fix(deps): bump: bump com.cedarsoftware:json-io from 4.102.0 to 4.105.0

[dependabot]

Bumps com.cedarsoftware:json-io from 4.102.0 to 4.105.0.

Release notes

Sourced from com.cedarsoftware:json-io's releases.

4.105.0

json-io 4.105.0

Maven Central: com.cedarsoftware:json-io:4.105.0

Note: json-io 4.104.0 was never published — this release supersedes it and matches java-util 4.105.0.

Highlights

Performance — write path (ratios vs Jackson, median of 3)

• CharSegmentWriter: toJson/toToon now materialize through a segmented char[] writer instead of a StringBuilder (Jackson's SegmentedStringWriter design) — no per-append capacity/coder checks, no growth copies, no latin1→UTF-16 inflation. JSON Write 1.91x → 1.70x / 1.72x → 1.53x (cycle on/off); TOON Write 1.72x → 1.47x / 1.60x → 1.40x.
• Hand-rolled ISO temporal emitters (TemporalChars) replace DateTimeFormatter in the java.time writers; writeJsonUtf8String scans the String directly (no scratch-copy); writeStringUnescaped skips the escape scan for alphabets that can't need escaping.
• Class-classification caching: WriteFieldPlan memoizes isForceType per class; class-keyed lookups moved to ClassValueSet/ClassValueMap.

Performance — read path

• FastIsoParser: strict java.time parse for ISO-8601 wire forms before the flexible Converter/DateUtilities path. JSON Read 1.82x → 1.67x, TOON Read 1.88x → 1.78x.
• Per-instance cache-compare scratch in CharStreamTokenizer/ToonReader (drops a ThreadLocal borrow per cache-checked string).
• TOON write + maps-mode read temporal fast paths.

Build

• Runtime java-util 4.103.0 → 4.105.0. Test-scope jackson-databind 2.22.0, maven-surefire-plugin 3.5.6.

JDK compatibility: 8 – 24.

4.103.0

json-io 4.103.0

Maven Central: com.cedarsoftware:json-io:4.103.0 (requires java-util 4.103.0+)

Highlights

New features

• Streaming-write API — JsonGenerator (Jackson-aligned cursor-style serializer). New JsonIo.createGenerator(Writer|OutputStream) factories return a JsonGenerator for hand-rolled streaming output. Method set mirrors Jackson's JsonGenerator: writeStartObject/writeEndObject/writeStartArray/writeEndArray/writeFieldName, scalar writers, raw writeRaw/writeRawValue, convenience field writers, and copyCurrentEvent/copyCurrentStructure bridges for parse → transform → emit pipelines. 57 new tests.
• JsonGenerator.writeObject(Object) — Jackson-aligned databind entry point driving the same code path as JsonIo.toJson (cycle tracking, @id/@ref, custom-writer dispatch, @type policy). Identity-map sharing across writeObject calls preserves graph identity across multiple top-level emits under cycleSupport(true). Plus writeObjectField(String, Object) and writeBinary(byte[]) (wrapped form by default; bare base64 under showTypeInfoNever(), round-tripping via java-util 4.103.0's MapConversions.toByteArray).
• JsonIo.formatJson reimplemented as a parse-and-re-emit pipeline through JsonTokenizer + JsonGenerator — output now byte-identical to toJson(prettyPrint=true); the 214-LOC JsonPrettyPrinter is deleted. New formatJson(String, WriteOptions) overload; throws JsonIoException on parse failure.
• JsonClassWriter gains a Jackson-aligned, JsonGenerator-based emission API — retires custom writers' direct dependence on java.io.Writer (the Writer-taking forms are @Deprecated for removal in 5.0). All 19 built-in writers migrated; Writer-based forms retained as bridge delegates.
• Directional Jackson-aligned ignore controls — @IoProperty(access = WRITE_ONLY|READ_ONLY), @IoIgnoreProperties(allowGetters/allowSetters), plus directional field-exclusion aliases on ReadOptionsBuilder/WriteOptionsBuilder.
• New TOON ReadOptions — toonExpandPaths(boolean) (spec §13.4 dotted-key path expansion) and toonIndentSize(int), each with permanent siblings.

