Bound diff()'s descent with a depth count instead of scanning the source

Now that operator== no longer recurses (#5390), diff() can keep its per-level equality shortcut all the way down. It diffs recursively for the first detail::recursion_depth_limit() levels, as merge_patch() does, and hands anything deeper to diff_iteratively(). The nesting_exceeds() scan, which cost about 30% on equal documents, is gone, and diff() is on par with develop again. Signed-off-by: Niels Lohmann <mail@nlohmann.me>
Merge remote-tracking branch 'origin/develop' into claude/iterative-diff
2026-09-26 01:40:32 +00:00 · 2026-09-25 22:23:57 +02:00 · 2026-09-25 22:19:57 +02:00 · 2026-09-25 21:57:28 +02:00 · 2026-09-25 21:56:39 +02:00 · 2026-09-25 21:54:11 +02:00
67 changed files with 4835 additions and 1201 deletions
@@ -9,12 +9,23 @@ identified a security vulnerability in this repository, please use the GitHub Se
 Until it is published, this draft security advisory will only be visible to the maintainers of this project. Other
 users and teams may be added once the advisory is created.

-We will send a response indicating the next steps in handling your report. After the initial reply to your report, we
-will keep you informed of the progress towards a fix and full announcement and may ask for additional information or
-guidance.
+We will send a first response within 14 days, indicating the next steps in handling your report. After the initial
+reply to your report, we will keep you informed of the progress towards a fix and full announcement and may ask for
+additional information or guidance.

 For vulnerabilities in third-party dependencies or modules, please report them directly to the respective maintainers.

+## Disclosure and credit
+
+Once a fix is released, we publish the security advisory and list the fixed vulnerability in the release notes. We
+credit the reporter in both, unless they ask not to be named.
+
+## Supported versions
+
+Security fixes are made on the `develop` branch and shipped with the next release. Only the latest release receives
+security fixes; they are not backported to older releases. A release stops receiving security fixes when the next
+release is published, so please update to the latest release to get them.
+
 ## Unofficial packages

 This project does not publish an official npm package. The npm package
@@ -3,6 +3,10 @@ name: "Check amalgamation"
 on:
  pull_request:

+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref || github.run_id }}
+  cancel-in-progress: true
+
 permissions:
  contents: read

@@ -1,6 +1,10 @@
 name: CIFuzz
 on: [pull_request]

+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref || github.run_id }}
+  cancel-in-progress: true
+
 permissions:
  contents: read

@@ -38,14 +38,14 @@ jobs:

    # Initializes the CodeQL tools for scanning.
    - name: Initialize CodeQL
-      uses: github/codeql-action/init@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
+      uses: github/codeql-action/init@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
      with:
        languages: c-cpp

    # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
    # If this step fails, then you should remove it and run the build manually (see below)
    - name: Autobuild
-      uses: github/codeql-action/autobuild@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
+      uses: github/codeql-action/autobuild@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1

    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
+      uses: github/codeql-action/analyze@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
@@ -9,6 +9,10 @@
 name: 'Dependency Review'
 on: [pull_request]

+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref || github.run_id }}
+  cancel-in-progress: true
+
 permissions:
  contents: read

@@ -5,6 +5,10 @@

 name: flawfinder

+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref || github.run_id }}
+  cancel-in-progress: true
+
 permissions:
  contents: read

@@ -43,6 +47,6 @@ jobs:
          output: 'flawfinder_results.sarif'

      - name: Upload analysis results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
+        uses: github/codeql-action/upload-sarif@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
        with:
          sarif_file: ${{github.workspace}}/flawfinder_results.sarif
@@ -4,6 +4,12 @@ on:
  pull_request_target:
    types: [opened, synchronize]

+# pull_request_target runs on the base branch, so github.ref would put all pull
+# requests into one group; group by pull request number instead
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: true
+
 permissions:
  contents: read

@@ -14,6 +14,10 @@ on:
  push:
    branches: ["develop"]

+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref || github.run_id }}
+  cancel-in-progress: true
+
 permissions:
  contents: read

@@ -76,6 +80,6 @@ jobs:

