Revision history for Perl extension JSON::SIMD

1.08 Sun Nov  1 10:03:31 PM CET 2026
	Security release
	
	A number of potentially vulnerable bugs were found by an AI-assisted review,
	then, independently, several CVEs were issued against Cpanel::JSON::XS,
	several of which where found to be applicable to this module.
	Most of the fixes are relevant to the legacy or incremental decoder,
	none of them affect encoding/decoding JSON with the default configuration.
	
	Breaking changes:
	- croak when boolean_values is called with one argument
	- require an explicit allow_nonref(1) to accept top-level scalars in the incremental parser
	
	[incr_parse] -Fix: quadratic rescanning during incremental parsing (similar to CVE-2026-110688)
	[allow_tags] -Fix: free arguments when THAW dies (CVE-2026-110685)
	[incr_parse] -Fix: require explicit allow_nonref for bare scalars (CVE-2026-110682)
	[legacy decoder] -Fix: filter_object: retain filter callbacks while active (CVE-2026-110686)
	[incr_parse] -Fix: enforce max_size on buffered text (CVE-2026-110678)
	[legacy decoder] -Fix: decode_tag: charge tagged values against max_depth (CVE-2026-110673)
	[legacy decoder] -Fix: decode_str() could allocate an accumulated string, then return from its failure path without decrementing it
	[legacy decoder] -Fix: decode_hv: free slow-path keys on errors (CVE-2026-110672)
	-Fix: don't leak scalars in boolean_values, core_bools; croak when boolean_values is called with one argument
	[legacy decoder] -Add: complete rewrite of the emulated decode_at_pointer functionality for the legacy decoder (hallucinated by AI), add tests
	-Change: disable simdjson mode with filter_json_object and filter_json_object_key
	-Fix: actually use simdjson's bigint parsing, fix the 1.e2 bad floating point number case in our own validate_large_number, add some test cases for bad numbers
	-Change: import simdjson 5.0.5, work around the changes in its api

1.07 Sun Sep  7 07:13:49 PM CEST 2025
	- Fix CVE-2025-40930 - buffer overread in the FP number parser of the legacy decoder
	- Import simdjson 3.13.0, with it, better big integer support

1.06 Thu Apr 27 17:55:29 CEST 2023
	- fix core_bools with false argument (now restores default)
	- make is_bool aware of core booleans on perl >= 5.36
	- more benchmark scripts

1.05 Sat Apr 22 21:55:43 CEST 2023
	- fix build issue with "invalid register for .seh_savexmm" (prev fix caused other problems, was reverted)
	- add ppport.h
	- add core_bools and encode_core_bools methods to support builtin::true and false on perl >= 5.36
		core_bools also works towards compatibility with JSON::PP, and with both of these options
		it is possible to have correct, full round-trip encode/decode between Perl and JSON booleans.

1.04 Thu Apr 20 19:48:29 CEST 2023
	- fix floating point precision issues with -Duselongdouble and -Dusequadmath
	- fix intermittent garbage in floating point numbers from encode with -Dusequadmath (fix taken from Cpanel::JSON::XS ad072b4)
	- fix build issue with "invalid register for .seh_savexmm"
	- drop common::sense as a direct dependency (it's still used via Types::Serialiser, though)
	- fix repository and issue tracker for CPAN (thanks to Gabor Szabo)

1.03 Apr 18 20:11:05 CEST 2023
	- fix hardcoded g++ in Makefile
	- document requirements and incompatibilites

1.02 Mon Apr 17 20:00:08  CEST 2023
	- update repository and issue tracker?
	- split old changes into separate file

1.01 Mon Apr 17 19:32:46 CEST 2023
	- update repository and issue tracker

1.00 Mon Apr 17 18:49:49 CEST 2023
	- first version of JSON::SIMD, forked from JSON::XS
	- add simdjson decoder, make it the default
	- add decode_at_pointer method
	- add simdjson_version function