Performance

• JsonIo.createTokenizer(...) caches the default ReadOptions instead of building a fresh one per null-options call, and borrows FastReader buffers from the thread-local recycler. java-json-benchmark stream-deser of Users JSON vs Jackson: 1KB 34.5x → 1.96x, 10KB 7.09x → 1.46x (faster than Gson).
• Primitive-field reads in Accessor no longer autobox — a VarHandle bound into an XGetter lambda per primitive type (gated by JDK ≥ 9; JDK 8 source-compat preserved). Integer/Double wrappers from Accessor.retrieve eliminated, Long reduced ~80%.
• CharStreamTokenizer number parsing writes directly into typed instance fields and no longer eagerly stringifies tokens (lazy getText()). Median-of-3: Maps Read -5.7%, POJO Read -16.3%.
• Typed primitive-array inline-write loops in ToonWriter (~3-7% ratio improvement); SIMD char-array cache-verify via java-util's VectorizedArrays.equalsRange; writeImpl narrow snap+restore (~2-3% Write improvement).

Refactor

• JsonWriter dog-food migration complete — structural emission ({/}/[/]/separators/indents/@id/@type/@ref/@items/@keys) now fully driven through CharStreamGenerator's state machine; the parallel contextStack machine is eliminated. Net ~-200 LOC. Behavior changes: writeStringField's legacy "always emit leading comma" removed (gen auto-decides, matching Jackson); pretty-print name: value spacing normalized to Jackson convention.
• Extracted JsonTokenizer (Jackson-style cursor API) and CharStreamTokenizer from JsonParser (shrinks ~1,590 → ~590 lines).

Correctness

... (truncated)

Changelog

Sourced from com.cedarsoftware:json-io's changelog.

4.105.0 - 2026-06-13

• BUILD: Runtime dependency java-util 4.103.0 → 4.105.0. Test-scope jackson-databind 2.21.3 → 2.22.0; maven-surefire-plugin 3.5.5 → 3.5.6.
• PERFORMANCE: CharSegmentWriter — JsonIo.toJson/toToon materialize their result through a segmented char[] writer instead of a StringBuilder, dropping per-append capacity/coder checks, growth copies, and the latin1→UTF-16 inflation any non-Latin-1 payload forced mid-write (Jackson's SegmentedStringWriter design). JSON Write 1.91x → 1.70x / 1.72x → 1.53x (cycle on/off) vs Jackson; TOON Write 1.72x → 1.47x / 1.60x → 1.40x.
• PERFORMANCE: CharStreamTokenizer / ToonReader replace a CharBufScratch ThreadLocal borrow in their cache-verify step with a per-instance 64-char scratch field (both are per-parse, single-threaded). JSON Read 1.67x → 1.62x, TOON Read 1.78x → 1.73x.
• PERFORMANCE: ClassValueSet/ClassValueMap replace hash-probe sets for the class-keyed lookups isForceType consults (Primitives, CONVERTABLE_TYPES, NUMERIC_PRIMITIVES_FOR_COMPACT, NATURAL_DEFAULTS). Combined with the escape-free string path, JSON Write 1.71x → 1.67x / 1.56x → 1.53x.
• PERFORMANCE: FastIsoParser — read-side String→java.time conversion tries a strict java.time parse before the Converter→DateUtilities regex path (which re-parsed the ISO-8601 strings json-io itself writes); non-ISO formats fall back unchanged. JSON Read 1.82x → 1.67x, TOON Read 1.88x → 1.78x.
• PERFORMANCE: JsonGenerator.writeStringUnescaped (package-private: quote + bulk write + quote, no escape scan) is used by built-in writers whose output can never need escaping — the java.time family, Date/Timestamp/Calendar, UUID, BigInteger, BigDecimal, Currency, Locale. Format-pattern paths keep escaping.
• PERFORMANCE: ToonWriter emits java.time values via the TemporalChars emitters rather than Converter→DateTimeFormatter (new ISO_ZONED_DATE_TIME variant, parity-pinned), and MapResolver gains the typed path's strict-ISO FastIsoParser hook. TOON Write 1.49x → 1.32x / 1.39x → 1.20x, TOON Read 1.75x → 1.70x.
• PERFORMANCE: WriteFieldPlan memoizes its isForceType result per runtime class (fields are overwhelmingly monomorphic) and ToonWriter.writeInlineValue gains isPrimitive's instanceof fast paths, removing repeated class-keyed probes and a double ClassValue dispatch per element. JSON Write 1.59x → 1.49x / 1.45x → 1.36x, TOON Write 1.55x → 1.41x / 1.40x → 1.30x.
• PERFORMANCE: writeJsonUtf8String scans the String directly and emits safe runs as slices (one String.getChars into the sink, no CharBufScratch staging copy); new hand-rolled TemporalChars ISO emitters replace DateTimeFormatter in the java.time writers, with a formatter fallback for years outside 0..9999 and byte-for-byte parity verified. JSON Write 1.65x → 1.59x / 1.51x → 1.45x.