      # Upload the results to GitHub's code scanning dashboard.
      - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
+        uses: github/codeql-action/upload-sarif@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
        with:
          sarif_file: results.sarif
@@ -19,6 +19,10 @@ on:
  schedule:
    - cron: '23 2 * * 4'

+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref || github.run_id }}
+  cancel-in-progress: true
+
 permissions:
  contents: read

@@ -61,7 +65,7 @@ jobs:

      # Upload SARIF file generated in previous step
      - name: Upload SARIF file
-        uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
+        uses: github/codeql-action/upload-sarif@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
        with:
          sarif_file: semgrep.sarif
        if: always()
@@ -17,7 +17,7 @@
 [![GitHub Downloads](https://img.shields.io/github/downloads/nlohmann/json/total)](https://github.com/nlohmann/json/releases)
 [![GitHub Issues](https://img.shields.io/github/issues/nlohmann/json.svg)](https://github.com/nlohmann/json/issues)
 [![Average time to resolve an issue](https://isitmaintained.com/badge/resolution/nlohmann/json.svg)](https://isitmaintained.com/project/nlohmann/json "Average time to resolve an issue")
-[![CII Best Practices](https://bestpractices.coreinfrastructure.org/projects/289/badge)](https://bestpractices.coreinfrastructure.org/projects/289)
+[![OpenSSF Best Practices](https://www.bestpractices.dev/projects/289/badge)](https://www.bestpractices.dev/projects/289)
 [![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/nlohmann/json/badge)](https://scorecard.dev/viewer/?uri=github.com/nlohmann/json)
 [![Backup Status](https://app.cloudback.it/badge/nlohmann/json)](https://cloudback.it)
 [![GitHub Sponsors](https://img.shields.io/badge/GitHub-Sponsors-ff69b4)](https://github.com/sponsors/nlohmann)
@@ -63,7 +63,7 @@ There are myriads of [JSON](https://json.org) libraries out there, and each may

 - **Trivial integration**. Our whole code consists of a single header file [`json.hpp`](https://github.com/nlohmann/json/blob/develop/single_include/nlohmann/json.hpp). That's it. No library, no subproject, no dependencies, no complex build system. The class is written in vanilla C++11. All in all, everything should require no adjustment of your compiler flags or project settings. The library is also included in all popular [package managers](https://json.nlohmann.me/integration/package_managers/).

- **Serious testing**. Our code is heavily [unit-tested](https://github.com/nlohmann/json/tree/develop/tests/src) and covers [100%](https://coveralls.io/r/nlohmann/json) of the code, including all exceptional behavior. Furthermore, we checked with [Valgrind](https://valgrind.org) and the [Clang Sanitizers](https://clang.llvm.org/docs/index.html) that there are no memory leaks. [Google OSS-Fuzz](https://github.com/google/oss-fuzz/tree/master/projects/json) additionally runs fuzz tests against all parsers 24/7, effectively executing billions of tests so far. To maintain high quality, the project is following the [Core Infrastructure Initiative (CII) best practices](https://bestpractices.coreinfrastructure.org/projects/289). See the [quality assurance](https://json.nlohmann.me/community/quality_assurance) overview documentation.
+- **Serious testing**. Our code is heavily [unit-tested](https://github.com/nlohmann/json/tree/develop/tests/src) and covers [100%](https://coveralls.io/r/nlohmann/json) of the code, including all exceptional behavior. Furthermore, we checked with [Valgrind](https://valgrind.org) and the [Clang Sanitizers](https://clang.llvm.org/docs/index.html) that there are no memory leaks. [Google OSS-Fuzz](https://github.com/google/oss-fuzz/tree/master/projects/json) additionally runs fuzz tests against all parsers 24/7, effectively executing billions of tests so far. To maintain high quality, the project is following the [OpenSSF Best Practices](https://www.bestpractices.dev/projects/289). See the [quality assurance](https://json.nlohmann.me/community/quality_assurance) overview documentation.

