to_bson() silently emits corrupt documents when a length exceeds INT32_MAX (#5314)

.github/SECURITY.md

@@ -15,6 +15,14 @@ guidance.
 
 For vulnerabilities in third-party dependencies or modules, please report them directly to the respective maintainers.
 
+## Unofficial packages
+
+This project does not publish an official npm package. The npm package
+[`nlohmann-json`](https://www.npmjs.com/package/nlohmann-json) (or similarly named packages) is not maintained or
+endorsed by this project. See the
+[package managers documentation](https://json.nlohmann.me/integration/package_managers/#npm) for supported
+integration options.
+
 ## Additional Resources
 
 - Explore security-related topics and contribute to tools and projects through

.github/workflows/check_amalgamation.yml

@@ -39,14 +39,14 @@ jobs:
           egress-policy: audit
 
       - name: Checkout pull request
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           path: main
           ref: ${{ github.event.pull_request.head.sha }}
           persist-credentials: false
 
       - name: Checkout tools
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           path: tools
           ref: develop

.github/workflows/codeql-analysis.yml

@@ -32,20 +32,20 @@ jobs:
         egress-policy: audit
 
     - name: Checkout repository
-      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         persist-credentials: false
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
+      uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1
       with:
         languages: c-cpp
 
     # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
+      uses: github/codeql-action/autobuild@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
+      uses: github/codeql-action/analyze@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1

.github/workflows/dependency-review.yml

@@ -22,7 +22,7 @@ jobs:
           egress-policy: audit
 
       - name: 'Checkout Repository'
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: 'Dependency Review'

.github/workflows/flawfinder.yml

@@ -32,7 +32,7 @@ jobs:
           egress-policy: audit
 
       - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
@@ -43,6 +43,6 @@ jobs:
           output: 'flawfinder_results.sarif'
 
       - name: Upload analysis results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
+        uses: github/codeql-action/upload-sarif@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1
         with:
           sarif_file: ${{github.workspace}}/flawfinder_results.sarif

.github/workflows/macos.yml

@@ -26,7 +26,7 @@ jobs:
       DEVELOPER_DIR: /Applications/Xcode_${{ matrix.xcode }}.app/Contents/Developer
 
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Run CMake
@@ -45,7 +45,7 @@ jobs:
       DEVELOPER_DIR: /Applications/Xcode_${{ matrix.xcode }}.app/Contents/Developer
 
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Run CMake
@@ -62,7 +62,7 @@ jobs:
         standard: [11, 14, 17, 20, 23, 26]
 
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Run CMake

.github/workflows/publish_documentation.yml

@@ -31,7 +31,7 @@ jobs:
         with:
           egress-policy: audit
 
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install virtual environment
         run: make install_venv -C docs/mkdocs

.github/workflows/scorecards.yml

@@ -41,7 +41,7 @@ jobs:
           egress-policy: audit
 
       - name: "Checkout code"
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
@@ -76,6 +76,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
+        uses: github/codeql-action/upload-sarif@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1
         with:
           sarif_file: results.sarif

.github/workflows/semgrep.yml

@@ -37,7 +37,7 @@ jobs:
           egress-policy: audit
 
       # Checkout project source
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
@@ -61,7 +61,7 @@ jobs:
 
       # Upload SARIF file generated in previous step
       - name: Upload SARIF file
-        uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
+        uses: github/codeql-action/upload-sarif@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1
         with:
           sarif_file: semgrep.sarif
         if: always()

.github/workflows/ubuntu.yml

@@ -21,11 +21,11 @@ jobs:
     runs-on: ubuntu-latest
     container: gcc:latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Get latest CMake and ninja
-        uses: lukka/get-cmake@f5b8fbb4d77cec1acc5a5f9f0df4beffaf5d98d9 # v4.3.4
+        uses: lukka/get-cmake@e6906078ebd1ccb8ce51ab4626ac46a1b5a517e3 # v4.4.0
       - name: Run CMake
         run: cmake -S . -B build -DJSON_CI=On
       - name: Build
@@ -43,11 +43,11 @@ jobs:
         run: |
           wget -q -O - "https://github.com/facebook/infer/releases/download/v1.3.0/infer-linux-x86_64-v1.3.0.tar.xz" | sudo tar -C /opt -xJ
           sudo ln -s /opt/infer-linux-x86_64-v1.3.0/bin/infer /usr/local/bin/infer
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Get latest CMake and ninja
-        uses: lukka/get-cmake@f5b8fbb4d77cec1acc5a5f9f0df4beffaf5d98d9 # v4.3.4
+        uses: lukka/get-cmake@e6906078ebd1ccb8ce51ab4626ac46a1b5a517e3 # v4.4.0
       - name: Run CMake
         run: cmake -S . -B build -DJSON_CI=On
       - name: Build
@@ -66,11 +66,11 @@ jobs:
 
       - name: Install Valgrind
         run: sudo apt-get update ; sudo apt-get install -y valgrind
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Get latest CMake and ninja
-        uses: lukka/get-cmake@f5b8fbb4d77cec1acc5a5f9f0df4beffaf5d98d9 # v4.3.4
+        uses: lukka/get-cmake@e6906078ebd1ccb8ce51ab4626ac46a1b5a517e3 # v4.4.0
       - name: Run CMake
         run: cmake -S . -B build -DJSON_CI=On
       - name: Build
@@ -85,11 +85,11 @@ jobs:
     steps:
       - name: Install git, clang-tools, iwyu (ci_single_binaries), and unzip
         run: apt-get update ; apt-get install -y git clang-tools iwyu unzip
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Get latest CMake and ninja
-        uses: lukka/get-cmake@f5b8fbb4d77cec1acc5a5f9f0df4beffaf5d98d9 # v4.3.4
+        uses: lukka/get-cmake@e6906078ebd1ccb8ce51ab4626ac46a1b5a517e3 # v4.4.0
       - name: Run CMake
         run: cmake -S . -B build -DJSON_CI=On
       - name: Build
@@ -104,11 +104,11 @@ jobs:
     steps:
       - name: Install build-essential
         run: apt-get update ; apt-get install -y build-essential unzip wget git libssl-dev
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Get latest CMake and ninja
-        uses: lukka/get-cmake@f5b8fbb4d77cec1acc5a5f9f0df4beffaf5d98d9 # v4.3.4
+        uses: lukka/get-cmake@e6906078ebd1ccb8ce51ab4626ac46a1b5a517e3 # v4.4.0
       - name: Run CMake
         run: cmake -S . -B build -DJSON_CI=On
       - name: Build
@@ -122,7 +122,7 @@ jobs:
         with:
           egress-policy: audit
 
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Install dependencies and de_DE locale
@@ -163,7 +163,15 @@ jobs:
           export DEBIAN_FRONTEND=noninteractive
           apt-get update
           apt-get install -y --no-install-recommends software-properties-common ca-certificates gnupg make git
-          add-apt-repository -y ppa:ubuntu-toolchain-r/test
+          # add-apt-repository resolves the PPA through the Launchpad API,
+          # which intermittently times out or fails the team lookup (the plain
+          # "deb ..." sources below never hit Launchpad and never flake).
+          # Retry with backoff so a transient Launchpad blip does not fail CI.
+          for attempt in 1 2 3 4 5; do
+            add-apt-repository -y ppa:ubuntu-toolchain-r/test && break
+            echo "::warning::add-apt-repository ppa:ubuntu-toolchain-r/test failed (attempt ${attempt}/5); retrying"
+            sleep $((attempt * 10))
+          done
           apt-add-repository -y "deb http://archive.ubuntu.com/ubuntu/ bionic main"
           apt-add-repository -y "deb http://archive.ubuntu.com/ubuntu/ bionic universe"
           apt-add-repository -y "deb http://archive.ubuntu.com/ubuntu/ xenial main"
@@ -172,11 +180,11 @@ jobs:
           apt-add-repository -y "deb http://archive.ubuntu.com/ubuntu/ xenial-updates universe"
           apt-get update
           apt-get install -y --no-install-recommends g++-${{ matrix.compiler }}
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Get latest CMake and ninja
-        uses: lukka/get-cmake@f5b8fbb4d77cec1acc5a5f9f0df4beffaf5d98d9 # v4.3.4
+        uses: lukka/get-cmake@e6906078ebd1ccb8ce51ab4626ac46a1b5a517e3 # v4.4.0
       - name: Run CMake
         run: CXX=g++-${{ matrix.compiler }} cmake -S . -B build -DJSON_CI=On
       - name: Build
@@ -190,11 +198,11 @@ jobs:
         compiler: ['7', '8', '9', '10', '11', '12', '13', '14', '15', 'latest']
     container: gcc:${{ matrix.compiler }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Get latest CMake and ninja
-        uses: lukka/get-cmake@f5b8fbb4d77cec1acc5a5f9f0df4beffaf5d98d9 # v4.3.4
+        uses: lukka/get-cmake@e6906078ebd1ccb8ce51ab4626ac46a1b5a517e3 # v4.4.0
       - name: Run CMake
         run: cmake -S . -B build -DJSON_CI=On
       - name: Build
@@ -207,11 +215,11 @@ jobs:
         compiler: ['3.4', '3.5', '3.6', '3.7', '3.8', '3.9', '4', '5', '6', '7', '8', '9', '10', '11', '12', '13', '14', '15-bullseye', '16', '17', '18', '19', '20', 'latest']
     container: silkeh/clang:${{ matrix.compiler }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Get latest CMake and ninja
-        uses: lukka/get-cmake@f5b8fbb4d77cec1acc5a5f9f0df4beffaf5d98d9 # v4.3.4
+        uses: lukka/get-cmake@e6906078ebd1ccb8ce51ab4626ac46a1b5a517e3 # v4.4.0
       - name: Set env FORCE_STDCPPFS_FLAG for clang 7 / 8 / 9 / 10
         run: echo "JSON_FORCED_GLOBAL_COMPILE_OPTIONS=-DJSON_HAS_FILESYSTEM=0;-DJSON_HAS_EXPERIMENTAL_FILESYSTEM=0" >> "$GITHUB_ENV"
         if: ${{ matrix.compiler == '7' || matrix.compiler == '8' || matrix.compiler == '9' || matrix.compiler == '10' }}
@@ -227,11 +235,11 @@ jobs:
       matrix:
         standard: [11, 14, 17, 20, 23, 26]
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Get latest CMake and ninja
-        uses: lukka/get-cmake@f5b8fbb4d77cec1acc5a5f9f0df4beffaf5d98d9 # v4.3.4
+        uses: lukka/get-cmake@e6906078ebd1ccb8ce51ab4626ac46a1b5a517e3 # v4.4.0
       - name: Run CMake
         run: cmake -S . -B build -DJSON_CI=On
       - name: Build
@@ -247,11 +255,11 @@ jobs:
     steps:
       - name: Install git and unzip
         run: apt-get update ; apt-get install -y git unzip
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Get latest CMake and ninja
-        uses: lukka/get-cmake@f5b8fbb4d77cec1acc5a5f9f0df4beffaf5d98d9 # v4.3.4
+        uses: lukka/get-cmake@e6906078ebd1ccb8ce51ab4626ac46a1b5a517e3 # v4.4.0
       - name: Run CMake
         run: cmake -S . -B build -DJSON_CI=On
       - name: Build with libc++
@@ -274,11 +282,11 @@ jobs:
         cuda: ['11.8.0', '12.1.1', '12.6.3']
     container: nvidia/cuda:${{ matrix.cuda }}-devel-ubuntu22.04
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Get latest CMake and ninja
-        uses: lukka/get-cmake@f5b8fbb4d77cec1acc5a5f9f0df4beffaf5d98d9 # v4.3.4
+        uses: lukka/get-cmake@e6906078ebd1ccb8ce51ab4626ac46a1b5a517e3 # v4.4.0
       - name: Run CMake
         run: cmake -S . -B build -DJSON_CI=On
       - name: Build
@@ -291,14 +299,14 @@ jobs:
     runs-on: ubuntu-latest
     container: ${{ matrix.container }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       # The module test uses `import std;`, which needs CMake's experimental
       # import-std support. Its opt-in token is CMake-version-specific, so pin
       # CMake to the version whose token is set in tests/module_cpp20/CMakeLists.txt.
       - name: Get pinned CMake and ninja
-        uses: lukka/get-cmake@f5b8fbb4d77cec1acc5a5f9f0df4beffaf5d98d9 # v4.3.4
+        uses: lukka/get-cmake@e6906078ebd1ccb8ce51ab4626ac46a1b5a517e3 # v4.4.0
         with:
           cmakeVersion: 4.3.4
       # Clang: the std library module is provided by libc++ (the image's libstdc++
@@ -320,11 +328,11 @@ jobs:
     # Intel's own last officially published image that still includes it.
     container: intel/oneapi-hpckit:2023.2.1-devel-ubuntu22.04
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Get latest CMake and ninja
-        uses: lukka/get-cmake@f5b8fbb4d77cec1acc5a5f9f0df4beffaf5d98d9 # v4.3.4
+        uses: lukka/get-cmake@e6906078ebd1ccb8ce51ab4626ac46a1b5a517e3 # v4.4.0
       - name: Run CMake
         run: cmake -S . -B build -DJSON_CI=On
       - name: Build
@@ -337,9 +345,9 @@ jobs:
     runs-on: ubuntu-latest
     container: intel/oneapi-hpckit:latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Get latest CMake and ninja
-        uses: lukka/get-cmake@f5b8fbb4d77cec1acc5a5f9f0df4beffaf5d98d9 # v4.3.4
+        uses: lukka/get-cmake@e6906078ebd1ccb8ce51ab4626ac46a1b5a517e3 # v4.4.0
       - name: Run CMake
         run: cmake -S . -B build -DJSON_CI=On
       - name: Build
@@ -349,9 +357,9 @@ jobs:
     runs-on: ubuntu-latest
     container: nvcr.io/nvidia/nvhpc:25.5-devel-cuda12.9-ubuntu22.04
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Get latest CMake and ninja
-        uses: lukka/get-cmake@f5b8fbb4d77cec1acc5a5f9f0df4beffaf5d98d9 # v4.3.4
+        uses: lukka/get-cmake@e6906078ebd1ccb8ce51ab4626ac46a1b5a517e3 # v4.4.0
       - name: Run CMake
         run: cmake -S . -B build -DJSON_CI=On
       - name: Build
@@ -367,11 +375,11 @@ jobs:
 