4.103.0 - 2026-05-25

• BUG FIX: JsonGenerator.deprecatedWriterBridge_* factories tolerate a null WriteOptions argument (fall back to defaults), preserving the legacy Writer-based custom-writer API contract for delegate-pattern migrations.
• BUILD: Runtime dependency java-util 4.102.0 → 4.103.0. Test-scope dependency bumps: root pom (junit-jupiter 5.14.3 → 5.14.4, maven-resources-plugin 3.4.0 → 3.5.0, jacoco-maven-plugin 0.8.12 → 0.8.14) and Spring stack (spring-boot 3.5.11 → 3.5.14, spring-web 6.2.16 → 6.2.18, reactor-test 3.7.16 → 3.7.18, spring-ai-model 1.1.2 → 1.1.7 across json-io-spring and json-io-spring-ai).
• CLEANUP: Removed CharStreamGenerator.restoreDepthAfterExternalValue + 15 call sites + 8 unused bodyDepth locals across JsonWriter element loops (-51 LOC). The narrow restore became redundant once all three remaining resetForBridgeAtValueSlot paths (writeCustom × 2 + writePrimitive Long-wrap bare-value) got their own narrow snap+restore pairs that fully restore depth.
• CLEANUP: Removed dead Resolver.determineFactoryType(JsonObject, Class) — private method with zero callers, artifact of a factory-dispatch refactor.
• CLEANUP: Removed dead getJsonGenerator() accessor + stale final Writer output = this.out; locals in writeCollection/writeJsonObjectCollection (leftover scaffolding from the dog-food migration). Updated stale Javadoc on gen.
• CLEANUP: Category-A lint sweep on JsonWriter.java — 3 unused imports, 2 redundant locals, 2 dangling javadocs, paragraph-break javadoc fixes in getTypeNameForOutput/shouldShowTypeForElement.
• CORRECTNESS: CharStreamTokenizer strict mode now rejects trailing-decimal numbers (1., 1.e2) per RFC 8259's frac = "." 1*DIGIT rule. Previously strictJson mode silently accepted because Double.parseDouble("1.") returns 1.0. Non-strict (JSON5/lenient) mode still accepts.
• CORRECTNESS: CharStreamTokenizer.getBooleanValue() / getNumberType() now throw JsonIoException on the wrong token type instead of silently returning stale typed-field state (which could leak the value from a prior token of the right type).
• CORRECTNESS: CharStreamTokenizer.getIntValue() / getLongValue() enforce overflow contracts matching Jackson's ParserBase semantics — overflow / NaN / Infinity throw JsonIoException; fractional parts of in-range doubles truncate like Java's (int) cast. Previously the LONG → int branch silently truncated and the BigInteger/BigDecimal branches were stricter than Jackson.
• CORRECTNESS: CharStreamTokenizer.nextToken() now clears currentToken to null on the EOF transition (the Javadoc said it would, the implementation didn't).
• CORRECTNESS: CharStreamGenerator.writeFieldName / writeKey always emits keys as unquoted JSON5 identifier OR double-quoted — never single-quoted, even with json5SmartQuotes. Aligns gen with JsonWriter and Jackson convention. Smart-quote logic still applies to string values.
• CORRECTNESS: CharStreamGenerator.writeNumber(double|float) permits NaN/Infinity/-Infinity literals when EITHER allowNanAndInfinity OR json5InfinityNaN is true. Previously only respected the first flag; fixes mismatch with JsonWriter.isNanInfinityAllowed().
• CORRECTNESS: CharStreamGenerator.writeString applies the same smart quote-style selection as JsonWriter.writeStringValue under json5SmartQuotes (single quotes only when the string contains " but not '). Previously emitted single-quoted unconditionally.
