Build(deps): bump oj from 3.17.4 to 3.17.5

[dependabot]

Bumps oj from 3.17.4 to 3.17.5.

Release notes

Sourced from oj's releases.

v3.17.5

What's Changed

Most of this release comes out of a security review of the C extension. There are no API changes.

Memory safety

• Fix hash flooding by seeding the key hash per process by @​Watson1978 in ohler55/oj#1053
• Fix a one byte buffer over-read on a trailing backslash by @​Watson1978 in ohler55/oj#1054
• Fix two length underflows that cause an unbounded buffer over-read by @​Watson1978 in ohler55/oj#1055
• Fix a SEGV from type confusion in class path resolution by @​Watson1978 in ohler55/oj#1056
• Fix uninitialized stack memory leaking into the class name error by @​Watson1978 in ohler55/oj#1057
• Fix output buffer overflows when writing indentation by @​Watson1978 in ohler55/oj#1058
• Fix doc path limit by @​ohler55 in ohler55/oj#1061
• Fix the use-after-free of a key when the value stack grows by @​Watson1978 in ohler55/oj#1062
• Fix the buffer over-read when a document ends where a key belongs by @​Watson1978 in ohler55/oj#1063
• Fix the id from a circular reference being used unchecked by @​Watson1978 in ohler55/oj#1064
• Fix the SEGV dumping an exception that was never raised by @​Watson1978 in ohler55/oj#1068
• Fix the stack buffer overflow writing the error location by @​Watson1978 in ohler55/oj#1071
• Fix the read error in Oj::Parser#file being taken as a huge read by @​Watson1978 in ohler55/oj#1072
• Fix the truncated float format copying stack bytes into the output by @​Watson1978 in ohler55/oj#1073
• Fix the double free of the default create_id when a call passes nil by @​Watson1978 in ohler55/oj#1074
• Fix the buffer over-read of an odd attribute name and the leak of its args by @​Watson1978 in ohler55/oj#1075
• Fix the SEGV reading a truncated document with Oj::Parser#file and the descriptor it leaks by @​Watson1978 in ohler55/oj#1076
• Fix the SEGV from a malformed number in Oj::Doc by @​Watson1978 in ohler55/oj#1077
• Fix the stack overflow from a long key with :only or :except by @​Watson1978 in ohler55/oj#1078
• Fix the odd module match being decided by uninitialized memory by @​Watson1978 in ohler55/oj#1079
• Fix :float_format taking directives it has no argument for by @​Watson1978 in ohler55/oj#1083

Memory leaks

• Fix the leak of an escaped hash key in the streaming parser by @​Watson1978 in ohler55/oj#1067
• Fix memory leak of the parser create_id when it is set again by @​Watson1978 in ohler55/oj#1085
• Fix memory leak of the parser when Oj::Parser.new or .safe raises by @​Watson1978 in ohler55/oj#1086

Parsing and dumping

• Fix a safe parser limit of 4 being ignored by @​Watson1978 in ohler55/oj#1065
• Fix the exponent bound being checked after it is narrowed by @​Watson1978 in ohler55/oj#1066
• Fix a long first token being rejected and the grown reader buffer leaking by @​Watson1978 in ohler55/oj#1069
• Fix the safe parser limits being dropped when an option is set by @​Watson1978 in ohler55/oj#1070
• Fix the custom mode dump of an unraised exception opening with "{," by @​Watson1978 in ohler55/oj#1082
• Fix the wab mode time load being an offset out on Windows by @​Watson1978 in ohler55/oj#1088
• Fix Oj::Doc dropping the exponent of a number with no decimal point by @​Watson1978 in ohler55/oj#1089

Rails

• Fix Rails to_json(only:/except:) dropping the include_root wrapper (#1020) and methods: keys (#1008) by @​Watson1978 in ohler55/oj#1039
• Pass the as_json options to every element of a container (#1008) by @​Watson1978 in ohler55/oj#1040
• Share the global rails state with an encoder instead of copying it per encoder by @​Watson1978 in ohler55/oj#1049
• Hand as_json a copy of the options instead of the encoder's own hash by @​Watson1978 in ohler55/oj#1050

... (truncated)

Changelog

Sourced from oj's changelog.

3.17.5 - 2026-07-31

Most of this release comes out of a security review of the C extension. There are no API changes.

