Repository navigation
fix(deps): update dependency com.alibaba:fastjson to v2.0.66 - #102
Open
renovate[bot] wants to merge 1 commit into
Open
renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
renovate
Bot
force-pushed
the
renovate/fastjson.version
branch
from
April 8, 2023 03:32
f6e5e74 to
016bfde
Compare
renovate
Bot
force-pushed
the
renovate/fastjson.version
branch
from
April 16, 2023 03:19
016bfde to
1db58e4
Compare
renovate
Bot
force-pushed
the
renovate/fastjson.version
branch
from
April 22, 2023 16:25
1db58e4 to
495770d
Compare
renovate
Bot
force-pushed
the
renovate/fastjson.version
branch
2 times, most recently
from
May 7, 2023 11:45
7a09576 to
03ed548
Compare
renovate
Bot
force-pushed
the
renovate/fastjson.version
branch
from
May 16, 2023 04:52
03ed548 to
49ad423
Compare
renovate
Bot
force-pushed
the
renovate/fastjson.version
branch
from
May 28, 2023 17:19
49ad423 to
1b62ee8
Compare
renovate
Bot
force-pushed
the
renovate/fastjson.version
branch
from
June 18, 2023 09:54
1b62ee8 to
2f0a32b
Compare
renovate
Bot
force-pushed
the
renovate/fastjson.version
branch
from
July 9, 2023 01:43
2f0a32b to
b48de37
Compare
renovate
Bot
force-pushed
the
renovate/fastjson.version
branch
2 times, most recently
from
July 22, 2023 12:48
2e4d824 to
366ed88
Compare
renovate
Bot
force-pushed
the
renovate/fastjson.version
branch
from
July 29, 2023 15:08
366ed88 to
7d8d493
Compare
renovate
Bot
force-pushed
the
renovate/fastjson.version
branch
from
August 14, 2023 17:32
7d8d493 to
4cbeebb
Compare
renovate
Bot
force-pushed
the
renovate/fastjson.version
branch
from
September 3, 2023 14:10
4cbeebb to
bc9ae36
Compare
renovate
Bot
force-pushed
the
renovate/fastjson.version
branch
from
October 6, 2023 03:56
bc9ae36 to
27b3c66
Compare
renovate
Bot
force-pushed
the
renovate/fastjson.version
branch
from
March 25, 2024 03:57
c33a926 to
eadb209
Compare
renovate
Bot
force-pushed
the
renovate/fastjson.version
branch
from
April 14, 2024 04:26
eadb209 to
a6ea5a9
Compare
renovate
Bot
force-pushed
the
renovate/fastjson.version
branch
from
May 12, 2024 03:27
a6ea5a9 to
beea3b7
Compare
renovate
Bot
force-pushed
the
renovate/fastjson.version
branch
from
June 1, 2024 09:38
beea3b7 to
afae83b
Compare
renovate
Bot
force-pushed
the
renovate/fastjson.version
branch
from
July 14, 2024 02:13
afae83b to
392924e
Compare
renovate
Bot
force-pushed
the
renovate/fastjson.version
branch
from
September 16, 2024 17:30
392924e to
78466e6
Compare
renovate
Bot
force-pushed
the
renovate/fastjson.version
branch
from
January 11, 2025 17:30
78466e6 to
79c5189
Compare
renovate
Bot
force-pushed
the
renovate/fastjson.version
branch
from
February 14, 2025 03:32
79c5189 to
2467ddf
Compare
renovate
Bot
force-pushed
the
renovate/fastjson.version
branch
from
February 22, 2025 02:11
2467ddf to
5a7243d
Compare
renovate
Bot
force-pushed
the
renovate/fastjson.version
branch
from
March 31, 2025 06:14
5a7243d to
be60e5e
Compare
renovate
Bot
force-pushed
the
renovate/fastjson.version
branch
from
July 30, 2025 06:31
be60e5e to
3fa22fc
Compare
renovate
Bot
force-pushed
the
renovate/fastjson.version
branch
from
September 22, 2025 01:14
3fa22fc to
866ced1
Compare
renovate
Bot
force-pushed
the
renovate/fastjson.version
branch
from
October 25, 2025 13:48
866ced1 to
9fdeac0
Compare
renovate
Bot
force-pushed
the
renovate/fastjson.version
branch
from
January 10, 2026 14:02
9fdeac0 to
31922fe
Compare
renovate
Bot
force-pushed
the
renovate/fastjson.version
branch
from
February 2, 2026 17:27
31922fe to
9575857
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Note
This PR body was truncated due to platform limits.