 Other aspects were not so important to us:

@@ -619,7 +619,7 @@ add_custom_target(ci_single_binaries
 add_custom_target(ci_benchmarks
    COMMAND ${CMAKE_COMMAND}
        -DCMAKE_BUILD_TYPE=Release -GNinja
-        -S${PROJECT_SOURCE_DIR}/benchmarks -B${PROJECT_BINARY_DIR}/build_benchmarks
+        -S${PROJECT_SOURCE_DIR}/tests/benchmarks -B${PROJECT_BINARY_DIR}/build_benchmarks
    COMMAND ${CMAKE_COMMAND} --build ${PROJECT_BINARY_DIR}/build_benchmarks --target json_benchmarks
    COMMAND cd ${PROJECT_BINARY_DIR}/build_benchmarks && ./json_benchmarks
    COMMENT "Run benchmarks"
@@ -77,7 +77,7 @@ if(CMAKE_CROSSCOMPILING)
 endif()
 if(NOT DEFINED LIBCPP_VERSION_OUTPUT_CACHED)
    try_run(RUN_RESULT_VAR COMPILE_RESULT_VAR
-        "${CMAKE_BINARY_DIR}" SOURCES "${CMAKE_SOURCE_DIR}/cmake/detect_libcpp_version.cpp"
+        "${CMAKE_BINARY_DIR}" SOURCES "${CMAKE_CURRENT_LIST_DIR}/detect_libcpp_version.cpp"
        RUN_OUTPUT_VARIABLE LIBCPP_VERSION_OUTPUT
        COMPILE_OUTPUT_VARIABLE LIBCPP_VERSION_COMPILE_OUTPUT
    )
@@ -46,9 +46,8 @@ Strong guarantee: if an exception is thrown, there are no changes in the JSON va

 ## Complexity

-Proportional to the size of the JSON value `j` multiplied by its maximum nesting
-depth, `O(n × d)`. BSON length prefixes are computed recursively before nested
-values are written.
+Linear in the size of the JSON value `j`. The length prefixes of all nested documents and arrays are computed in one
+pass before anything is written.

 ## Examples

@@ -77,3 +76,4 @@ values are written.
 ## Version history

 - Added in version 3.4.0.
+- Linear in the size of `j`, and no longer limited by the call stack for deeply nested values, since version 3.13.0.
@@ -65,6 +65,12 @@ The default value is `0` (disabled — existing behavior is preserved).
    for CBOR or MessagePack, are never affected by this trimming; their full extent - including a genuine trailing
    `0x00` - is always preserved, in both states of this macro.

+!!! note "ABI compatibility"
+
+    The value of this macro is encoded in the [namespace](../../features/namespace.md) (tag `_snul`), resulting in
+    distinct symbol names. Translation units compiled with and without it can therefore be linked into the same program
+    without One Definition Rule (ODR) violations, but they cannot exchange instances of library types.
+
 !!! tip "Workaround without the macro"

    To reject a NUL byte without enabling this macro, trim your input yourself before calling `parse()`:
@@ -57,7 +57,8 @@ Summary:
 :   name of the base type (class, struct) `type` is derived from

 `member` (in)
-:   name of the member variable to serialize/deserialize; up to 63 members can be given as a comma-separated list
+:   name of the member variable to serialize/deserialize; up to 63 members can be given as a comma-separated
+    list, which may also be empty

 ## Default definition

@@ -127,6 +128,20 @@ void to_json(BasicJsonType& j, const B& b) {
    - Macros 4, 5, and 6 have the same prerequisites of [NLOHMANN_DEFINE_TYPE_NON_INTRUSIVE](nlohmann_define_type_non_intrusive.md).
    - Serialization/deserialization of base types must be defined.

+!!! info "Derived types without own members"
+
+    The member list may be empty. The macro then generates a `to_json`/`from_json` pair that only delegates to
+    the base type, so `type` serializes exactly like `base_type`:
+
+    ```cpp
+    struct derived : base
+    {
+        NLOHMANN_DEFINE_DERIVED_TYPE_INTRUSIVE(derived, base)
+    };
+    ```
+
+    The `WITH_NAMES` variants do not support this.
+
 !!! warning "Implementation limits"

    See Implementation limits for [NLOHMANN_DEFINE_TYPE_INTRUSIVE](nlohmann_define_type_intrusive.md) and
@@ -33,7 +33,8 @@ Summary:
 :   name of the type (class, struct) to serialize/deserialize

 `member` (in)
-:   name of the member variable to serialize/deserialize; up to 63 members can be given as a comma-separated list
+:   name of the member variable to serialize/deserialize; up to 63 members can be given as a comma-separated
+    list, which may also be empty

 ## Default definition

@@ -58,6 +59,20 @@ See the examples below for the concrete generated code.