• CORRECTNESS: TOON read/write brought into full conformance with the toonformat.dev v3.3 spec — the complete upstream fixture suite now passes. User-visible changes: uniform-Map arrays emit in tabular form (header + rows); Long-overflow literals decode as BigInteger instead of silently truncating; quoted strings decode \uXXXX escapes; leading-zero forms (007) decode as strings; bare-hyphen lines decode as empty objects; tabular header keys are quote-aware. New ToonSpecFixtureTest runs the vendored fixtures (refreshable via scripts/refresh-toon-fixtures.sh).
• DOCUMENTATION: JsonTokenizer.getText() Javadoc clarified for numeric tokens — returns the canonical form (Long.toString/Double.toString/etc.), not the raw source lexeme. 1e2 reads back as "100.0", 1.2300 as "1.23", 0xFF as "255".
• DOCUMENTATION: Cleaned up 8 latent mvn javadoc:javadoc warnings — the json-io main module now produces zero Javadoc warnings on clean build.
• FEATURE: Streaming-write API — JsonGenerator (Jackson-aligned cursor-style serializer). New JsonIo.createGenerator(Writer|OutputStream) factories return a JsonGenerator for hand-rolled streaming output. Method set mirrors Jackson's com.fasterxml.jackson.core.JsonGenerator: writeStartObject/writeEndObject/writeStartArray/writeEndArray/writeFieldName, scalar writeString/writeNumber/writeBoolean/writeNull, raw writeRaw/writeRawValue, convenience writeStringField/writeNumberField/etc., and copyCurrentEvent/copyCurrentStructure bridges for parse → transform → emit pipelines. Fluent return on every write. 57 new tests.
• FEATURE: Identity-map sharing across JsonGenerator.writeObject calls. The same instance passed multiple times emits as @id once and {"@ref":N} thereafter — preserving graph identity across multiple top-level emits. Active under cycleSupport(true) (default).
• FEATURE: JsonGenerator.writeObject(Object) — Jackson-aligned databind entry point. Drives the same code path as JsonIo.toJson (cycle tracking, @id/@ref, custom-writer dispatch, @type policy), so a POJO can be embedded inside a streaming sequence with one call. Honors the active ShowType policy.
• FEATURE: JsonGenerator.writeObjectField(String, Object) — convenience for writeFieldName(name) + writeObject(value), mirroring the writeStringField/writeNumberField/writeBooleanField family.
• FEATURE: JsonGenerator.writeBinary(byte[]) (and slice overload). Default modes emit the wrapped form {"@type":"byte[]","value":"<base64>"}; under showTypeInfoNever() emits bare base64 matching Jackson. Round-trips via java-util's smart String → byte[] detection and the new MapConversions.toByteArray. ObjectResolver routes wrapped-form JsonObjects (value/_v key) through Converter BEFORE recursive resolution, so primitive-array wrapped forms reach MapConversions correctly.
• FEATURE: JsonIo.formatJson reimplemented as a parse-and-re-emit pipeline through JsonTokenizer + JsonGenerator. The 214-LOC JsonPrettyPrinter character-shuffler is deleted; formatJson now produces output byte-identical to JsonIo.toJson(prettyPrint=true). New formatJson(String, WriteOptions) overload accepts custom options. JsonIoException thrown on parse failure (the old path silently passed through malformed input).
• FEATURE: CharStreamGenerator pretty-print follows Jackson convention — scalar values stay on the same line as their field name ("name": "value"); only object/array openings and array elements get newline+indent. Behavior change in pretty-print mode; compact output unchanged.