Memory safety

• Fixed hash flooding by seeding the key hash per process. The hash was decided entirely at compile time, so a document of colliding keys turned key interning into O(n^2) and left the process slow for every later parse. (#1053)
• Fixed a one byte buffer over-read on a document that ends with a backslash inside an unterminated string. (#1054)
• Fixed two length underflows that made an empty ^m value and a key of exactly 65,536 bytes read forward until they left mapped memory. (#1055)
• Fixed a SEGV from type confusion in class path resolution. A name segment that resolved to something other than a class or module was dereferenced as one. (#1056)
• Fixed uninitialized stack memory being read into the message of an unresolved class name error. (#1057)
• Fixed output buffer overflows when writing indentation, where several callers of fill_indent() had not assured the buffer first. (#1058)
• Fixed the Oj::Doc path depth limit being checked one level too late. (#1061)
• Fixed the use-after-free of a key when the value stack grows. (#1062)
• Fixed the buffer over-read when a document ends where a key belongs. (#1063)
• Fixed the id from a circular reference being used unchecked. (#1064)
• Fixed the SEGV dumping an exception that was never raised, where the missing backtrace was read as an Array. (#1068)
• Fixed the stack buffer overflow writing the error location. (#1071)
• Fixed a read error in Oj::Parser#file being taken as a read of SIZE_MAX bytes, which wrote in front of the buffer and then reparsed it forever without checking for interrupts. (#1072)
• Fixed a :float_format too long for the 64 byte buffer copying stack bytes past the end of it into the output. (#1073)
• Fixed the double free of the default create_id when a call passes :create_id => nil. (#1074)
• Fixed the buffer over-read of an odd attribute name and the leak of its arguments. (#1075)
• Fixed the SEGV reading a truncated document with Oj::Parser#file and the descriptor it leaked. (#1076)
• Fixed the SEGV from a malformed number in Oj::Doc. (#1077)
• Fixed the stack exhaustion from a long key with :only or :except. (#1078)
• Fixed the odd module match being decided by uninitialized memory. (#1079)
• Fixed :float_format accepting directives it has no argument for. (#1083)

Memory leaks

• Fixed the leak of an escaped hash key in the streaming parser. (#1067)
• Fixed the leak of the parser create_id when it is set a second time. (#1085)
• Fixed the leak of the parser when Oj::Parser.new or Oj::Parser.safe raises on an argument it does not take. (#1086)

Parsing and dumping

• Fixed a safe parser limit of 4 being ignored. (#1065)
• Fixed the exponent bound being checked after it is narrowed. (#1066)
• Fixed a document being rejected when it opens with a number of 4093 digits or more read through a file descriptor or an IO, and the reader buffer that leaked when it grew. (#1069)
• Fixed the safe parser limits being dropped when an option is set after the parser is built. (#1070)
• Fixed the :custom mode dump of an exception that was never raised opening with {,. (#1082)
• Fixed the :wab mode time load being an offset out on Windows, where mktime() stood in for timegm() and returned -1 for any time before the epoch. (#1088)
• Fixed Oj::Doc dropping the exponent of a number written without a decimal point, so 1e3 loaded as 1. (#1089)

Rails

• Fixed a to_json(only:) or to_json(except:) dropping the include_root_in_json wrapper key and the keys added by :methods. (#1039)
• Fixed the as_json options reaching only the first element of a container, so to_json(only:), to_json(methods:) and any custom as_json(opts) took effect on one row and nowhere else. (#1040)
• An encoder now reads the global optimized class table and options instead of copying them, saving about 6.7KB of malloc per ActiveSupport::JSON.encode, and picks up later Oj.default_options and ActiveSupport::JSON::Encoding changes. (#1049)
• Fixed as_json being handed the encoder's own options hash. ActiveSupport allows as_json to write into it, and ActiveSupport 8.1 caches one encoder per process, so a single such as_json could leave :only set for every later to_json. (#1050)

... (truncated)

Commits

• 04d3084 Update changelog
• aae0079 Fix the 3.17.5 changelog entry saying only "Fixed multiple issues" (#1091)
• 6d04d30 Fix the pre-1970 time tests being skipped on Windows for a limit that no long...
• eaf0ad6 Fix Oj::Doc dropping the exponent of a number with no decimal point (#1089)
• 7f683cd Fix the wab mode time load being an offset out on Windows (#1088)
• c9bae55 Fix rake never running the test/test_*.rb suite (#1084)
• f5d4af6 Add a job timeout to the workflows (#1087)
• 2949015 Fix memory leak of the parser when Oj::Parser.new or .safe raises (#1086)
• c08a078 Fix memory leak of the parser create_id when it is set again (#1085)
• d3df7d9 Fix the custom mode dump of an unraised exception opening with "{," (#1082)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)