 [GetNonDefNonCopy]: ../../features/arbitrary_types.md#how-can-i-use-get-for-non-default-constructiblenon-copyable-types

+!!! info "Types without members"
+
+    The member list may be empty. The macro then generates a `to_json` that produces an empty JSON object
+    `#!json {}`, and a `from_json` that reads no members:
+
+    ```cpp
+    struct marker
+    {
+        NLOHMANN_DEFINE_TYPE_INTRUSIVE(marker)
+    };
+    ```
+
+    The `WITH_NAMES` variants do not support this.
+
 !!! warning "Implementation limits"

    - The current implementation is limited to at most 63 member variables. If you want to serialize/deserialize types
@@ -33,7 +33,8 @@ Summary:
 :   name of the type (class, struct) to serialize/deserialize

 `member` (in)
-:   name of the (public) member variable to serialize/deserialize; up to 63 members can be given as a comma-separated list
+:   name of the (public) member variable to serialize/deserialize; up to 63 members can be given as a
+    comma-separated list, which may also be empty

 ## Default definition

@@ -59,6 +60,18 @@ See the examples below for the concrete generated code.

 [GetNonDefNonCopy]: ../../features/arbitrary_types.md#how-can-i-use-get-for-non-default-constructiblenon-copyable-types

+!!! info "Types without members"
+
+    The member list may be empty. The macro then generates a `to_json` that produces an empty JSON object
+    `#!json {}`, and a `from_json` that reads no members:
+
+    ```cpp
+    struct marker {};
+    NLOHMANN_DEFINE_TYPE_NON_INTRUSIVE(marker)
+    ```
+
+    The `WITH_NAMES` variants do not support this.
+
 !!! warning "Implementation limits"

    - The current implementation is limited to at most 63 member variables. If you want to serialize/deserialize types
@@ -43,8 +43,8 @@ that an attacker controls, passed to [`parse`](../api/basic_json/parse.md), [`ac
  user code. The destructor does not recurse, so destroying a deeply nested value does not exhaust the stack.
 - **Bounded recursion.** The JSON parser and the binary readers keep their state in explicit stacks instead of
  recursing per nesting level. Operations that walk a value, such as [`dump`](../api/basic_json/dump.md), copying,
-  hashing, and [`merge_patch`](../api/basic_json/merge_patch.md), recurse only up to a fixed depth and continue with an
-  explicit stack below it. Some operations, such as comparison, [`diff`](../api/basic_json/diff.md),
+  comparison, hashing, and [`merge_patch`](../api/basic_json/merge_patch.md), recurse only up to a fixed depth and
+  continue with an explicit stack below it. Some operations, such as [`diff`](../api/basic_json/diff.md),
  [`flatten`](../api/basic_json/flatten.md), and the binary writers, still recurse once per nesting level; work on them
  is in progress. Applications that process untrusted input can limit its nesting depth with a
  [parser callback](../features/parsing/parser_callbacks.md).
@@ -91,6 +91,31 @@ activities include (but are not limited to):
 Users who continue to engage with the project and its community will often find themselves becoming more and more
 involved. Such users may then go on to become contributors, as described above.

+## Access to project resources
+
+The project's resources are the [GitHub repository](https://github.com/nlohmann/json) with its settings, CI workflows
+and secrets, and the documentation at [json.nlohmann.me](https://json.nlohmann.me), which is built and deployed from
+the repository. Currently, the project lead is the only person with write or admin access to them.
+
+### Granting access
+
+Write or admin access is only granted by the project lead, and only to a contributor whose track record in the project
+the project lead has reviewed first. The role is assigned manually and is the lowest one that is needed for the task.
+Access is removed when it is no longer needed. GitHub requires two-factor authentication for everyone who can modify the
+repository.
+
+### Secrets
+
+The CI workflows mostly use the token that GitHub creates for each workflow run. It is read-only by default, and each
+workflow requests only the additional permissions it needs. The few other credentials, such as the token for
+[Semgrep](https://semgrep.dev), are stored as encrypted GitHub Actions secrets:
+
+- Only people with admin access can create, change, or delete them. Their values cannot be read back, not even by
+  admins.
+- They are not passed to workflows that run for pull requests from forks.
+- They must never be committed to the repository or printed in logs.
+- They are rotated whenever someone with admin access leaves the project, and immediately if a leak is suspected.
+
 ## Support