       - name: Install emscripten
         uses: mymindstorm/setup-emsdk@4528d102f7230f0e7b276855c01ea1159be0e984 # v16
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Get latest CMake and ninja
-        uses: lukka/get-cmake@f5b8fbb4d77cec1acc5a5f9f0df4beffaf5d98d9 # v4.3.4
+        uses: lukka/get-cmake@e6906078ebd1ccb8ce51ab4626ac46a1b5a517e3 # v4.4.0
       - name: Run CMake
         run: cmake -S . -B build -DCMAKE_TOOLCHAIN_FILE=$EMSDK/upstream/emscripten/cmake/Modules/Platform/Emscripten.cmake -GNinja
       - name: Build
@@ -388,7 +396,7 @@ jobs:
         with:
           egress-policy: audit
 
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Run CMake

.github/workflows/windows.yml

@@ -24,7 +24,7 @@ jobs:
         architecture: [x64, x86]
 
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Set up MinGW
@@ -49,7 +49,7 @@ jobs:
     runs-on: windows-2022
 
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Set extra CXX_FLAGS for latest std_version
@@ -86,9 +86,9 @@ jobs:
     runs-on: windows-2025
 
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Get latest CMake and ninja
-        uses: lukka/get-cmake@f5b8fbb4d77cec1acc5a5f9f0df4beffaf5d98d9 # v4.3.4
+        uses: lukka/get-cmake@e6906078ebd1ccb8ce51ab4626ac46a1b5a517e3 # v4.4.0
       - name: Set extra CXX_FLAGS for latest std_version
         # /wd5285 silences C5285 emitted by the bundled third-party doctest.h, which
         # specializes std::tuple (newly diagnosed by the VS2026 v145 toolset)
@@ -122,7 +122,7 @@ jobs:
     runs-on: windows-11-arm
 
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Run CMake (Release)
         run: cmake -S . -B build -G "Visual Studio 17 2022" -A ARM64 -DJSON_BuildTests=On -DCMAKE_CXX_FLAGS="/W4 /WX"
         if: matrix.build_type == 'Release'
@@ -143,7 +143,7 @@ jobs:
         version: [11.0.1, 12.0.1, 13.0.1, 14.0.6, 15.0.7, 16.0.6, 18.1.8, 19.1.7, 20.1.8]
 
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Install Clang
@@ -173,7 +173,7 @@ jobs:
         architecture: [Win32, x64]
 
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Run CMake
@@ -186,14 +186,14 @@ jobs:
   ci_module_cpp20:
     runs-on: windows-2022
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       # The module test uses `import std;`, which needs CMake's experimental
       # import-std support. Its opt-in token is CMake-version-specific, so pin
       # CMake to the version whose token is set in tests/module_cpp20/CMakeLists.txt.
       - name: Get pinned CMake and ninja
-        uses: lukka/get-cmake@f5b8fbb4d77cec1acc5a5f9f0df4beffaf5d98d9 # v4.3.4
+        uses: lukka/get-cmake@e6906078ebd1ccb8ce51ab4626ac46a1b5a517e3 # v4.4.0
         with:
           cmakeVersion: 4.3.4
       - name: Run CMake (Debug)

README.md

@@ -90,7 +90,6 @@ You can sponsor this library at [GitHub Sponsors](https://github.com/sponsors/nl
 - [Steve Sperandeo](https://github.com/homer6)
 - [Robert Jefe Lindstädt](https://github.com/eljefedelrodeodeljefe)
 - [Steve Wagner](https://github.com/ciroque)
-- [Lion Yang](https://github.com/LionNatsu)
 
 ### Further support
 

docs/mkdocs/docs/api/basic_json/dump.md

@@ -43,6 +43,17 @@ Strong guarantee: if an exception is thrown, there are no changes to any JSON va
 Throws [`type_error.316`](../../home/exceptions.md#jsonexceptiontype_error316) if a string stored inside the JSON value
 is not UTF-8 encoded and `error_handler` is set to `strict`
 
+!!! warning "Serializing untrusted input"
+
+    When serializing values that may contain invalid or untrusted UTF-8 (e.g., bytes taken directly from network
+    input), `dump()` throws [`type_error.316`](../../home/exceptions.md#jsonexceptiontype_error316) in the default
+    `strict` mode. To serialize such data without throwing, pass
+    [`error_handler_t::replace`](error_handler_t.md) (substitutes U+FFFD) or
+    [`error_handler_t::ignore`](error_handler_t.md). Callers that serialize untrusted input on a crash-sensitive path
+    should either choose a non-strict error handler or wrap `dump()` in a `#!cpp try`/`#!cpp catch`.
+
+    See the [FAQ](../../home/faq.md#serializing-untrusted-or-invalid-utf-8) for details.
+
 ## Complexity
 
 Linear.

docs/mkdocs/docs/api/basic_json/to_bson.md

@@ -40,6 +40,9 @@ Strong guarantee: if an exception is thrown, there are no changes in the JSON va
   is not an object; example: `"to serialize to BSON, top-level type must be object, but is string"`
 - Throws [`out_of_range.409`](../../home/exceptions.md#jsonexceptionout_of_range409) if a key in the JSON object contains
   a null byte (code point U+0000); example: `"BSON key cannot contain code point U+0000 (at byte 2)"`
+- Throws [`out_of_range.412`](../../home/exceptions.md#jsonexceptionout_of_range412) if the length of a document, array,
+  string, or binary value exceeds the range of the 32-bit BSON length field; example:
+  `"BSON length 2147483661 exceeds maximum of 2147483647"`
 
 ## Complexity
 

docs/mkdocs/docs/home/exceptions.md

@@ -898,6 +898,22 @@ A JSON Patch `add` operation cannot be applied because the target location's par
 
     This exception was added in version 3.13.0. Before that, this situation hit an internal assertion (aborting the program in debug builds) or was silently ignored when assertions were disabled.
 
+### json.exception.out_of_range.412
+
+BSON stores the length of documents, arrays, strings, and binary values in a signed 32-bit integer. This exception is thrown when a value is too large to be described by such a length field.
+
+!!! failure "Example message"
+
+    ```
+    BSON length 2147483661 exceeds maximum of 2147483647
+    ```
+
+!!! note
+
+    This exception was added in version 3.13.0. Before that, the length was silently truncated, and
+    [`to_bson`](../api/basic_json/to_bson.md) produced documents with negative length prefixes that
+    [`from_bson`](../api/basic_json/from_bson.md) rejected.
+
 ## Further exceptions
 
 This exception is thrown in case of errors that cannot be classified with the

docs/mkdocs/docs/home/faq.md

@@ -194,6 +194,27 @@ The library uses `std::numeric_limits<number_float_t>::digits10` (15 for IEEE `d
 
 See [this section](../features/types/number_handling.md#number-serialization) on the library's number handling for more information.
 
