From 3f0b52dc73103cb51516a6ff95a20f173e4302ad Mon Sep 17 00:00:00 2001 From: Sebastiaan van Stijn Date: Tue, 23 Jun 2026 10:03:37 +0200 Subject: [PATCH] vendor: github.com/valyala/fastjson v1.6.7 - pool.go: add missing Arena.Reset() call inside ArenaPool.Put() - Treat nil values as null in SetArrayItem prevents a potential panic when a nil value is used as an array item full diff: https://github.com/valyala/fastjson/compare/v1.6.4...v1.6.7 Signed-off-by: Sebastiaan van Stijn --- go.mod | 2 +- go.sum | 4 ++-- vendor/github.com/valyala/fastjson/arena.go | 8 ++++---- vendor/github.com/valyala/fastjson/doc.go | 1 - vendor/github.com/valyala/fastjson/fuzz.go | 1 + vendor/github.com/valyala/fastjson/pool.go | 1 + vendor/github.com/valyala/fastjson/update.go | 3 +++ vendor/modules.txt | 2 +- 8 files changed, 13 insertions(+), 9 deletions(-) diff --git a/go.mod b/go.mod index a4b2ddcd3..33927eb4f 100644 --- a/go.mod +++ b/go.mod @@ -207,7 +207,7 @@ require ( github.com/tonistiigi/vt100 v0.0.0-20240514184818-90bafcd6abab // indirect github.com/transparency-dev/formats v0.1.1 // indirect github.com/transparency-dev/merkle v0.0.2 // indirect - github.com/valyala/fastjson v1.6.4 // indirect + github.com/valyala/fastjson v1.6.7 // indirect github.com/vektah/gqlparser/v2 v2.5.30 // indirect github.com/x448/float16 v0.8.4 // indirect github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect diff --git a/go.sum b/go.sum index 8d34d0d35..de58f8635 100644 --- a/go.sum +++ b/go.sum @@ -576,8 +576,8 @@ github.com/transparency-dev/formats v0.1.1 h1:4bVHJc+KdBgpA1OJD1yjI+g0i5Z1graCpp github.com/transparency-dev/formats v0.1.1/go.mod h1:qtZ8goRuJ8FTBG9c9+Bj0rn2rUG7eG/AUTkr+Aw3jFw= github.com/transparency-dev/merkle v0.0.2 h1:Q9nBoQcZcgPamMkGn7ghV8XiTZ/kRxn1yCG81+twTK4= github.com/transparency-dev/merkle v0.0.2/go.mod h1:pqSy+OXefQ1EDUVmAJ8MUhHB9TXGuzVAT58PqBoHz1A= -github.com/valyala/fastjson v1.6.4 h1:uAUNq9Z6ymTgGhcm0UynUAB6tlbakBrz6CQFax3BXVQ= -github.com/valyala/fastjson v1.6.4/go.mod h1:CLCAqky6SMuOcxStkYQvblddUtoRxhYMGLrsQns1aXY= +github.com/valyala/fastjson v1.6.7 h1:ZE4tRy0CIkh+qDc5McjatheGX2czdn8slQjomexVpBM= +github.com/valyala/fastjson v1.6.7/go.mod h1:CLCAqky6SMuOcxStkYQvblddUtoRxhYMGLrsQns1aXY= github.com/vbatts/tar-split v0.12.3 h1:Cd46rkGXI3Td4yrVNwU8ripbxFaQbmesqhjBUUYAJSw= github.com/vbatts/tar-split v0.12.3/go.mod h1:sQOc6OlqGCr7HkGx/IDBeKiTIvqhmj8KffNhEXG4Nq0= github.com/vektah/gqlparser/v2 v2.5.30 h1:EqLwGAFLIzt1wpx1IPpY67DwUujF1OfzgEyDsLrN6kE= diff --git a/vendor/github.com/valyala/fastjson/arena.go b/vendor/github.com/valyala/fastjson/arena.go index 9fe21a48c..1a512d5f3 100644 --- a/vendor/github.com/valyala/fastjson/arena.go +++ b/vendor/github.com/valyala/fastjson/arena.go @@ -8,10 +8,10 @@ import ( // // Typical Arena lifecycle: // -// 1) Construct Values via the Arena and Value.Set* calls. -// 2) Marshal the constructed Values with Value.MarshalTo call. -// 3) Reset all the constructed Values at once by Arena.Reset call. -// 4) Go to 1 and re-use the Arena. +// 1. Construct Values via the Arena and Value.Set* calls. +// 2. Marshal the constructed Values with Value.MarshalTo call. +// 3. Reset all the constructed Values at once by Arena.Reset call. +// 4. Go to 1 and re-use the Arena. // // It is unsafe calling Arena methods from concurrent goroutines. // Use per-goroutine Arenas or ArenaPool instead. diff --git a/vendor/github.com/valyala/fastjson/doc.go b/vendor/github.com/valyala/fastjson/doc.go index 8076189cf..3dbff364d 100644 --- a/vendor/github.com/valyala/fastjson/doc.go +++ b/vendor/github.com/valyala/fastjson/doc.go @@ -4,6 +4,5 @@ Package fastjson provides fast JSON parsing. Arbitrary JSON may be parsed by fastjson without the need for creating structs or for generating go code. Just parse JSON and get the required fields with Get* functions. - */ package fastjson diff --git a/vendor/github.com/valyala/fastjson/fuzz.go b/vendor/github.com/valyala/fastjson/fuzz.go index 9130797c7..d9da1f1ab 100644 --- a/vendor/github.com/valyala/fastjson/fuzz.go +++ b/vendor/github.com/valyala/fastjson/fuzz.go @@ -1,3 +1,4 @@ +//go:build gofuzz // +build gofuzz package fastjson diff --git a/vendor/github.com/valyala/fastjson/pool.go b/vendor/github.com/valyala/fastjson/pool.go index 00cfb42fa..3f40fb4e2 100644 --- a/vendor/github.com/valyala/fastjson/pool.go +++ b/vendor/github.com/valyala/fastjson/pool.go @@ -48,5 +48,6 @@ func (ap *ArenaPool) Get() *Arena { // // a and objects created by a cannot be used after a is put into ap. func (ap *ArenaPool) Put(a *Arena) { + a.Reset() ap.pool.Put(a) } diff --git a/vendor/github.com/valyala/fastjson/update.go b/vendor/github.com/valyala/fastjson/update.go index f8099bdbb..795b7fbd6 100644 --- a/vendor/github.com/valyala/fastjson/update.go +++ b/vendor/github.com/valyala/fastjson/update.go @@ -106,5 +106,8 @@ func (v *Value) SetArrayItem(idx int, value *Value) { for idx >= len(v.a) { v.a = append(v.a, valueNull) } + if value == nil { + value = valueNull + } v.a[idx] = value } diff --git a/vendor/modules.txt b/vendor/modules.txt index e1a8c48af..c6269b7d2 100644 --- a/vendor/modules.txt +++ b/vendor/modules.txt @@ -1131,7 +1131,7 @@ github.com/transparency-dev/merkle github.com/transparency-dev/merkle/compact github.com/transparency-dev/merkle/proof github.com/transparency-dev/merkle/rfc6962 -# github.com/valyala/fastjson v1.6.4 +# github.com/valyala/fastjson v1.6.7 ## explicit; go 1.12 github.com/valyala/fastjson github.com/valyala/fastjson/fastfloat