 All participants in the community are encouraged to provide support for new users within the project management
@@ -200,6 +200,25 @@ Note: Some modern features (like C++20 ranges or filesystem support) may be disa
 - [x] The test suite is executed with [Sanitizers](https://github.com/google/sanitizers) (address sanitizer, undefined
  behavior sanitizer, integer overflow detection, nullability violations).

+## Dependencies
+
+!!! success "Requirement: No vulnerable dependencies"
+
+    The library has no dependencies besides the C++ standard library. The tools used to build, test, and document it
+    are kept free of known vulnerabilities.
+
+- [x] GitHub Actions are pinned to a commit hash, and the Python packages used by the documentation and the tools are
+  pinned to exact versions.
+- [x] [Dependabot](https://docs.github.com/en/code-security/dependabot) checks these dependencies daily and proposes
+  updates as pull requests.
+- [x] Every pull request is checked with the
+  [dependency review action](https://github.com/actions/dependency-review-action). A pull request that adds a
+  dependency with a known vulnerability of any severity fails this check and is not merged.
+- [x] Vulnerability alerts for dependencies are fixed or dismissed with a documented reason before the next release.
+  No release is made while such an alert is open.
+- [x] Third-party code included in the repository for testing, such as [doctest](https://github.com/doctest/doctest),
+  is updated manually.
+
 ## Style check

 !!! success "Requirement: Common code style"
@@ -215,6 +215,24 @@ For _derived_ classes and structs, use the following macros
    nlohmann::ordered_json j = p; // keys appear in declaration order: name, address, age
    ```

+!!! note "Zero-member types"
+
+    All 12 `NLOHMANN_DEFINE_TYPE_*`/`NLOHMANN_DEFINE_DERIVED_TYPE_*` macros (excluding the `WITH_NAMES` variants)
+    also accept types with no member variables to serialize, producing/accepting an empty JSON object `{}`
+    (or, for the derived-type macros, just the base class's own JSON representation):
+
+    ```cpp
+    namespace ns {
+        struct marker {
+            bool operator==(const marker&) const { return true; }
+            NLOHMANN_DEFINE_TYPE_INTRUSIVE(marker)
+        };
+    }
+
+    ns::marker m{};
+    nlohmann::json j = m; // {}
+    ```
+
 !!! note "No macro for non-default-constructible types"

    There is currently no `NLOHMANN_DEFINE_TYPE_*`-style macro for types that are not
@@ -109,6 +109,15 @@ The library maps BSON record types to JSON value types as follows:
    If BSON input must be validated for strict specification compliance, validate it separately before passing it to
    `from_bson()`.

+!!! warning "UTF-8 validation of string values"
+
+    The BSON specification requires `string` values (type `0x02`) to be valid UTF-8. This library validates the
+    bytes of every such string at decode time and rejects ill-formed UTF-8 with a
+    [`parse_error.113`](../../home/exceptions.md#jsonexceptionparse_error113) exception (or, with `allow_exceptions`
+    set to `false`, a discarded value), rather than only failing later when the resulting value is dumped. Element
+    (key) names and `binary` values (type `0x05`) are unaffected and are never validated, since they are read
+    byte-by-byte as a C string, or are not required to hold text, respectively.
+
 ??? example

    ```cpp
@@ -176,6 +176,16 @@ The library maps CBOR types to JSON value types as follows:

    CBOR allows map keys of any type, whereas JSON only allows strings as keys in object values. Therefore, CBOR maps with keys other than UTF-8 strings are rejected.