+### Serializing untrusted or invalid UTF-8
+
+!!! question "Questions"
+
+    - Why does `dump()` throw when I serialize data that came from the network?
+    - Is CVE-2024-34363 a vulnerability in this library?
+
+Crashes reported against this library that stem from an uncaught
+[`type_error.316`](exceptions.md#jsonexceptiontype_error316) while serializing unvalidated input (e.g.,
+CVE-2024-34363) are a usage issue, not a library vulnerability:
+[`dump()`](../api/basic_json/dump.md) throws in its default `strict` mode because
+[RFC 8259](https://datatracker.ietf.org/doc/html/rfc8259#section-8.1) requires JSON text to be valid UTF-8.
+
+The recommended pattern is to pass a non-strict [`error_handler`](../api/basic_json/error_handler_t.md) or to handle the
+exception:
+
+```cpp
+// replace invalid sequences with U+FFFD instead of throwing
+const auto s = j.dump(-1, ' ', false, json::error_handler_t::replace);
+```
+
 ### Using JSON values with `std::format` or `fmt`
 
 !!! question

docs/mkdocs/docs/home/sponsors.md

@@ -14,6 +14,5 @@ You can sponsor this library at [GitHub Sponsors](https://github.com/sponsors/nl
 - [Steve Sperandeo](https://github.com/homer6)
 - [Robert Jefe Lindstädt](https://github.com/eljefedelrodeodeljefe)
 - [Steve Wagner](https://github.com/ciroque)
-- [Lion Yang](https://github.com/LionNatsu)
 
 Thanks everyone!

docs/mkdocs/docs/integration/package_managers.md

@@ -930,6 +930,12 @@ If you are using [CocoaPods](https://cocoapods.org), you can use the library by
 to your podfile (see [an example](https://bitbucket.org/benman/nlohmann_json-cocoapod/src/master/)). Please file issues
 [here](https://bitbucket.org/benman/nlohmann_json-cocoapod/issues?status=new&status=open).
 
+## npm
+
+This project does not publish an official [npm](https://www.npmjs.com) package. The npm package
+[`nlohmann-json`](https://www.npmjs.com/package/nlohmann-json) (or similarly named packages) is not maintained or
+endorsed by this project. Use one of the package managers listed above, or integrate the single header directly.
+
 ## ESP-IDF and PlatformIO
 
 There is no official package published to the [ESP-IDF Component Registry](https://components.espressif.com) or the

docs/mkdocs/requirements.txt

@@ -2,7 +2,7 @@ wheel==0.47.0
 
 mkdocs==1.6.1                                       # documentation framework
 mkdocs-git-revision-date-localized-plugin==1.5.3    # plugin "git-revision-date-localized"
-mkdocs-material==9.7.6                             # theme for mkdocs
+mkdocs-material==9.7.7                             # theme for mkdocs
 mkdocs-material-extensions==1.3.1                   # extensions
 mkdocs-minify-plugin==0.8.0                         # plugin "minify"
 mkdocs-redirects==1.2.3                             # plugin "redirects"

include/nlohmann/detail/input/binary_reader.hpp

@@ -163,12 +163,39 @@ class binary_reader
     // BSON //
     //////////
 
+    /*!
+    @brief Validate a BSON document's declared size against the bytes read.
+
+    A BSON document starts with an int32 that counts its own total length in
+    bytes, including that prefix and the trailing 0x00. The reader is driven
+    by the terminator rather than the declared length, so without this check a
+    nested document could declare a length that disagrees with where its
+    terminator actually falls and quietly hand the bytes in between to the
+    enclosing document. A well-formed document is at least 5 bytes (the prefix
+    plus the terminator); the equality also rejects those impossible sizes,
+    since at least 5 bytes are always consumed.
+
+    @param[in] document_start  value of chars_read before the size prefix
+    @param[in] document_size   the declared document size
+    @return whether the declared size matches the number of bytes read
+    */
+    bool check_bson_document_size(const std::size_t document_start, const std::int32_t document_size)
+    {
+        if (JSON_HEDLEY_UNLIKELY(document_size < 0 || static_cast<std::size_t>(document_size) != chars_read - document_start))
+        {
+            return sax->parse_error(chars_read, get_token_string(), parse_error::create(112, chars_read,
+                                    exception_message(input_format_t::bson, concat("document size ", std::to_string(document_size), " does not match the number of bytes read (", std::to_string(chars_read - document_start), ")"), "document"), nullptr));
+        }
+        return true;
+    }
+
     /*!
     @brief Reads in a BSON-object and passes it to the SAX-parser.
     @return whether a valid BSON-value was passed to the SAX parser
     */
     bool parse_bson_internal()
     {
+        const std::size_t document_start = chars_read;
         std::int32_t document_size{};
         get_number<std::int32_t, true>(input_format_t::bson, document_size);
 
@@ -182,6 +209,11 @@ class binary_reader
             return false;
         }
 
+        if (JSON_HEDLEY_UNLIKELY(!check_bson_document_size(document_start, document_size)))
+        {
+            return false;
+        }
+
         return sax->end_object();
     }
 
@@ -397,6 +429,7 @@ class binary_reader
     */
     bool parse_bson_array()
     {
+        const std::size_t document_start = chars_read;
         std::int32_t document_size{};
         get_number<std::int32_t, true>(input_format_t::bson, document_size);
 
@@ -410,6 +443,11 @@ class binary_reader
             return false;
         }
 
+        if (JSON_HEDLEY_UNLIKELY(!check_bson_document_size(document_start, document_size)))
+        {
+            return false;
+        }
+
         return sax->end_array();
     }
 
@@ -1846,6 +1884,29 @@ class binary_reader
         return get_ubjson_value(get_char ? get_ignore_noop() : current);
     }
 
+    /*!
+    @brief reject a negative UBJSON/BJData string length
+
+    String and key lengths are written with signed integer markers (i, I, l,
+    L). A negative value is malformed; without this check get_string() would
+    silently treat it as an empty string and leave the following bytes to be
+    misread as the next value. This mirrors the non-negative check the
+    optimized-container count path already performs in get_ubjson_size_value.
+
+    @param[in] len  the string length read from the input
+    @return whether the length is valid (non-negative)
+    */
+    template<typename NumberType>
+    bool check_ubjson_string_length(const NumberType len)
+    {
+        if (JSON_HEDLEY_UNLIKELY(len < 0))
+        {
+            return sax->parse_error(chars_read, get_token_string(), parse_error::create(113, chars_read,
+                                    exception_message(input_format, "string length must not be negative", "string"), nullptr));
+        }
+        return true;
+    }
+
     /*!
     @brief reads a UBJSON string
 
@@ -1883,25 +1944,25 @@ class binary_reader
             case 'i':
             {
                 std::int8_t len{};
-                return get_number(input_format, len) && get_string(input_format, len, result);
+                return get_number(input_format, len) && check_ubjson_string_length(len) && get_string(input_format, len, result);
             }
 
             case 'I':
             {
                 std::int16_t len{};
-                return get_number(input_format, len) && get_string(input_format, len, result);
+                return get_number(input_format, len) && check_ubjson_string_length(len) && get_string(input_format, len, result);
             }
 
             case 'l':
             {
                 std::int32_t len{};
-                return get_number(input_format, len) && get_string(input_format, len, result);
+                return get_number(input_format, len) && check_ubjson_string_length(len) && get_string(input_format, len, result);
             }
 
             case 'L':
             {
                 std::int64_t len{};
-                return get_number(input_format, len) && get_string(input_format, len, result);
+                return get_number(input_format, len) && check_ubjson_string_length(len) && get_string(input_format, len, result);
             }
 
             case 'u':

include/nlohmann/detail/input/input_adapters.hpp

@@ -231,33 +231,6 @@ class iterator_input_adapter
         std::is_same<IteratorType, SentinelType>::value && std::is_pointer<IteratorType>::value;
 #endif
 
-  public:
-    // Whether the remaining input is a single contiguous block of 1-byte
-    // elements that the lexer can inspect directly (used for the SWAR string
-    // fast path). Restricted to same-type iterator/sentinel pairs so that plain
-    // std::distance/std::advance are well-defined in all standards.
-    static constexpr bool supports_bulk_scan =
-        iterator_is_contiguous && std::is_same<IteratorType, SentinelType>::value && sizeof(char_type) == 1;
-
-    // Pointer to the next unread element; only valid when bulk_remaining() > 0.
-    const char_type* bulk_data() const
-    {
-        return &*current;
-    }
-
-    // Number of unread elements available as one contiguous block.
-    std::size_t bulk_remaining() const
-    {
-        return static_cast<std::size_t>(std::distance(current, end));
-    }
-
-    // Consume @a n elements previously inspected via bulk_data().
-    void bulk_skip(std::size_t n)
-    {
-        std::advance(current, static_cast<typename std::iterator_traits<IteratorType>::difference_type>(n));
-    }
-
-  private:
     // contiguous fast path: bulk copy the remaining range with std::memcpy
     template<class T>
     std::size_t get_elements_impl(T* dest, std::size_t count, std::true_type /*contiguous*/)

include/nlohmann/detail/input/lexer.hpp

@@ -11,12 +11,9 @@
 #include <array> // array
 #include <clocale> // localeconv
 #include <cstddef> // size_t
-#include <cstdint> // uint64_t
 #include <cstdio> // snprintf
 #include <cstdlib> // strtof, strtod, strtold, strtoll, strtoull
-#include <cstring> // memcpy
 #include <initializer_list> // initializer_list
-#include <limits> // numeric_limits
 #include <string> // char_traits, string
 #include <utility> // move
 #include <vector> // vector
@@ -128,25 +125,6 @@ constexpr bool input_adapter_supports_seek(std::false_type /*detected*/)
     return false;
 }
 
-// Detect whether an input adapter exposes a contiguous byte block that the
-// lexer can scan directly (see iterator_input_adapter::supports_bulk_scan).
-// Adapters without the flag - file, stream, wide-string, user-defined - fall
-// back to the character-at-a-time string scanner.
-template<typename InputAdapterType>
-using detect_supports_bulk_scan = decltype(InputAdapterType::supports_bulk_scan);
-
-template<typename InputAdapterType>
-constexpr bool input_adapter_supports_bulk_scan(std::true_type /*detected*/)
-{
-    return InputAdapterType::supports_bulk_scan;
-}
-
-template<typename InputAdapterType>
-constexpr bool input_adapter_supports_bulk_scan(std::false_type /*detected*/)
-{
-    return false;
-}
-
 /*!
 @brief lexical analysis
 
@@ -168,14 +146,6 @@ class lexer : public lexer_base<BasicJsonType>
     static constexpr bool lazy_token_string =
         input_adapter_supports_seek<InputAdapterType>(is_detected<detect_supports_seek, InputAdapterType> {});
 
-    /// whether string scanning may bulk-consume runs of ordinary characters
-    /// directly from a contiguous input buffer (SWAR fast path). This requires
-    /// the token to be reconstructible lazily (lazy_token_string), so bypassing
-    /// the per-character capture in get() cannot lose error diagnostics.
-    static constexpr bool bulk_scan =
-        lazy_token_string
-        && input_adapter_supports_bulk_scan<InputAdapterType>(is_detected<detect_supports_bulk_scan, InputAdapterType> {});
-
   public:
     using token_type = typename lexer_base<BasicJsonType>::token_type;
 
@@ -295,92 +265,6 @@ class lexer : public lexer_base<BasicJsonType>
         return true;
     }
 