• FEATURE: JsonClassWriter gains a Jackson-aligned, JsonGenerator-based emission API — retires custom writers' direct dependence on java.io.Writer. Two new default methods on the interface; the Writer-taking forms are @Deprecated for removal in 5.0. All 19 built-in writers in the writers/ package + the writer hierarchies in Writers.java migrated; Writer-based forms retained as bridge-generator delegates for super.write*() chaining from user subclasses. Framework dispatch caches per-class which overload each writer overrode (via a ClassValueMap). Optional/OptionalInt/OptionalLong/OptionalDouble writers gain Jackson-policy-aware NaN/Infinity handling as a bonus fix.
• FEATURE: Directional Jackson-aligned ignore controls — @IoProperty(access = WRITE_ONLY|READ_ONLY) accepts the field on one side only; @IoIgnoreProperties gains allowGetters/allowSetters escapes. Mirrors Jackson's @JsonProperty(access) and @JsonIgnoreProperties semantics. @IoIgnore and zero-arg @IoIgnoreProperties remain the both-sides shortcuts.
• FEATURE: Directional field-exclusion aliases on ReadOptionsBuilder / WriteOptionsBuilder — Jackson-named (Java-bean) and unambiguous (JSON-direction) aliases now exist for the permanent and per-instance methods (addPermanentWriteOnlyField / addPermanentDeserializeOnlyField / addPermanentExcludedField; symmetric on the read side). All delegate to the same internal map; pick whichever reads more clearly. Also fixes a pre-existing aliasing bug that mutated the BASE permanent-state Set.
• FEATURE: New CharStreamGenerator package-private helpers — writeSeparator() (fused , + newline+indent for legacy element loops), writeNewlineIndent() (depth-driven indent), writeFieldNameRaw(String) (precomputed key+colon fast-path), writeStringFieldUnescaped(name, value) (caller-guarantees-no-escape fast path), writeStartXxxRaw / writeEndXxxRaw family (structural-token fast paths).
• FEATURE: New TOON ReadOptions — toonExpandPaths(boolean) for opt-in spec §13.4 dotted-key path expansion (default off, preserves literal dotted keys); toonIndentSize(int) for custom decoder indent width when the document uses non-default indentation. Both ship with permanent (JVM-lifetime) siblings: ReadOptionsBuilder.addPermanentToonExpandPaths(boolean) and addPermanentToonIndentSize(int).
• PERFORMANCE: Primitive-field reads in Accessor no longer autobox. The primitive-lambda fast path was silently dead since introduction — LambdaMetafactory rejects getField MethodHandle kinds. Now a VarHandle bound into an XGetter lambda per primitive type (gated by JDK ≥ 9 via reflective access; JDK 8 source-compat preserved). JFR allocation impact: Integer wrappers from Accessor.retrieve eliminated, Double eliminated, Long reduced ~80%.
• PERFORMANCE: Typed primitive-array inline-write loops in ToonWriter. writeArrayElements dispatches to dedicated typed loops when the array's component type is primitive (int/long/double/float/short/byte/boolean), reading directly from the typed array instead of routing through ArrayUtilities.getPrimitiveElement + writeInlineValue (which allocated a wrapper per element). Output byte-identical. ~1.8 GB Integer + portion of ~2.4 GB Long boxing eliminated from the toon-write workload; ~3-7% real ratio improvement.
