From 61223a5a6623b3c2787f943aaae190574c06f5c9 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Wed, 29 Jul 2026 23:19:17 +0000
Subject: [PATCH] chore(deps): bump fastjson2 to 2.0.63
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Upgrades the JSON engine from 2.0.62 to 2.0.63. The release is security
hardening plus robustness fixes with no API changes:

- stricter AutoType validation (URL-special characters rejected before
  class loading; whitelist hash matches now text-verified)
- number literal digit limit guarding against BigInteger DoS
- JSONB BC_BIGINT / BC_BINARY declared-length OOM fixes
- Metaspace leak fix for uncached ObjectWriter instances

Also refreshes the fastjson2 row in the README dependency table, which
had drifted (still listed 2.0.61 while the pom was on 2.0.62).

Verified: full reactor `mvn clean install` green (482 tests, 0 failures)
and `./allocation-check.sh` within budget on all 8 benchmarks — no
allocation regression on the hot encode paths.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TEnyP2T2hu5ymBfYKEKUoo
---
 README.md | 2 +-
 pom.xml   | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/README.md b/README.md
index cd2a5ce..35dd558 100644
--- a/README.md
+++ b/README.md
@@ -309,7 +309,7 @@ buff-json/
 |                  Dependency                   | Version |                Purpose                 |           Module(s)           |
 |-----------------------------------------------|---------|----------------------------------------|-------------------------------|
 | `com.google.protobuf:protobuf-java`           | 4.34.1  | Protobuf runtime (Message, Descriptor) | core, schema, jackson, plugin |
-| `com.alibaba.fastjson2:fastjson2`             | 2.0.61  | JSON writing engine                    | core, jackson                 |
+| `com.alibaba.fastjson2:fastjson2`             | 2.0.63  | JSON writing engine                    | core, jackson                 |
 | `com.fasterxml.jackson.core:jackson-databind` | 2.18.1  | Jackson ObjectMapper integration       | jackson                       |
 | `io.swagger.core.v3:swagger-core-jakarta`     | 2.2.38  | Swagger/OpenAPI ModelConverter         | swagger                       |
 
diff --git a/pom.xml b/pom.xml
index 452e8e0..2029344 100644
--- a/pom.xml
+++ b/pom.xml
@@ -44,7 +44,7 @@
 
     <properties>
         <central-publishing-maven-plugin.version>0.7.0</central-publishing-maven-plugin.version>
-        <fastjson2.version>2.0.62</fastjson2.version>
+        <fastjson2.version>2.0.63</fastjson2.version>
         <flatten-maven-plugin.version>1.6.0</flatten-maven-plugin.version>
         <jackson-databind.version>2.18.1</jackson-databind.version>
         <jackson-datatype-protobuf.version>0.9.18</jackson-datatype-protobuf.version>