-    // classify a single byte as needing individual string handling: the
-    // closing quote, an escape, a control character, or a non-ASCII (UTF-8)
-    // lead/continuation byte. Ordinary bytes (0x20..0x7F except '"' and '\\')
-    // are copied verbatim, which the bulk scanner does 8 bytes at a time.
-    static bool is_string_special(unsigned char c) noexcept
-    {
-        return c == '\"' || c == '\\' || c < 0x20u || c >= 0x80u;
-    }
-
-    // SWAR helper: return a word whose high bit is set in every byte of @a v
-    // that is_string_special(); zero if the 8 bytes are all ordinary.
-    static std::uint64_t swar_string_special(std::uint64_t v) noexcept
-    {
-        constexpr std::uint64_t ones = 0x0101010101010101ull;
-        constexpr std::uint64_t high = 0x8080808080808080ull;
-        const std::uint64_t q = v ^ 0x2222222222222222ull; // '"'  (0x22)
-        const std::uint64_t b = v ^ 0x5C5C5C5C5C5C5C5Cull; // '\\' (0x5C)
-        const std::uint64_t has_quote     = (q - ones) & ~q & high;
-        const std::uint64_t has_backslash = (b - ones) & ~b & high;
-        const std::uint64_t has_control   = (v - 0x2020202020202020ull) & ~v & high; // < 0x20
-        const std::uint64_t has_non_ascii = v & high;                                // >= 0x80
-        return has_quote | has_backslash | has_control | has_non_ascii;
-    }
-
-    // return the index of the first is_string_special() byte in [data, data+n),
-    // or n if every byte is ordinary; scans 8 bytes at a time
-    static std::size_t find_string_special(const unsigned char* data, std::size_t n) noexcept
-    {
-        std::size_t i = 0;
-        for (; i + 8 <= n; i += 8)
-        {
-            std::uint64_t word = 0;
-            std::memcpy(&word, data + i, sizeof(word));
-            if (swar_string_special(word) != 0)
-            {
-                // a special byte is in this word; locate it (endian-agnostic)
-                for (std::size_t j = 0; j < 8; ++j)
-                {
-                    if (is_string_special(data[i + j]))
-                    {
-                        return i + j;
-                    }
-                }
-            }
-        }
-        for (; i < n; ++i)
-        {
-            if (is_string_special(data[i]))
-            {
-                return i;
-            }
-        }
-        return n;
-    }
-
-    /// contiguous input: bulk-append the run of ordinary characters starting at
-    /// the current read position, leaving the first special byte for get()
-    void scan_string_bulk(std::true_type /*bulk*/)
-    {
-        // a pending unget must be consumed through the normal path first
-        if (next_unget)
-        {
-            return;
-        }
-        const std::size_t remaining = ia.bulk_remaining();
-        if (remaining == 0)
-        {
-            return;
-        }
-        const auto* const data = reinterpret_cast<const unsigned char*>(ia.bulk_data());
-        const std::size_t run = find_string_special(data, remaining);
-        if (run == 0)
-        {
-            return;
-        }
-        token_buffer.append(reinterpret_cast<const typename string_t::value_type*>(data), run);
-        ia.bulk_skip(run);
-        // the run contains no newline (all bytes < 0x20 are treated as special),
-        // so only the flat character counters advance
-        position.chars_read_total += run;
-        position.chars_read_current_line += run;
-    }
-
-    /// streaming input: no bulk fast path
-    void scan_string_bulk(std::false_type /*bulk*/) const noexcept {}
-
     /*!
     @brief scan a string literal
 
@@ -406,10 +290,6 @@ class lexer : public lexer_base<BasicJsonType>
 
         while (true)
         {
-            // bulk-consume ordinary characters from contiguous input, then
-            // handle the next special byte through the switch below
-            scan_string_bulk(std::integral_constant<bool, bulk_scan> {});
-
             // get the next character
             switch (get())
             {
@@ -1079,216 +959,6 @@ class lexer : public lexer_base<BasicJsonType>
         f = std::strtold(str, endptr);
     }
 
-    /*!
-    @brief fast integer parser for an already-validated digit sequence
-
-    The scan_number() state machine has already checked that [first, last) is a
-    valid JSON integer, so this only needs to accumulate the digits and detect
-    overflow. This avoids the locale/errno machinery of std::strtoull, which
-    dominates integer-heavy inputs.
-
-    @param[in]  first   pointer to the first character (a digit)
-    @param[in]  last    pointer past the last character
-    @param[out] value   the parsed value on success
-    @return true if the value fit into number_unsigned_t; false on overflow, in
-            which case the caller falls back to floating-point parsing (matching
-            the previous std::strtoull behavior)
-    */
-    static bool parse_integer_unsigned(const char* first, const char* last, number_unsigned_t& value) noexcept
-    {
-        // accumulate in the widest unsigned type used by the previous strtoull
-        // path so the overflow behavior is unchanged for custom number types
-        std::uint64_t x = 0;
-        constexpr std::uint64_t cutoff = (std::numeric_limits<std::uint64_t>::max)() / 10u;
-        constexpr std::uint64_t cutlim = (std::numeric_limits<std::uint64_t>::max)() % 10u;
-        for (const char* p = first; p != last; ++p)
-        {
-            const auto digit = static_cast<std::uint64_t>(static_cast<unsigned char>(*p) - static_cast<unsigned char>('0'));
-            if (JSON_HEDLEY_UNLIKELY(x > cutoff || (x == cutoff && digit > cutlim)))
-            {
-                return false;
-            }
-            x = x * 10u + digit;
-        }
-        value = static_cast<number_unsigned_t>(x);
-        // reject values that do not round-trip into a narrower number_unsigned_t
-        return static_cast<std::uint64_t>(value) == x;
-    }
-
-    /*!
-    @brief fast integer parser for an already-validated negative integer
-
-    @param[in]  first   pointer to the leading '-'
-    @param[in]  last    pointer past the last character
-    @param[out] value   the parsed (negative) value on success
-    @return true on success; false on overflow (caller falls back to float)
-    */
-    static bool parse_integer_signed(const char* first, const char* last, number_integer_t& value) noexcept
-    {
-        // the state machine only reaches the signed path via a leading '-'
-        JSON_ASSERT(first != last && *first == '-');
-        std::uint64_t magnitude = 0;
-        // |INT64_MIN| == INT64_MAX + 1; this is the largest admissible magnitude
-        constexpr std::uint64_t limit = static_cast<std::uint64_t>((std::numeric_limits<std::int64_t>::max)()) + 1u;
-        for (const char* p = first + 1; p != last; ++p)
-        {
-            const auto digit = static_cast<std::uint64_t>(static_cast<unsigned char>(*p) - static_cast<unsigned char>('0'));
-            if (JSON_HEDLEY_UNLIKELY(magnitude > (limit - digit) / 10u))
-            {
-                return false;
-            }
-            magnitude = magnitude * 10u + digit;
-        }
-        const std::int64_t x = (magnitude == limit)
-                               ? (std::numeric_limits<std::int64_t>::min)()
-                               : -static_cast<std::int64_t>(magnitude);
-        value = static_cast<number_integer_t>(x);
-        // reject values that do not round-trip into a narrower number_integer_t
-        return static_cast<std::int64_t>(value) == x;
-    }
-
-    /*!
-    @brief exact fast path for parsing a `double` (Clinger's algorithm)
-
-    For the common case - at most 19 significant digits, a decimal exponent in
-    [-22, 22], and a significand below 2^53 - the value equals significand *
-    10^exp computed in IEEE-754 double arithmetic, which is exact under
-    round-to-nearest because both operands are exactly representable. This is the
-    same fast path used by fast_float/simdjson; the general cases are left to
-    std::strtod. The parser only activates for number_float_t == double; float
-    and long double keep the std::strtof/std::strtold paths (see the templated
-    overload below).
-
-    @param[in]  first   pointer to the first character of the number
-    @param[in]  last    pointer past the last character
-    @param[out] out     the parsed value on success
-    @return true if the value was parsed exactly; false to fall back to strtod
-    */
-    bool parse_float_fast(const char* first, const char* last, double& out) const noexcept
-    {
-        static const double powers_of_ten[] =
-        {
-            1e0, 1e1, 1e2, 1e3, 1e4, 1e5, 1e6, 1e7, 1e8, 1e9, 1e10, 1e11,
-            1e12, 1e13, 1e14, 1e15, 1e16, 1e17, 1e18, 1e19, 1e20, 1e21, 1e22
-        };
-
-        const char* p = first;
-        bool negative = false;
-        if (p != last && (*p == '-' || *p == '+'))
-        {
-            negative = (*p == '-');
-            ++p;
-        }
-
-        std::uint64_t significand = 0;
-        int num_digits = 0;
-        int fractional_digits = 0;
-        bool seen_dot = false;
-        bool any_digit = false;
-        for (; p != last; ++p)
-        {
-            const char c = *p;
-            if (c >= '0' && c <= '9')
-            {
-                any_digit = true;
-                if (JSON_HEDLEY_UNLIKELY(num_digits >= 19))
-                {
-                    return false; // significand may not fit into uint64_t
-                }
-                significand = significand * 10u + static_cast<std::uint64_t>(c - '0');
-                ++num_digits;
-                fractional_digits += static_cast<int>(seen_dot);
-            }
-            else if (static_cast<char_int_type>(c) == decimal_point_char)
-            {
-                if (JSON_HEDLEY_UNLIKELY(seen_dot))
-                {
-                    return false;
-                }
-                seen_dot = true;
-            }
-            else if (c == 'e' || c == 'E')
-            {
-                ++p;
-                break;
-            }
-            else
-            {
-                return false;
-            }
-        }
-        if (JSON_HEDLEY_UNLIKELY(!any_digit))
-        {
-            return false;
-        }
-
-        int exponent = 0;
-        if (p != last) // an exponent part remains
-        {
-            bool exp_negative = false;
-            if (p != last && (*p == '-' || *p == '+'))
-            {
-                exp_negative = (*p == '-');
-                ++p;
-            }
-            bool any_exp_digit = false;
-            for (; p != last; ++p)
-            {
-                if (JSON_HEDLEY_UNLIKELY(*p < '0' || *p > '9'))
-                {
-                    return false;
-                }
-                exponent = exponent * 10 + (*p - '0');
-                any_exp_digit = true;
-                if (JSON_HEDLEY_UNLIKELY(exponent > 9999))
-                {
-                    return false;
-                }
-            }
-            if (JSON_HEDLEY_UNLIKELY(!any_exp_digit))
-            {
-                return false;
-            }
-            if (exp_negative)
-            {
-                exponent = -exponent;
-            }
-        }
-
-        const int scale = exponent - fractional_digits;
-        if (JSON_HEDLEY_UNLIKELY(significand >= (static_cast<std::uint64_t>(1) << 53)))
-        {
-            return false; // significand not exactly representable as double
-        }
-
-        double result = static_cast<double>(significand);
-        if (scale >= 0)
-        {
-            if (JSON_HEDLEY_UNLIKELY(scale > 22))
-            {
-                return false;
-            }
-            result *= powers_of_ten[scale];
-        }
-        else
-        {
-            if (JSON_HEDLEY_UNLIKELY(-scale > 22))
-            {
-                return false;
-            }
-            result /= powers_of_ten[-scale];
-        }
-        out = negative ? -result : result;
-        return true;
-    }
-
-    /// fast float path is only exact for `double`; decline for float/long double
-    template<typename FloatType>
-    bool parse_float_fast(const char* /*first*/, const char* /*last*/, FloatType& /*out*/) const noexcept
-    {
-        return false;
-    }
-
     /*!
     @brief scan a number literal
 