This PR contains the following updates:
2.0.25→2.0.66Release Notes
alibaba/fastjson2 (com.alibaba:fastjson)
v2.0.66Compare Source
What's Changed
New Contributors
Full Changelog: alibaba/fastjson2@2.0.65...2.0.66
v2.0.65: fastjson 2.0.65版本发布Compare Source
FASTJSON 2.0.65 Release Notes
Release Date: 2 Sep 2026
Tag: 2.0.65 (
879183e)Overview
This is a security fix release. It closes an AutoType authorization bypass reachable when
JSONReader.Feature.SupportAutoTypeis enabled, and includes parser/writer robustness fixes. All users are strongly recommended to upgrade, especially applications that parse untrusted JSON or JSONB with AutoType enabled.This release also restores
fastjson2-extension-spring6on Maven Central. It was missing for 2.0.62–2.0.64 because those releases were deployed with a JDK that did not activate theenable-for-17+build profile, so the module never entered the build reactor #7840.The Android variants
2.0.65.android5and2.0.65.android8carry the same AutoType security fix #7843 #7844.Security Fixes
@typeis no longer treated as authorization. All untrusted-input paths (JSON and JSONB readers, and the object readers for beans, interfaces, exceptions, adapters, typed maps, arrays, collections and no-default-constructor types) now resolve@typethrough the full provider security checks — SafeMode, deny lists, type-name validation, and any user-suppliedAutoTypeBeforeHandler. Compatibility is preserved for explicit local mappings declared with@JSONType(seeAlso = ...)and for readers annotated with@JSONType(... SupportAutoType)#7753Bug Fixes
ArrayIndexOutOfBoundsExceptioninJSONReaderASCIIfield-name decoding, triggered by a field name that combines an escape sequence with latin1 bytes >= 0x80 #7808 #7836char/Characterfields, which caused NPEs or lost field values #7719NullPointerExceptionwhen serializing a Kotlin class withoutkotlin-reflecton the classpath #7835Documentation
Maven Dependency Configuration
Standard Version
Spring 6 Extension
Android 5 Optimized Version
Android 8 Optimized Version
中文版本
概述
本版本为安全修复版本,修复了在开启
JSONReader.Feature.SupportAutoType时可触达的 AutoType 授权绕过问题,并包含解析/序列化的健壮性修复。强烈建议所有用户升级,尤其是解析不可信 JSON / JSONB 且开启了 AutoType 的应用。本版本同时恢复了 Maven Central 上的
fastjson2-extension-spring6。2.0.62~2.0.64 缺失该模块,原因是这几个版本发布时使用的 JDK 未激活enable-for-17+构建 profile,模块没有进入构建 reactor #7840。Android 变体
2.0.65.android5与2.0.65.android8已同步 port 该 AutoType 安全修复 #7843 #7844。安全修复
@type的 FNV-1a-64 哈希命中 reader 缓存不再被视为授权。所有不可信输入路径(JSON 与 JSONB reader,以及 bean、接口、异常、adapter、typed map、数组、集合、无默认构造类型的 object reader)现在都会让@type经过 provider 的完整安全检查——SafeMode、deny 列表、类型名校验,以及用户提供的AutoTypeBeforeHandler。同时保留兼容行为:@JSONType(seeAlso = ...)声明的显式局部映射,以及标注了@JSONType(... SupportAutoType)的 reader #7753问题修复
JSONReaderASCII字段名解码的ArrayIndexOutOfBoundsException——当字段名同时包含转义序列和 >= 0x80 的 latin1 字节时触发 #7808 #7836char/Character字段时 getter 方法被静默丢弃,导致空指针异常或字段值丢失的问题 #7719kotlin-reflect时序列化 Kotlin 类抛出NullPointerException的问题 #7835文档
Maven 依赖配置
标准版本
Spring 6 扩展
Android 5 优化版本
Android 8 优化版本
v2.0.64: fastjson 2.0.64版本发布Compare Source
FASTJSON 2.0.64 Release Notes
Release Date: 2 Aug 2026
Tag: 2.0.64
Overview
This is a bug fix release. It fixes several issues in core serialization/deserialization, Java records support, and the fastjson 1.x compatibility layer. All users are recommended to upgrade.