+!!! warning "UTF-8 validation of text strings"
+
+    [RFC 8949, Section 3.1](https://www.rfc-editor.org/rfc/rfc8949.html#section-3.1) requires CBOR text strings
+    (major type 3) to be valid UTF-8. This library validates the bytes of every text string (object keys included) at
+    decode time and rejects ill-formed UTF-8 with a
+    [`parse_error.113`](../../home/exceptions.md#jsonexceptionparse_error113) exception (or, with
+    `allow_exceptions` set to `false`, a discarded value), rather than only failing later when the resulting value is
+    dumped. Byte strings (major type 2) are unaffected and are never validated, since they are not required to hold
+    text.
+
 !!! warning "Tagged items"

    Tagged items (0xC0..0xDB) will throw a parse error by default. They can be ignored by passing `cbor_tag_handler_t::ignore` to function `from_cbor`, in which case the tag is skipped and the enclosed data item is parsed on its own. They can be stored by passing `cbor_tag_handler_t::store` to function `from_cbor`. Note that no tag is ever interpreted: for instance, a text string tagged with tag 0 (date/time) stays a string.
@@ -136,6 +136,14 @@ The library maps MessagePack types to JSON value types as follows:

    Any MessagePack output created by `to_msgpack` can be successfully parsed by `from_msgpack`.

+!!! warning "UTF-8 validation of string values"
+
+    The MessagePack specification requires `str` values (`fixstr`, `str 8`, `str 16`, `str 32`) to be valid UTF-8.
+    This library validates the bytes of every such string (object keys included) at decode time and rejects
+    ill-formed UTF-8 with a [`parse_error.113`](../../home/exceptions.md#jsonexceptionparse_error113) exception (or,
+    with `allow_exceptions` set to `false`, a discarded value), rather than only failing later when the resulting
+    value is dumped. `bin`/`ext`/`fixext` values are unaffected and are never validated, since they are not required
+    to hold text.

 ??? example

@@ -19,6 +19,7 @@ The complete default namespace name is derived as follows:
    - [`JSON_BRACE_INIT_COPY_SEMANTICS`](../api/macros/json_brace_init_copy_semantics.md) defined non-zero appends
      `_bics`.
    - [`JSON_PRECISE_STREAM_POSITION`](../api/macros/json_precise_stream_position.md) defined non-zero appends `_psp`.
+    - [`JSON_STRICT_NUL_HANDLING`](../api/macros/json_strict_nul_handling.md) defined non-zero appends `_snul`.
 - The inline namespace ends with the suffix `_v` followed by the 3 components of the version number separated by
  underscores. To omit the version component, see [Disabling the version component](#disabling-the-version-component)
  below.
@@ -562,7 +562,11 @@ binary32 or binary64 field and have no encoding for `#!cpp long double`.
 ## `AllocatorType`

 `AllocatorType` is instantiated with **one** argument, for each of `object_t`, `array_t`, `string_t`, `binary_t`,
-`basic_json`, and `#!cpp std::pair<const StringType, basic_json>`.
+`basic_json`, `#!cpp std::pair<const StringType, basic_json>`, and `#!cpp std::pair<StringType, basic_json>`.
+
+`AllocatorType` is not the only allocator a `basic_json` uses. It allocates the JSON values themselves, but most
+temporary storage is allocated with `#!cpp std::allocator`. This includes the parser's stacks and the stacks that
+process deeply nested values without recursion.

 ### Always required

@@ -6,7 +6,7 @@ There are myriads of [JSON](https://json.org) libraries out there, and each may

 - **Trivial integration**. Our whole code consists of a single header file [`json.hpp`](https://github.com/nlohmann/json/blob/develop/single_include/nlohmann/json.hpp). That's it. No library, no subproject, no dependencies, no complex build system. The class is written in vanilla C++11. All in all, everything should require no adjustment of your compiler flags or project settings.