@@ -1609,36 +1279,45 @@ scan_number_done:
         // we are done scanning a number)
         unget();
 
-        const char* const num_begin = token_buffer.data();
+        char* endptr = nullptr; // NOLINT(misc-const-correctness,cppcoreguidelines-pro-type-vararg,hicpp-vararg)
-        const char* const num_end = num_begin + token_buffer.size();
+        errno = 0;
 
-        // try to parse integers first and fall back to floats; the digit
+        // try to parse integers first and fall back to floats
-        // sequence has already been validated by the state machine above, so
-        // a dedicated parser can avoid the locale/errno overhead of strtoull
         if (number_type == token_type::value_unsigned)
         {
-            if (parse_integer_unsigned(num_begin, num_end, value_unsigned))
+            const auto x = std::strtoull(token_buffer.data(), &endptr, 10);
+
+            // we checked the number format before
+            JSON_ASSERT(endptr == token_buffer.data() + token_buffer.size());
+
+            if (errno != ERANGE)
             {
-                return token_type::value_unsigned;
+                value_unsigned = static_cast<number_unsigned_t>(x);
+                if (value_unsigned == x)
+                {
+                    return token_type::value_unsigned;
+                }
             }
         }
         else if (number_type == token_type::value_integer)
         {
-            if (parse_integer_signed(num_begin, num_end, value_integer))
+            const auto x = std::strtoll(token_buffer.data(), &endptr, 10);
+
+            // we checked the number format before
+            JSON_ASSERT(endptr == token_buffer.data() + token_buffer.size());
+
+            if (errno != ERANGE)
             {
-                return token_type::value_integer;
+                value_integer = static_cast<number_integer_t>(x);
+                if (value_integer == x)
+                {
+                    return token_type::value_integer;
+                }
             }
         }
 
         // this code is reached if we parse a floating-point number or if an
-        // integer conversion above overflowed. Try the exact fast path (double
+        // integer conversion above failed
-        // only) before falling back to the locale-independent strtof/strtod.
-        if (parse_float_fast(num_begin, num_end, value_float))
-        {
-            return token_type::value_float;
-        }
-
-        char* endptr = nullptr; // NOLINT(misc-const-correctness,cppcoreguidelines-pro-type-vararg,hicpp-vararg)
         strtof(value_float, token_buffer.data(), &endptr);
 
         // we checked the number format before

include/nlohmann/detail/output/binary_writer.hpp

@@ -979,13 +979,28 @@ class binary_writer
         return /*id*/ 1ul + name.size() + /*zero-terminator*/1u;
     }
 
+    /*!
+    @brief Checks that @a size fits into the 32-bit length field used by BSON
+    @return The size as a signed 32-bit integer
+    @throw out_of_range.412 if @a size exceeds the range of std::int32_t
+    */
+    static std::int32_t to_bson_length(const std::size_t size)
+    {
+        if (JSON_HEDLEY_UNLIKELY(!value_in_range_of<std::int32_t>(size)))
+        {
+            JSON_THROW(out_of_range::create(412, concat("BSON length ", std::to_string(size), " exceeds maximum of ", std::to_string((std::numeric_limits<std::int32_t>::max)())), nullptr));
+        }
+
+        return static_cast<std::int32_t>(size);
+    }
+
     /*!
     @brief Writes the given @a element_type and @a name to the output adapter
     */
     void write_bson_entry_header(const string_t& name,
                                  const std::uint8_t element_type)
     {
-        oa->write_character(to_char_type(element_type)); // boolean
+        oa->write_character(to_char_type(element_type));
         oa->write_characters(
             reinterpret_cast<const CharType*>(name.c_str()),
             name.size() + 1u);
@@ -1027,7 +1042,7 @@ class binary_writer
     {
         write_bson_entry_header(name, 0x02);
 
-        write_number<std::int32_t>(static_cast<std::int32_t>(value.size() + 1ul), true);
+        write_number<std::int32_t>(to_bson_length(value.size() + 1ul), true);
         oa->write_characters(
             reinterpret_cast<const CharType*>(value.c_str()),
             value.size() + 1);
@@ -1070,7 +1085,7 @@ class binary_writer
     }
 
     /*!
-    @return The size of the BSON-encoded unsigned integer in @a j
+    @return The size of the BSON-encoded unsigned integer @a value
     */
     static constexpr std::size_t calc_bson_unsigned_size(const std::uint64_t value) noexcept
     {
@@ -1083,22 +1098,22 @@ class binary_writer
     @brief Writes a BSON element with key @a name and unsigned @a value
     */
     void write_bson_unsigned(const string_t& name,
-                             const BasicJsonType& j)
+                             const std::uint64_t value)
     {
-        if (j.m_data.m_value.number_unsigned <= static_cast<std::uint64_t>((std::numeric_limits<std::int32_t>::max)()))
+        if (value <= static_cast<std::uint64_t>((std::numeric_limits<std::int32_t>::max)()))
         {
             write_bson_entry_header(name, 0x10 /* int32 */);
-            write_number<std::int32_t>(static_cast<std::int32_t>(j.m_data.m_value.number_unsigned), true);
+            write_number<std::int32_t>(static_cast<std::int32_t>(value), true);
         }
-        else if (j.m_data.m_value.number_unsigned <= static_cast<std::uint64_t>((std::numeric_limits<std::int64_t>::max)()))
+        else if (value <= static_cast<std::uint64_t>((std::numeric_limits<std::int64_t>::max)()))
         {
             write_bson_entry_header(name, 0x12 /* int64 */);
-            write_number<std::int64_t>(static_cast<std::int64_t>(j.m_data.m_value.number_unsigned), true);
+            write_number<std::int64_t>(static_cast<std::int64_t>(value), true);
         }
         else
         {
             write_bson_entry_header(name, 0x11 /* uint64 */);
-            write_number<std::uint64_t>(static_cast<std::uint64_t>(j.m_data.m_value.number_unsigned), true);
+            write_number<std::uint64_t>(value, true);
         }
     }
 
@@ -1142,7 +1157,7 @@ class binary_writer
                           const typename BasicJsonType::array_t& value)
     {
         write_bson_entry_header(name, 0x04); // array
-        write_number<std::int32_t>(static_cast<std::int32_t>(calc_bson_array_size(value)), true);
+        write_number<std::int32_t>(to_bson_length(calc_bson_array_size(value)), true);
 
         std::size_t array_index = 0ul;
 
@@ -1162,7 +1177,7 @@ class binary_writer
     {
         write_bson_entry_header(name, 0x05);
 
-        write_number<std::int32_t>(static_cast<std::int32_t>(value.size()), true);
+        write_number<std::int32_t>(to_bson_length(value.size()), true);
         write_number(value.has_subtype() ? static_cast<std::uint8_t>(value.subtype()) : static_cast<std::uint8_t>(0x00));
 
         oa->write_characters(reinterpret_cast<const CharType*>(value.data()), value.size());
@@ -1244,7 +1259,7 @@ class binary_writer
                 return write_bson_integer(name, j.m_data.m_value.number_integer);
 
             case value_t::number_unsigned:
-                return write_bson_unsigned(name, j);
+                return write_bson_unsigned(name, j.m_data.m_value.number_unsigned);
 
             case value_t::string:
                 return write_bson_string(name, *j.m_data.m_value.string);
@@ -1284,7 +1299,7 @@ class binary_writer
     */
     void write_bson_object(const typename BasicJsonType::object_t& value)
     {
-        write_number<std::int32_t>(static_cast<std::int32_t>(calc_bson_object_size(value)), true);
+        write_number<std::int32_t>(to_bson_length(calc_bson_object_size(value)), true);
 
         for (const auto& el : value)
         {

single_include/nlohmann/json.hpp

@@ -7218,33 +7218,6 @@ class iterator_input_adapter
         std::is_same<IteratorType, SentinelType>::value && std::is_pointer<IteratorType>::value;
 #endif
 
-  public:
-    // Whether the remaining input is a single contiguous block of 1-byte
-    // elements that the lexer can inspect directly (used for the SWAR string
-    // fast path). Restricted to same-type iterator/sentinel pairs so that plain
-    // std::distance/std::advance are well-defined in all standards.
-    static constexpr bool supports_bulk_scan =
-        iterator_is_contiguous && std::is_same<IteratorType, SentinelType>::value && sizeof(char_type) == 1;
-
-    // Pointer to the next unread element; only valid when bulk_remaining() > 0.
-    const char_type* bulk_data() const
-    {
-        return &*current;
-    }
-
-    // Number of unread elements available as one contiguous block.
-    std::size_t bulk_remaining() const
-    {
-        return static_cast<std::size_t>(std::distance(current, end));
-    }
-
-    // Consume @a n elements previously inspected via bulk_data().
-    void bulk_skip(std::size_t n)
-    {
-        std::advance(current, static_cast<typename std::iterator_traits<IteratorType>::difference_type>(n));
-    }
-
-  private:
     // contiguous fast path: bulk copy the remaining range with std::memcpy
     template<class T>
     std::size_t get_elements_impl(T* dest, std::size_t count, std::true_type /*contiguous*/)
@@ -7732,12 +7705,9 @@ NLOHMANN_JSON_NAMESPACE_END
 #include <array> // array
 #include <clocale> // localeconv
 #include <cstddef> // size_t
-#include <cstdint> // uint64_t
 #include <cstdio> // snprintf
 #include <cstdlib> // strtof, strtod, strtold, strtoll, strtoull
-#include <cstring> // memcpy
 #include <initializer_list> // initializer_list
-#include <limits> // numeric_limits
 #include <string> // char_traits, string
 #include <utility> // move
 #include <vector> // vector
@@ -7853,25 +7823,6 @@ constexpr bool input_adapter_supports_seek(std::false_type /*detected*/)
     return false;
 }
 
-// Detect whether an input adapter exposes a contiguous byte block that the
-// lexer can scan directly (see iterator_input_adapter::supports_bulk_scan).
-// Adapters without the flag - file, stream, wide-string, user-defined - fall
-// back to the character-at-a-time string scanner.
-template<typename InputAdapterType>
-using detect_supports_bulk_scan = decltype(InputAdapterType::supports_bulk_scan);
-
-template<typename InputAdapterType>
-constexpr bool input_adapter_supports_bulk_scan(std::true_type /*detected*/)
-{
-    return InputAdapterType::supports_bulk_scan;
-}
-
-template<typename InputAdapterType>
-constexpr bool input_adapter_supports_bulk_scan(std::false_type /*detected*/)
-{
-    return false;
-}
-
 /*!
 @brief lexical analysis
 
@@ -7893,14 +7844,6 @@ class lexer : public lexer_base<BasicJsonType>
     static constexpr bool lazy_token_string =
         input_adapter_supports_seek<InputAdapterType>(is_detected<detect_supports_seek, InputAdapterType> {});
 
