by @​goccy in goccy/go-json#707
• jsontext: fail an attached encoder which ends the level it is attached in by @​goccy in goccy/go-json#708
• v2: fail the value of a method when a call of MarshalEncode within it fails by @​goccy in goccy/go-json#709
• v2: detect cycles through declined values and MarshalEncode called by methods by @​goccy in goccy/go-json#710
• v2: write json.Number as a number and fail time.Duration map keys by @​goccy in goccy/go-json#711
• v2: rewrite only raw values by the options which rewrite raw values by @​goccy in goccy/go-json#712
• Encode json.Number and pointer map keys by their names by @​goccy in goccy/go-json#713
• v2: give the string option of a field to its methods and functions by @​goccy in goccy/go-json#714
• v2: name keys in interfaces and behind pointers by the functions of their values by @​goccy in goccy/go-json#715
• v2: escape field names for JavaScript and keep the escapes of nested calls by @​goccy in goccy/go-json#716
• Fail values nested deeper than 10000 levels by @​goccy in goccy/go-json#717
• v2: keep nothing of the caller's output in the state of MarshalEncode by @​goccy in goccy/go-json#718
• v2: count the depth of methods, nested calls and declined values in the whole output by @​goccy in goccy/go-json#719
• v2: fix the names which methods write for map keys by @​goccy in goccy/go-json#720
• Count the levels a type nests in its frame for the max depth by @​goccy in goccy/go-json#721
• v2: give the functions of marshaling a pointer at the top level as its value by @​goccy in goccy/go-json#722
• Fix the option ,string with Colorize and on a pointer to a pointer by @​goccy in goccy/go-json#723
• Write a pointer to a nil value with omitempty as null by @​goccy in goccy/go-json#724
• Fix small defects found by a review of the whole encoder by @​goccy in goccy/go-json#725
• Choose and indent the fields of embedded structs as encoding/json does by @​goccy in goccy/go-json#726
• Fail for a value of an unsupported type only when it is encoded by @​goccy in goccy/go-json#727
• Add benchmarks of decoding a stream from a chunked reader by @​goccy in goccy/go-json#728
• Decode the option ,string on pointers and keys of pointer types as encoding/json of Go 1.27 does by @​goccy in goccy/go-json#729
• Add benchmarks of encoding maps under every condition by @​goccy in goccy/go-json#732
• Decode the keys of maps as encoding/json does by @​goccy in goccy/go-json#733
• Encode the values of a sorted map in the order of the names by @​goccy in goccy/go-json#730
• Name a map key of pointers by what they lead to, and fail for a cycle by @​goccy in goccy/go-json#735
• Decoder: bound the memory of a stream (supersedes #734) by @​goccy in goccy/go-json#736
• Add the sonic Decoder to the stream benchmarks which had none by @​goccy in goccy/go-json#737
• Decoder: match encoding/json at the depth limit wherever the reads end by @​goccy in goccy/go-json#739
• Decode as encoding/json of Go 1.27 on every version of Go by @​goccy in goccy/go-json#740
• Encode a pointer type which is a value of itself through what it points to by @​goccy in goccy/go-json#738
• README: describe decoding as Go 1.27's on every Go version, and the stream decoder by elements by @​goccy in goccy/go-json#741
• Decode recursive slice, map and array types instead of overflowing the stack by @​goccy in goccy/go-json#742
• Decode the fields of embedded structs as encoding/json chooses them by @​goccy in goccy/go-json#743

... (truncated)

Commits

• c0214cb Docs: decoded values keep only their own memory, and DecodeNoCopyString keeps...
• 8a0f087 Decoded values keep alive no memory but their own (#775) (#777)
• 1b0ea32 Path: return errors instead of panics, and select by .. at any depth (#774) (...
• 483eceb issues: drop the parts which master fixed, and state the rest as master has i...
• 9adc5cb Decode a float whose digits wrap the mantissa around to 0 (#770) (#772)
• 5c8a7dd Call MarshalJSONTo and UnmarshalJSONFrom from the root package (#769)
• 8d26d8c Add the options of encoding/json, applied by the engine of v2 (#771)
• 8850196 Follow encoding/json of Go 1.27.3, and pin CI to it (#768)
• 0ceaba2 Prepare v0.12.0: describe v2 and jsontext in the README, and pass the tests o...
• b6e231f v2: decode structs, streams and UnmarshalDecode by v1's paths where v2 decode...
• Additional commits viewable in compare view

[github-actions]

Gemini PR Review

Reviewed commit: 20e6df132a95e871e971d83f5999d73fd07ea9ea
Verdict: FAIL

• Correctness bug risk: The update to github.com/goccy/go-json from v0.11.2 to v0.12.0 includes a fix titled "allow for unmarshaling of empty string to string slice". This change in unmarshaling behavior for string slice fields, when the JSON value is an empty string, could lead to correctness bugs if existing application logic differentiates between a nil slice (which might have been the prior result or an error) and an empty slice ([]string{}). Verify that all modules using go-json correctly handle this new behavior for string slices. (Files: adapters/cassandra/go.mod, adapters/redis/go.mod, ai/go.mod, go.mod, incfs/go.mod, infs/go.mod, jsondb/go.mod, search/go.mod)

This result blocks merge. Push a fix and comment /gemini review. To contest a finding, see the Gemini dispute process in CONTRIBUTING.md.

[github-actions]

Gemini PR Review

Reviewed commit: 85362f810c5ff62583e964524303dee4891e6cbd
Verdict: FAIL

• The upgrade of github.com/goccy/go-json to v0.12.0 across all modified go.mod files introduces a MaxRecursionDepth option. This feature is designed to mitigate potential Denial of Service (DoS) attacks by limiting the recursion depth when parsing deeply nested JSON structures. The current diff only updates the dependency and does not include any changes to configure or utilize this new security control, leaving the application potentially vulnerable to such attacks.

This result blocks merge. Push a fix and comment /gemini review. To contest a finding, see the Gemini dispute process in CONTRIBUTING.md.