Bug Fixes
ClassFormatErrorwhen serializing classes with array-typed fields #4009 #4014strBufnot kept in sync after mid-loop growth, which could produce corrupted output #7671 #7676MethodHandles.Lookupinitialization order — initialize before readingIMPL_LOOKUP#7691 #7718additionalItemsschema validation for Java arrays #7709serialVersionUIDtoJSONArrayfor Java serialization compatibility #7687 #7698ParserConfig.propertyNamingStrategyfor fastjson 1.x compatibility #7740Maven Dependency Configuration
Standard Version
Android 5 Optimized Version
Android 8 Optimized Version
中文版本
概述
本版本为问题修复版本,修复了核心序列化/反序列化、Java records 支持以及 fastjson 1.x 兼容层中的多个问题。建议所有用户升级。
问题修复
ClassFormatError的问题 #4009 #4014strBuf未同步,可能导致输出损坏的问题 #7671 #7676MethodHandles.Lookup初始化顺序——在读取IMPL_LOOKUP之前完成初始化 #7691 #7718additionalItemsschema 校验 #7709JSONArray添加serialVersionUID,兼容 Java 序列化 #7687 #7698ParserConfig.propertyNamingStrategy,兼容 fastjson 1.x #7740Maven 依赖配置
标准版本
Android 5 优化版本
Android 8 优化版本
v2.0.63: fastjson 2.0.63版本发布Compare Source
FASTJSON 2.0.63 Release Notes
Release Date: 29 Jul 2026
Tag: 2.0.63 (
82eda3e)Overview
This is a security fix release. It hardens AutoType deserialization and fixes several parser robustness issues (OOM / DoS) that can be triggered by crafted input. All users are strongly recommended to upgrade, especially applications parsing untrusted JSON or JSONB data.
Users who cannot upgrade immediately can mitigate the AutoType issue with
-Dfastjson2.parser.safeMode=true(applications not using a customAutoTypeBeforeHandler).fastjson 1.x users: the same AutoType hardening is available in fastjson 1.2.84.
Security Fixes
ClassLoader/DataSource/RowSetgadget base types — only an accept entry naming the type in full is treated as an explicit opt-in #7703BigIntegerO(n²) DoS with crafted long number literals #7668 #7694BC_BIGINTdeclared-length OOM from crafted payloads declaring a huge length #7669 #7696BC_BINARYdeclared-length OOM #7669 #7705Changes & Bug Fixes
Collectionelements (e.g.HashSet), duplicate elements now serialize as$refwhenReferenceDetectionis on #7678 #7701ObjectWritercreated in the switch block ofgetObjectWriterInternal#7626 #7627getInt/setIntout of lambda to avoid per-call spin #7677 #7693Maven Dependency Configuration
Standard Version
Android 5 Optimized Version
Android 8 Optimized Version
中文版本
概述
本版本为安全修复版本,加固了 AutoType 反序列化校验,并修复了多个可由构造输入触发的解析健壮性问题(OOM / DoS)。强烈建议所有用户升级,尤其是解析不可信 JSON 或 JSONB 数据的应用。
暂时无法升级的用户,可通过
-Dfastjson2.parser.safeMode=true缓解 AutoType 问题(适用于未使用自定义AutoTypeBeforeHandler的应用)。fastjson 1.x 用户:同款 AutoType 加固已在 fastjson 1.2.84 中提供。
安全修复
ClassLoader/DataSource/RowSet等危险基类——只有完整类名的 accept 条目才视为显式放行 #7703BigIntegerO(n²) DoS #7668 #7694BC_BIGINT声明长度 OOM(构造超大长度声明的 payload)#7669 #7696BC_BINARY声明长度 OOM #7669 #7705变更与问题修复
Collection元素(如HashSet)缺少引用检测的问题,开启ReferenceDetection时重复元素现在正确序列化为$ref#7678 #7701getObjectWriterInternalswitch 分支中创建的ObjectWriter未缓存导致的 Metaspace 泄漏 #7626 #7627getInt/setInt移出 lambda,避免每次调用自旋 #7677 #7693Maven 依赖配置
标准版本
Android 5 优化版本
Android 8 优化版本
v2.0.62Compare Source
v2.0.61: fastjson 2.0.61版本发布Compare Source
FASTJSON 2.0.61 Release Notes
Release Date: 07 Feb 2026
Tag: 2.0.61 (
170f71f)Overview
This is a regularly scheduled maintenance release with feature enhancements, performance improvements, and bug fixes. Users should upgrade as needed.