-    /// whether string scanning may bulk-consume runs of ordinary characters
-    /// directly from a contiguous input buffer (SWAR fast path). This requires
-    /// the token to be reconstructible lazily (lazy_token_string), so bypassing
-    /// the per-character capture in get() cannot lose error diagnostics.
-    static constexpr bool bulk_scan =
-        lazy_token_string
-        && input_adapter_supports_bulk_scan<InputAdapterType>(is_detected<detect_supports_bulk_scan, InputAdapterType> {});
-
   public:
     using token_type = typename lexer_base<BasicJsonType>::token_type;
 
@@ -8020,92 +7963,6 @@ class lexer : public lexer_base<BasicJsonType>
         return true;
     }
 
-    // classify a single byte as needing individual string handling: the
-    // closing quote, an escape, a control character, or a non-ASCII (UTF-8)
-    // lead/continuation byte. Ordinary bytes (0x20..0x7F except '"' and '\\')
-    // are copied verbatim, which the bulk scanner does 8 bytes at a time.
-    static bool is_string_special(unsigned char c) noexcept
-    {
-        return c == '\"' || c == '\\' || c < 0x20u || c >= 0x80u;
-    }
-
-    // SWAR helper: return a word whose high bit is set in every byte of @a v
-    // that is_string_special(); zero if the 8 bytes are all ordinary.
-    static std::uint64_t swar_string_special(std::uint64_t v) noexcept
-    {
-        constexpr std::uint64_t ones = 0x0101010101010101ull;
-        constexpr std::uint64_t high = 0x8080808080808080ull;
-        const std::uint64_t q = v ^ 0x2222222222222222ull; // '"'  (0x22)
-        const std::uint64_t b = v ^ 0x5C5C5C5C5C5C5C5Cull; // '\\' (0x5C)
-        const std::uint64_t has_quote     = (q - ones) & ~q & high;
-        const std::uint64_t has_backslash = (b - ones) & ~b & high;
-        const std::uint64_t has_control   = (v - 0x2020202020202020ull) & ~v & high; // < 0x20
-        const std::uint64_t has_non_ascii = v & high;                                // >= 0x80
-        return has_quote | has_backslash | has_control | has_non_ascii;
-    }
-
-    // return the index of the first is_string_special() byte in [data, data+n),
-    // or n if every byte is ordinary; scans 8 bytes at a time
-    static std::size_t find_string_special(const unsigned char* data, std::size_t n) noexcept
-    {
-        std::size_t i = 0;
-        for (; i + 8 <= n; i += 8)
-        {
-            std::uint64_t word = 0;
-            std::memcpy(&word, data + i, sizeof(word));
-            if (swar_string_special(word) != 0)
-            {
-                // a special byte is in this word; locate it (endian-agnostic)
-                for (std::size_t j = 0; j < 8; ++j)
-                {
-                    if (is_string_special(data[i + j]))
-                    {
-                        return i + j;
-                    }
-                }
-            }
-        }
-        for (; i < n; ++i)
-        {
-            if (is_string_special(data[i]))
-            {
-                return i;
-            }
-        }
-        return n;
-    }
-
-    /// contiguous input: bulk-append the run of ordinary characters starting at
-    /// the current read position, leaving the first special byte for get()
-    void scan_string_bulk(std::true_type /*bulk*/)
-    {
-        // a pending unget must be consumed through the normal path first
-        if (next_unget)
-        {
-            return;
-        }
-        const std::size_t remaining = ia.bulk_remaining();
-        if (remaining == 0)
-        {
-            return;
-        }
-        const auto* const data = reinterpret_cast<const unsigned char*>(ia.bulk_data());
-        const std::size_t run = find_string_special(data, remaining);
-        if (run == 0)
-        {
-            return;
-        }
-        token_buffer.append(reinterpret_cast<const typename string_t::value_type*>(data), run);
-        ia.bulk_skip(run);
-        // the run contains no newline (all bytes < 0x20 are treated as special),
-        // so only the flat character counters advance
-        position.chars_read_total += run;
-        position.chars_read_current_line += run;
-    }
-
-    /// streaming input: no bulk fast path
-    void scan_string_bulk(std::false_type /*bulk*/) const noexcept {}
-
     /*!
     @brief scan a string literal
 
@@ -8131,10 +7988,6 @@ class lexer : public lexer_base<BasicJsonType>
 
         while (true)
         {
-            // bulk-consume ordinary characters from contiguous input, then
-            // handle the next special byte through the switch below
-            scan_string_bulk(std::integral_constant<bool, bulk_scan> {});
-
             // get the next character
             switch (get())
             {
@@ -8804,216 +8657,6 @@ class lexer : public lexer_base<BasicJsonType>
         f = std::strtold(str, endptr);
     }
 
-    /*!
-    @brief fast integer parser for an already-validated digit sequence
-
-    The scan_number() state machine has already checked that [first, last) is a
-    valid JSON integer, so this only needs to accumulate the digits and detect
-    overflow. This avoids the locale/errno machinery of std::strtoull, which
-    dominates integer-heavy inputs.
-
-    @param[in]  first   pointer to the first character (a digit)
-    @param[in]  last    pointer past the last character
-    @param[out] value   the parsed value on success
-    @return true if the value fit into number_unsigned_t; false on overflow, in
-            which case the caller falls back to floating-point parsing (matching
-            the previous std::strtoull behavior)
-    */
-    static bool parse_integer_unsigned(const char* first, const char* last, number_unsigned_t& value) noexcept
-    {
-        // accumulate in the widest unsigned type used by the previous strtoull
-        // path so the overflow behavior is unchanged for custom number types
-        std::uint64_t x = 0;
-        constexpr std::uint64_t cutoff = (std::numeric_limits<std::uint64_t>::max)() / 10u;
-        constexpr std::uint64_t cutlim = (std::numeric_limits<std::uint64_t>::max)() % 10u;
-        for (const char* p = first; p != last; ++p)
-        {
-            const auto digit = static_cast<std::uint64_t>(static_cast<unsigned char>(*p) - static_cast<unsigned char>('0'));
-            if (JSON_HEDLEY_UNLIKELY(x > cutoff || (x == cutoff && digit > cutlim)))
-            {
-                return false;
-            }
-            x = x * 10u + digit;
-        }
-        value = static_cast<number_unsigned_t>(x);
-        // reject values that do not round-trip into a narrower number_unsigned_t
-        return static_cast<std::uint64_t>(value) == x;
-    }
-
-    /*!
-    @brief fast integer parser for an already-validated negative integer
-
-    @param[in]  first   pointer to the leading '-'
-    @param[in]  last    pointer past the last character
-    @param[out] value   the parsed (negative) value on success
-    @return true on success; false on overflow (caller falls back to float)
-    */
-    static bool parse_integer_signed(const char* first, const char* last, number_integer_t& value) noexcept
-    {
-        // the state machine only reaches the signed path via a leading '-'
-        JSON_ASSERT(first != last && *first == '-');
-        std::uint64_t magnitude = 0;
-        // |INT64_MIN| == INT64_MAX + 1; this is the largest admissible magnitude
-        constexpr std::uint64_t limit = static_cast<std::uint64_t>((std::numeric_limits<std::int64_t>::max)()) + 1u;
-        for (const char* p = first + 1; p != last; ++p)
-        {
-            const auto digit = static_cast<std::uint64_t>(static_cast<unsigned char>(*p) - static_cast<unsigned char>('0'));
-            if (JSON_HEDLEY_UNLIKELY(magnitude > (limit - digit) / 10u))
-            {
-                return false;
-            }
-            magnitude = magnitude * 10u + digit;
-        }
-        const std::int64_t x = (magnitude == limit)
-                               ? (std::numeric_limits<std::int64_t>::min)()
-                               : -static_cast<std::int64_t>(magnitude);
-        value = static_cast<number_integer_t>(x);
-        // reject values that do not round-trip into a narrower number_integer_t
-        return static_cast<std::int64_t>(value) == x;
-    }
-
-    /*!
-    @brief exact fast path for parsing a `double` (Clinger's algorithm)
-
-    For the common case - at most 19 significant digits, a decimal exponent in
-    [-22, 22], and a significand below 2^53 - the value equals significand *
-    10^exp computed in IEEE-754 double arithmetic, which is exact under
-    round-to-nearest because both operands are exactly representable. This is the
-    same fast path used by fast_float/simdjson; the general cases are left to
-    std::strtod. The parser only activates for number_float_t == double; float
-    and long double keep the std::strtof/std::strtold paths (see the templated
-    overload below).
-
-    @param[in]  first   pointer to the first character of the number
-    @param[in]  last    pointer past the last character
-    @param[out] out     the parsed value on success
-    @return true if the value was parsed exactly; false to fall back to strtod
-    */
-    bool parse_float_fast(const char* first, const char* last, double& out) const noexcept
-    {
-        static const double powers_of_ten[] =
-        {
-            1e0, 1e1, 1e2, 1e3, 1e4, 1e5, 1e6, 1e7, 1e8, 1e9, 1e10, 1e11,
-            1e12, 1e13, 1e14, 1e15, 1e16, 1e17, 1e18, 1e19, 1e20, 1e21, 1e22
-        };
-
-        const char* p = first;
-        bool negative = false;
-        if (p != last && (*p == '-' || *p == '+'))
-        {
-            negative = (*p == '-');
-            ++p;
-        }
-
-        std::uint64_t significand = 0;
-        int num_digits = 0;
-        int fractional_digits = 0;
-        bool seen_dot = false;
-        bool any_digit = false;
-        for (; p != last; ++p)
-        {
-            const char c = *p;
-            if (c >= '0' && c <= '9')
-            {
-                any_digit = true;
-                if (JSON_HEDLEY_UNLIKELY(num_digits >= 19))
-                {
-                    return false; // significand may not fit into uint64_t
-                }
-                significand = significand * 10u + static_cast<std::uint64_t>(c - '0');
-                ++num_digits;
-                fractional_digits += static_cast<int>(seen_dot);
-            }
-            else if (static_cast<char_int_type>(c) == decimal_point_char)
-            {
-                if (JSON_HEDLEY_UNLIKELY(seen_dot))
-                {
-                    return false;
-                }
-                seen_dot = true;
-            }
-            else if (c == 'e' || c == 'E')
-            {
-                ++p;
-                break;
-            }
-            else
-            {
-                return false;
-            }
-        }
-        if (JSON_HEDLEY_UNLIKELY(!any_digit))
-        {
-            return false;
-        }
-
-        int exponent = 0;
-        if (p != last) // an exponent part remains
-        {
-            bool exp_negative = false;
-            if (p != last && (*p == '-' || *p == '+'))
-            {
-                exp_negative = (*p == '-');
-                ++p;
-            }
-            bool any_exp_digit = false;
-            for (; p != last; ++p)
-            {
-                if (JSON_HEDLEY_UNLIKELY(*p < '0' || *p > '9'))
-                {
-                    return false;
-                }
-                exponent = exponent * 10 + (*p - '0');
-                any_exp_digit = true;
-                if (JSON_HEDLEY_UNLIKELY(exponent > 9999))
-                {
-                    return false;
-                }
-            }
-            if (JSON_HEDLEY_UNLIKELY(!any_exp_digit))
-            {
-                return false;
-            }
-            if (exp_negative)
-            {
-                exponent = -exponent;
-            }
-        }
-
-        const int scale = exponent - fractional_digits;
-        if (JSON_HEDLEY_UNLIKELY(significand >= (static_cast<std::uint64_t>(1) << 53)))
-        {
-            return false; // significand not exactly representable as double
-        }
-
-        double result = static_cast<double>(significand);
-        if (scale >= 0)
-        {
-            if (JSON_HEDLEY_UNLIKELY(scale > 22))
-            {
-                return false;
-            }
-            result *= powers_of_ten[scale];
-        }
-        else
-        {
-            if (JSON_HEDLEY_UNLIKELY(-scale > 22))
-            {
-                return false;
-            }
-            result /= powers_of_ten[-scale];
-        }
-        out = negative ? -result : result;
-        return true;
-    }
-
-    /// fast float path is only exact for `double`; decline for float/long double
-    template<typename FloatType>
-    bool parse_float_fast(const char* /*first*/, const char* /*last*/, FloatType& /*out*/) const noexcept
-    {
-        return false;
-    }
-
     /*!
     @brief scan a number literal
 