• PERFORMANCE: JsonIo.createTokenizer(...) caches the default ReadOptions (lazy-init volatile) instead of building a fresh one per call when the caller passes null. java-json-benchmark stream-deser of Users JSON vs Jackson: 1KB 34.5x → 1.96x, 10KB 7.09x → 1.46x (faster than Gson). Tokenizer also borrows FastReader buffers from the existing thread-local BUFFER_RECYCLER (released on close), eliminating a 128 KB young-gen allocation per parse.
• PERFORMANCE: CharStreamTokenizer — number parsing writes directly into typed instance fields (longValue/doubleValue/numberType) instead of routing through a boxed Number. Eliminates 2 boxes + 1 unbox per parsed number. Median-of-3 JsonPerformanceTest: Maps Read -3.3% (1.97x → 1.91x Jackson); POJO Read -2.7% (1.38x → 1.34x).
• PERFORMANCE: CharStreamTokenizer.emitNumber() no longer eagerly stringifies parsed numeric tokens into currentText — the JSON value path consults the typed getters directly. A new ensureNumericText() helper materializes lazily on getText() / getTextLength(). Median-of-3: Maps Read -5.7% (2.13x → 1.99x); POJO Read -16.3% (1.59x → 1.38x).
• PERFORMANCE: JsonWriter.writeImpl wrapper's snap+restore replaced with narrow per-path snap+restore + trailing gen.markValue() — ~2-3% Write Ratio improvement. Body-method destructive resets removed across 10 sites; only the 3 legitimate reset paths (writeCustom × 2 + writePrimitive Long-wrap bare-value) keep their own narrow snap+restore.
• PERFORMANCE: Digit-pair integer-to-chars conversion moved from JsonWriter.writeLongDirect/writeIntDirect into CharStreamGenerator.writeLongRaw(long) / writeIntRaw(int). CharStreamGenerator.writeNumber(int|long) now uses the algorithm directly (eliminating per-call Integer.toString/Long.toString allocation for all external JsonGenerator consumers). -117 LOC in JsonWriter.
• PERFORMANCE: Cache-verify loops in ToonReader.cacheSubstringFromBuf and CharStreamTokenizer.cacheStringFromChars now bulk-extract the cached String via CharBufScratch.getChars (SIMD-optimized String.getChars intrinsic), then compare char[] vs char[] via java-util 4.103.0's VectorizedArrays.equalsRange (which dispatches to JDK 9+'s SIMD Arrays.equals intrinsic). Cache-hit path drops from 2.06% → 1.33% of CPU samples in JFR.
• PERFORMANCE: CharStreamTokenizer.readUnquotedIdentifier routes through the per-tokenizer string cache, so repeated JSON5 unquoted identifiers intern to the same String instance.
• PERFORMANCE: JsonParser.readJsonObject skips the substitutes HashMap probe for full @-keys (@type/@id/@items/@keys/@ref/@enum) — the map only holds @x short forms (length 2) and $-prefixed forms, so a single-char gate eliminates the lookup on every @-keyed field.

... (truncated)

Commits

• fd47e02 Release: json-io 4.105.0 (skips 4.104.0)
• a5f6f2e Doc: express 4.104.0 changelog perf gains as ratio transitions
• e40c977 Doc: tighten 4.104.0 changelog to prior-release brevity + alphabetize
• 1b2d371 Performance: temporal fast paths for TOON write and maps-mode read
• 5d63d2b Performance: class-classification caching on the write hot path
• c846960 Performance: string-emission fast paths in the write pipeline
• c7d3a61 Doc: refresh README performance table for 4.104.0
• bed2606 Performance: per-instance string-cache scratch in both readers
• 71afbc3 Performance: strict-ISO-first temporal parsing on the read side
• 8c13f0a Performance: escape-free string fast path + ClassValue classification
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)