Changes & Bug Fixes
@JsonPropertyon methods was being ignored in record types #3893ArrayIndexOutOfBoundsExceptionissues inJSONReaderUTF8,JSONReaderASCII, andJSONReader#3883@JSONFieldformat #3864TypeUtils.castToTimestampcompatibility issues when upgrading from 1.2.83 #3906 #3907getStringand othergetXXXmethods #3880TypeUtils.castwith Long global converter #3932TimeModulesupport including improvedYearMonthsupport #3934 #3935org.w3c.dom.Node#3960Listsubclasses during deserialization #3926parse(InputStream)overload with default context #3946DirectByteBufferUnsupportedOperationExceptionforjava.nio.ByteBuffer#array#3894PropertyFilter,PropertyPreFilter, etc.) #3877BigIntegerasDoublereadStringperformance inJSONReaderUTF8/JSONReaderUTF16WriteNulls,ErrorOnNullForPrimitives,NotWriteDefaultValue, and other features-Dfastjson2.creator=reflect#1563Maven Dependency Configuration
Standard Version
Android 5 Optimized Version
Android 8 Optimized Version (supports java.time and Optional)
1.x Compatible Version
Spring 5 Extension
Spring 6 Extension
JAX-RS Extension
JAX-RS Jakarta Extension
Related Links
FASTJSON 2.0.61 发布说明
发布日期: 2026年2月7日
标签: 2.0.61 (
170f71f)概述
这是定期维护版本,包含功能增强、性能改进和问题修复。建议用户根据需要升级。
变更与问题修复
@JsonProperty注解在 record 类型的方法上被忽略的问题 #3893JSONReaderUTF8、JSONReaderASCII和JSONReader中的多个ArrayIndexOutOfBoundsException问题 #3883@JSONFieldformat 格式的冲突问题 #3864TypeUtils.castToTimestamp的兼容性问题 #3906 #3907getString等getXXX方法新增默认值参数支持 #3880TypeUtils.cast出现双引号的问题 #3932TimeModule支持,包括改进的YearMonth支持 #3934 #3935org.w3c.dom.Node的序列化支持 #3960List子类在反序列化时无法自动推断泛型类型的问题 #3926parse(InputStream)重载方法 #3946DirectByteBuffer调用java.nio.ByteBuffer#array时的UnsupportedOperationException#3894PropertyFilter、PropertyPreFilter等)#3877BigInteger解析为Double时溢出检查不正确的问题JSONReaderUTF8/JSONReaderUTF16的readString性能WriteNulls、ErrorOnNullForPrimitives、NotWriteDefaultValue等特性的多个问题-Dfastjson2.creator=reflect时的类型转换错误 #1563Maven 依赖配置
标准版本
Android 5 优化版本
Android 8 优化版本(支持 java.time 和 Optional)
1.x 兼容版本
Spring 5 扩展
Spring 6 扩展
JAX-RS 扩展
JAX-RS Jakarta 扩展
相关链接
v2.0.60: fastjson 2.0.60发布Compare Source
这又是一个定期维护的功能增强BUG FIX版本,大家按需升级。
Issues
@ JsonProperties之后结果错误的问题 #3799java.util.Collections#EMPTY_LIST报错的问题 #3828MAVEN依赖配置
这个版本支持java.time和Optional
3. 相关链接
v2.0.59: fastjson 2.0.59发布Compare Source
这又是一个定期维护的功能增强BUG FIX版本,大家按需升级。
Issues
MAVEN依赖配置
这个版本支持java.time和Optional
3. 相关链接
v2.0.58: Fastjson 2.0.58版本发布Compare Source
这又是一个定期维护的功能增强BUG FIX版本,大家按需升级。
@JSONField(defaultValue="")和fastjson 1.x不兼容的问题MAVEN依赖配置
这个版本支持java.time和Optional
3. 相关链接
v2.0.57: Fastjson 2.0.57版本发布Compare Source
这又是一个定期维护的功能增强BUG FIX版本,大家按需升级。
Issues
MAVEN依赖配置
这个版本支持java.time和Optional
3. 相关链接
v2.0.56: fastjson 2.0.56版本发布,性能进一步提升Compare Source
这个版本进一步提升了性能,并且修复了2.0.54发布以来用户反馈的BUG。
Issues
@type且位置不在json串开始位置时和fastjson 1.x行为不一致的问题 #3284MAVEN依赖配置
这个版本支持java.time和Optional