@@ -9334,36 +8977,45 @@ scan_number_done:
         // we are done scanning a number)
         unget();
 
-        const char* const num_begin = token_buffer.data();
+        char* endptr = nullptr; // NOLINT(misc-const-correctness,cppcoreguidelines-pro-type-vararg,hicpp-vararg)
-        const char* const num_end = num_begin + token_buffer.size();
+        errno = 0;
 
-        // try to parse integers first and fall back to floats; the digit
+        // try to parse integers first and fall back to floats
-        // sequence has already been validated by the state machine above, so
-        // a dedicated parser can avoid the locale/errno overhead of strtoull
         if (number_type == token_type::value_unsigned)
         {
-            if (parse_integer_unsigned(num_begin, num_end, value_unsigned))
+            const auto x = std::strtoull(token_buffer.data(), &endptr, 10);
+
+            // we checked the number format before
+            JSON_ASSERT(endptr == token_buffer.data() + token_buffer.size());
+
+            if (errno != ERANGE)
             {
-                return token_type::value_unsigned;
+                value_unsigned = static_cast<number_unsigned_t>(x);
+                if (value_unsigned == x)
+                {
+                    return token_type::value_unsigned;
+                }
             }
         }
         else if (number_type == token_type::value_integer)
         {
-            if (parse_integer_signed(num_begin, num_end, value_integer))
+            const auto x = std::strtoll(token_buffer.data(), &endptr, 10);
+
+            // we checked the number format before
+            JSON_ASSERT(endptr == token_buffer.data() + token_buffer.size());
+
+            if (errno != ERANGE)
             {
-                return token_type::value_integer;
+                value_integer = static_cast<number_integer_t>(x);
+                if (value_integer == x)
+                {
+                    return token_type::value_integer;
+                }
             }
         }
 
         // this code is reached if we parse a floating-point number or if an
-        // integer conversion above overflowed. Try the exact fast path (double
+        // integer conversion above failed
-        // only) before falling back to the locale-independent strtof/strtod.
-        if (parse_float_fast(num_begin, num_end, value_float))
-        {
-            return token_type::value_float;
-        }
-
-        char* endptr = nullptr; // NOLINT(misc-const-correctness,cppcoreguidelines-pro-type-vararg,hicpp-vararg)
         strtof(value_float, token_buffer.data(), &endptr);
 
         // we checked the number format before
@@ -11060,12 +10712,39 @@ class binary_reader
     // BSON //
     //////////
 
+    /*!
+    @brief Validate a BSON document's declared size against the bytes read.
+
+    A BSON document starts with an int32 that counts its own total length in
+    bytes, including that prefix and the trailing 0x00. The reader is driven
+    by the terminator rather than the declared length, so without this check a
+    nested document could declare a length that disagrees with where its
+    terminator actually falls and quietly hand the bytes in between to the
+    enclosing document. A well-formed document is at least 5 bytes (the prefix
+    plus the terminator); the equality also rejects those impossible sizes,
+    since at least 5 bytes are always consumed.
+
+    @param[in] document_start  value of chars_read before the size prefix
+    @param[in] document_size   the declared document size
+    @return whether the declared size matches the number of bytes read
+    */
+    bool check_bson_document_size(const std::size_t document_start, const std::int32_t document_size)
+    {
+        if (JSON_HEDLEY_UNLIKELY(document_size < 0 || static_cast<std::size_t>(document_size) != chars_read - document_start))
+        {
+            return sax->parse_error(chars_read, get_token_string(), parse_error::create(112, chars_read,
+                                    exception_message(input_format_t::bson, concat("document size ", std::to_string(document_size), " does not match the number of bytes read (", std::to_string(chars_read - document_start), ")"), "document"), nullptr));
+        }
+        return true;
+    }
+
     /*!
     @brief Reads in a BSON-object and passes it to the SAX-parser.
     @return whether a valid BSON-value was passed to the SAX parser
     */
     bool parse_bson_internal()
     {
+        const std::size_t document_start = chars_read;
         std::int32_t document_size{};
         get_number<std::int32_t, true>(input_format_t::bson, document_size);
 
@@ -11079,6 +10758,11 @@ class binary_reader
             return false;
         }
 
+        if (JSON_HEDLEY_UNLIKELY(!check_bson_document_size(document_start, document_size)))
+        {
+            return false;
+        }
+
         return sax->end_object();
     }
 
@@ -11294,6 +10978,7 @@ class binary_reader
     */
     bool parse_bson_array()
     {
+        const std::size_t document_start = chars_read;
         std::int32_t document_size{};
         get_number<std::int32_t, true>(input_format_t::bson, document_size);
 
@@ -11307,6 +10992,11 @@ class binary_reader
             return false;
         }
 
+        if (JSON_HEDLEY_UNLIKELY(!check_bson_document_size(document_start, document_size)))
+        {
+            return false;
+        }
+
         return sax->end_array();
     }
 
@@ -12743,6 +12433,29 @@ class binary_reader
         return get_ubjson_value(get_char ? get_ignore_noop() : current);
     }
 
+    /*!
+    @brief reject a negative UBJSON/BJData string length
+
+    String and key lengths are written with signed integer markers (i, I, l,
+    L). A negative value is malformed; without this check get_string() would
+    silently treat it as an empty string and leave the following bytes to be
+    misread as the next value. This mirrors the non-negative check the
+    optimized-container count path already performs in get_ubjson_size_value.
+
+    @param[in] len  the string length read from the input
+    @return whether the length is valid (non-negative)
+    */
+    template<typename NumberType>
+    bool check_ubjson_string_length(const NumberType len)
+    {
+        if (JSON_HEDLEY_UNLIKELY(len < 0))
+        {
+            return sax->parse_error(chars_read, get_token_string(), parse_error::create(113, chars_read,
+                                    exception_message(input_format, "string length must not be negative", "string"), nullptr));
+        }
+        return true;
+    }
+
     /*!
     @brief reads a UBJSON string
 
@@ -12780,25 +12493,25 @@ class binary_reader
             case 'i':
             {
                 std::int8_t len{};
-                return get_number(input_format, len) && get_string(input_format, len, result);
+                return get_number(input_format, len) && check_ubjson_string_length(len) && get_string(input_format, len, result);
             }
 
             case 'I':
             {
                 std::int16_t len{};
-                return get_number(input_format, len) && get_string(input_format, len, result);
+                return get_number(input_format, len) && check_ubjson_string_length(len) && get_string(input_format, len, result);
             }
 
             case 'l':
             {
                 std::int32_t len{};
-                return get_number(input_format, len) && get_string(input_format, len, result);
+                return get_number(input_format, len) && check_ubjson_string_length(len) && get_string(input_format, len, result);
             }
 
             case 'L':
             {
                 std::int64_t len{};
-                return get_number(input_format, len) && get_string(input_format, len, result);
+                return get_number(input_format, len) && check_ubjson_string_length(len) && get_string(input_format, len, result);
             }
 
             case 'u':
@@ -18051,13 +17764,28 @@ class binary_writer
         return /*id*/ 1ul + name.size() + /*zero-terminator*/1u;
     }
 
+    /*!
+    @brief Checks that @a size fits into the 32-bit length field used by BSON
+    @return The size as a signed 32-bit integer
+    @throw out_of_range.412 if @a size exceeds the range of std::int32_t
+    */
+    static std::int32_t to_bson_length(const std::size_t size)
+    {
+        if (JSON_HEDLEY_UNLIKELY(!value_in_range_of<std::int32_t>(size)))
+        {
+            JSON_THROW(out_of_range::create(412, concat("BSON length ", std::to_string(size), " exceeds maximum of ", std::to_string((std::numeric_limits<std::int32_t>::max)())), nullptr));
+        }
+
+        return static_cast<std::int32_t>(size);
+    }
+
     /*!
     @brief Writes the given @a element_type and @a name to the output adapter
     */
     void write_bson_entry_header(const string_t& name,
                                  const std::uint8_t element_type)
     {
-        oa->write_character(to_char_type(element_type)); // boolean
+        oa->write_character(to_char_type(element_type));
         oa->write_characters(
             reinterpret_cast<const CharType*>(name.c_str()),
             name.size() + 1u);
@@ -18099,7 +17827,7 @@ class binary_writer
     {
         write_bson_entry_header(name, 0x02);
 
-        write_number<std::int32_t>(static_cast<std::int32_t>(value.size() + 1ul), true);
+        write_number<std::int32_t>(to_bson_length(value.size() + 1ul), true);
         oa->write_characters(
             reinterpret_cast<const CharType*>(value.c_str()),
             value.size() + 1);
@@ -18142,7 +17870,7 @@ class binary_writer
     }
 
     /*!
-    @return The size of the BSON-encoded unsigned integer in @a j
+    @return The size of the BSON-encoded unsigned integer @a value
     */
     static constexpr std::size_t calc_bson_unsigned_size(const std::uint64_t value) noexcept
     {
@@ -18155,22 +17883,22 @@ class binary_writer
     @brief Writes a BSON element with key @a name and unsigned @a value
     */
     void write_bson_unsigned(const string_t& name,
-                             const BasicJsonType& j)
+                             const std::uint64_t value)
     {
-        if (j.m_data.m_value.number_unsigned <= static_cast<std::uint64_t>((std::numeric_limits<std::int32_t>::max)()))
+        if (value <= static_cast<std::uint64_t>((std::numeric_limits<std::int32_t>::max)()))
         {
             write_bson_entry_header(name, 0x10 /* int32 */);
-            write_number<std::int32_t>(static_cast<std::int32_t>(j.m_data.m_value.number_unsigned), true);
+            write_number<std::int32_t>(static_cast<std::int32_t>(value), true);
         }
-        else if (j.m_data.m_value.number_unsigned <= static_cast<std::uint64_t>((std::numeric_limits<std::int64_t>::max)()))
+        else if (value <= static_cast<std::uint64_t>((std::numeric_limits<std::int64_t>::max)()))
         {
             write_bson_entry_header(name, 0x12 /* int64 */);
-            write_number<std::int64_t>(static_cast<std::int64_t>(j.m_data.m_value.number_unsigned), true);
+            write_number<std::int64_t>(static_cast<std::int64_t>(value), true);
         }
         else
         {
             write_bson_entry_header(name, 0x11 /* uint64 */);
-            write_number<std::uint64_t>(static_cast<std::uint64_t>(j.m_data.m_value.number_unsigned), true);
+            write_number<std::uint64_t>(value, true);
         }
     }
 
@@ -18214,7 +17942,7 @@ class binary_writer
                           const typename BasicJsonType::array_t& value)
     {
         write_bson_entry_header(name, 0x04); // array
-        write_number<std::int32_t>(static_cast<std::int32_t>(calc_bson_array_size(value)), true);
+        write_number<std::int32_t>(to_bson_length(calc_bson_array_size(value)), true);
 
         std::size_t array_index = 0ul;
 
@@ -18234,7 +17962,7 @@ class binary_writer
     {
         write_bson_entry_header(name, 0x05);
 
-        write_number<std::int32_t>(static_cast<std::int32_t>(value.size()), true);
+        write_number<std::int32_t>(to_bson_length(value.size()), true);
         write_number(value.has_subtype() ? static_cast<std::uint8_t>(value.subtype()) : static_cast<std::uint8_t>(0x00));
 
         oa->write_characters(reinterpret_cast<const CharType*>(value.data()), value.size());
@@ -18316,7 +18044,7 @@ class binary_writer
                 return write_bson_integer(name, j.m_data.m_value.number_integer);
 
             case value_t::number_unsigned:
-                return write_bson_unsigned(name, j);
+                return write_bson_unsigned(name, j.m_data.m_value.number_unsigned);
 
             case value_t::string:
                 return write_bson_string(name, *j.m_data.m_value.string);
@@ -18356,7 +18084,7 @@ class binary_writer
     */
     void write_bson_object(const typename BasicJsonType::object_t& value)
     {
-        write_number<std::int32_t>(static_cast<std::int32_t>(calc_bson_object_size(value)), true);
+        write_number<std::int32_t>(to_bson_length(calc_bson_object_size(value)), true);
 
         for (const auto& el : value)
         {

tests/src/unit-bjdata.cpp

@@ -2721,6 +2721,19 @@ TEST_CASE("BJData")
                 CHECK_THROWS_WITH_AS(_ = json::from_bjdata(v), "[json.exception.parse_error.113] parse error at byte 2: syntax error while parsing BJData string: expected length type specification (U, i, u, I, m, l, M, L); last byte: 0x31", json::parse_error&);
             }
 
+            SECTION("negative length")
+            {
+                json _;
+
+                std::vector<uint8_t> const vi = {'S', 'i', 0xFF};
+                CHECK_THROWS_WITH_AS(_ = json::from_bjdata(vi), "[json.exception.parse_error.113] parse error at byte 3: syntax error while parsing BJData string: string length must not be negative", json::parse_error&);
+                CHECK(json::from_bjdata(vi, true, false).is_discarded());
+
+                std::vector<uint8_t> const vl = {'S', 'l', 0xFF, 0xFF, 0xFF, 0xFF};
+                CHECK_THROWS_WITH_AS(_ = json::from_bjdata(vl), "[json.exception.parse_error.113] parse error at byte 6: syntax error while parsing BJData string: string length must not be negative", json::parse_error&);
+                CHECK(json::from_bjdata(vl, true, false).is_discarded());
+            }
+
             SECTION("parse bjdata markers in ubjson")
             {
                 // create a single-character string for all number types

tests/src/unit-bson.cpp

@@ -11,12 +11,35 @@
 #include <nlohmann/json.hpp>
 using nlohmann::json;
 
+#include <cstdint>
 #include <fstream>
 #include <limits>
 #include <sstream>
+#include <vector>
 #include "make_test_data_available.hpp"
 #include "test_utils.hpp"
 
+namespace
+{
+// a binary container that reports a size beyond INT32_MAX without allocating
+// that much memory, so the BSON length overflow can be tested cheaply
+class huge_binary_t : public std::vector<std::uint8_t>
+{
+  public:
+    using std::vector<std::uint8_t>::vector;
+
+    size_type size() const noexcept // NOLINT(readability-convert-member-functions-to-static)
+    {
+        // one byte more than the BSON length field can represent
+        return static_cast<size_type>((std::numeric_limits<std::int32_t>::max)()) + 1;
+    }
+};
+
+using huge_binary_json = nlohmann::basic_json <
+                         std::map, std::vector, std::string, bool, std::int64_t, std::uint64_t,
+                         double, std::allocator, nlohmann::adl_serializer, huge_binary_t, void >;
+} // namespace
+
 TEST_CASE("BSON")
 {
     SECTION("individual values not supported")
@@ -80,6 +103,14 @@ TEST_CASE("BSON")
 #endif
     }
 
+    SECTION("lengths exceeding INT32_MAX cannot be serialized to BSON")
+    {
+        huge_binary_json j;
+        j["b"] = huge_binary_json::binary(huge_binary_t{});
+
+        CHECK_THROWS_WITH_AS(huge_binary_json::to_bson(j), "[json.exception.out_of_range.412] BSON length 2147483661 exceeds maximum of 2147483647", huge_binary_json::out_of_range&);
+    }
+
     SECTION("string length must be at least 1")
     {
         // from https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11175
@@ -854,6 +885,62 @@ TEST_CASE("Unsupported BSON input")
     CHECK(!json::sax_parse(bson, &scp, json::input_format_t::bson));
 }
 
+TEST_CASE("BSON document size mismatch")
+{
+    json _;
+
+    SECTION("top-level document declaring more bytes than it contains")
+    {
+        // empty object, but the length prefix claims 6 bytes instead of 5
+        std::vector<std::uint8_t> const input = {0x06, 0x00, 0x00, 0x00, 0x00};
+        CHECK_THROWS_WITH_AS(_ = json::from_bson(input), "[json.exception.parse_error.112] parse error at byte 5: syntax error while parsing BSON document: document size 6 does not match the number of bytes read (5)", json::parse_error&);
+        CHECK(json::from_bson(input, true, false).is_discarded());
+    }
+
+    SECTION("top-level document with a negative size")
+    {
+        std::vector<std::uint8_t> const input = {0xFF, 0xFF, 0xFF, 0xFF, 0x00};
+        CHECK_THROWS_WITH_AS(_ = json::from_bson(input), "[json.exception.parse_error.112] parse error at byte 5: syntax error while parsing BSON document: document size -1 does not match the number of bytes read (5)", json::parse_error&);
+        CHECK(json::from_bson(input, true, false).is_discarded());
+    }
+
+    SECTION("embedded document whose size disagrees with its terminator")
+    {
+        // the embedded document "d" declares 0x7FFFFFFF bytes but its 0x00
+        // terminator falls right after {"a":null}; the length prefix would
+        // otherwise let the following "h" element be read as a member of the
+        // enclosing document instead of "d"
+        std::vector<std::uint8_t> const input =
+        {
+            0x00, 0x00, 0x00, 0x00, // outer size
+            0x03, 'd', 0x00,        // entry: embedded document "d"
+            0xFF, 0xFF, 0xFF, 0x7F, //   embedded size 0x7FFFFFFF
+            0x0A, 'a', 0x00,        //   entry: null "a"
+            0x00,                   //   embedded end marker
+            0x08, 'h', 0x00, 0x01,  // entry: bool "h" = true
+            0x00                    // outer end marker
+        };
+        CHECK_THROWS_WITH_AS(_ = json::from_bson(input), "[json.exception.parse_error.112] parse error at byte 15: syntax error while parsing BSON document: document size 2147483647 does not match the number of bytes read (8)", json::parse_error&);
+        CHECK(json::from_bson(input, true, false).is_discarded());
+    }
+
+    SECTION("embedded array whose size disagrees with its terminator")
+    {
+        // array [42] is 12 bytes, but the length prefix claims 13
+        std::vector<std::uint8_t> const input =
+        {
+            0x00, 0x00, 0x00, 0x00, // outer size
+            0x04, 'a', 0x00,        // entry: array "a"
+            0x0D, 0x00, 0x00, 0x00, //   array size 13 (real is 12)
+            0x10, '0', 0x00, 0x2A, 0x00, 0x00, 0x00, //   entry: int32 "0" = 42
+            0x00,                   //   array end marker
+            0x00                    // outer end marker
+        };
+        CHECK_THROWS_WITH_AS(_ = json::from_bson(input), "[json.exception.parse_error.112] parse error at byte 19: syntax error while parsing BSON document: document size 13 does not match the number of bytes read (12)", json::parse_error&);
+        CHECK(json::from_bson(input, true, false).is_discarded());
+    }
+}
+
 TEST_CASE("BSON numerical data")
 {
     SECTION("number")

tests/src/unit-ubjson.cpp

@@ -1862,6 +1862,31 @@ TEST_CASE("UBJSON")
                 json _;
                 CHECK_THROWS_WITH_AS(_ = json::from_ubjson(v), "[json.exception.parse_error.113] parse error at byte 2: syntax error while parsing UBJSON string: expected length type specification (U, i, I, l, L); last byte: 0x31", json::parse_error&);
             }
+
+            SECTION("negative length")
+            {
+                json _;
+
+                std::vector<uint8_t> const vi = {'S', 'i', 0xFF};
+                CHECK_THROWS_WITH_AS(_ = json::from_ubjson(vi), "[json.exception.parse_error.113] parse error at byte 3: syntax error while parsing UBJSON string: string length must not be negative", json::parse_error&);
+                CHECK(json::from_ubjson(vi, true, false).is_discarded());
+
+                std::vector<uint8_t> const vI = {'S', 'I', 0xFF, 0xFF};
+                CHECK_THROWS_WITH_AS(_ = json::from_ubjson(vI), "[json.exception.parse_error.113] parse error at byte 4: syntax error while parsing UBJSON string: string length must not be negative", json::parse_error&);
+                CHECK(json::from_ubjson(vI, true, false).is_discarded());
+
+                std::vector<uint8_t> const vl = {'S', 'l', 0xFF, 0xFF, 0xFF, 0xFF};
+                CHECK_THROWS_WITH_AS(_ = json::from_ubjson(vl), "[json.exception.parse_error.113] parse error at byte 6: syntax error while parsing UBJSON string: string length must not be negative", json::parse_error&);
+                CHECK(json::from_ubjson(vl, true, false).is_discarded());
+
+                std::vector<uint8_t> const vL = {'S', 'L', 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF};
+                CHECK_THROWS_WITH_AS(_ = json::from_ubjson(vL), "[json.exception.parse_error.113] parse error at byte 10: syntax error while parsing UBJSON string: string length must not be negative", json::parse_error&);
+                CHECK(json::from_ubjson(vL, true, false).is_discarded());
+
+                // a length of zero remains valid and yields an empty string
+                std::vector<uint8_t> const v0 = {'S', 'i', 0};
+                CHECK(json::from_ubjson(v0) == json(""));
+            }
         }
 
         SECTION("array")