- **Serious testing**. Our class is heavily [unit-tested](https://github.com/nlohmann/json/tree/develop/tests/src) and covers [100%](https://coveralls.io/r/nlohmann/json) of the code, including all exceptional behavior. Furthermore, we checked with [Valgrind](http://valgrind.org) and the [Clang Sanitizers](https://clang.llvm.org/docs/index.html) that there are no memory leaks. [Google OSS-Fuzz](https://github.com/google/oss-fuzz/tree/master/projects/json) additionally runs fuzz tests against all parsers 24/7, effectively executing billions of tests so far. To maintain high quality, the project is following the [Core Infrastructure Initiative (CII) best practices](https://bestpractices.coreinfrastructure.org/projects/289).
+- **Serious testing**. Our class is heavily [unit-tested](https://github.com/nlohmann/json/tree/develop/tests/src) and covers [100%](https://coveralls.io/r/nlohmann/json) of the code, including all exceptional behavior. Furthermore, we checked with [Valgrind](http://valgrind.org) and the [Clang Sanitizers](https://clang.llvm.org/docs/index.html) that there are no memory leaks. [Google OSS-Fuzz](https://github.com/google/oss-fuzz/tree/master/projects/json) additionally runs fuzz tests against all parsers 24/7, effectively executing billions of tests so far. To maintain high quality, the project is following the [OpenSSF Best Practices](https://www.bestpractices.dev/projects/289).

 Other aspects were not so important to us:

@@ -340,7 +340,8 @@ An unexpected byte was read in a [binary format](../features/binary_formats/inde
 ### json.exception.parse_error.113

 A string could not be read from a [binary format](../features/binary_formats/index.md): either a value that is not a
-string was read where one was required (for instance as a map key), or the string's length specification is invalid.
+string was read where one was required (for instance as a map key), the string's length specification is invalid, or
+the string's bytes are not valid UTF-8.

 !!! failure "Example messages"

@@ -356,6 +357,9 @@ string was read where one was required (for instance as a map key), or the strin
    ```
    [json.exception.parse_error.113] parse error at byte 3: syntax error while parsing BJData string: string length must not be negative
    ```
+    ```
+    [json.exception.parse_error.113] parse error at byte 3: syntax error while parsing CBOR string: invalid string: ill-formed UTF-8 byte
+    ```

 ### json.exception.parse_error.114

@@ -42,6 +42,10 @@
    #define JSON_PRECISE_STREAM_POSITION 0
 #endif

+#ifndef JSON_STRICT_NUL_HANDLING
+    #define JSON_STRICT_NUL_HANDLING 0
+#endif
+
 #if JSON_DIAGNOSTICS
    #define NLOHMANN_JSON_ABI_TAG_DIAGNOSTICS _diag
 #else
@@ -72,14 +76,20 @@
    #define NLOHMANN_JSON_ABI_TAG_PRECISE_STREAM_POSITION
 #endif

+#if JSON_STRICT_NUL_HANDLING
+    #define NLOHMANN_JSON_ABI_TAG_STRICT_NUL_HANDLING _snul
+#else
+    #define NLOHMANN_JSON_ABI_TAG_STRICT_NUL_HANDLING
+#endif
+
 #ifndef NLOHMANN_JSON_NAMESPACE_NO_VERSION
    #define NLOHMANN_JSON_NAMESPACE_NO_VERSION 0
 #endif

 // Construct the namespace ABI tags component
-#define NLOHMANN_JSON_ABI_TAGS_CONCAT_EX(a, b, c, d, e) json_abi ## a ## b ## c ## d ## e
-#define NLOHMANN_JSON_ABI_TAGS_CONCAT(a, b, c, d, e) \
-    NLOHMANN_JSON_ABI_TAGS_CONCAT_EX(a, b, c, d, e)
+#define NLOHMANN_JSON_ABI_TAGS_CONCAT_EX(a, b, c, d, e, f) json_abi ## a ## b ## c ## d ## e ## f
+#define NLOHMANN_JSON_ABI_TAGS_CONCAT(a, b, c, d, e, f) \
+    NLOHMANN_JSON_ABI_TAGS_CONCAT_EX(a, b, c, d, e, f)

 #define NLOHMANN_JSON_ABI_TAGS                                       \
    NLOHMANN_JSON_ABI_TAGS_CONCAT(                                   \
@@ -87,7 +97,8 @@
            NLOHMANN_JSON_ABI_TAG_LEGACY_DISCARDED_VALUE_COMPARISON, \
            NLOHMANN_JSON_ABI_TAG_DIAGNOSTIC_POSITIONS,              \
            NLOHMANN_JSON_ABI_TAG_BRACE_INIT_COPY_SEMANTICS,         \
-            NLOHMANN_JSON_ABI_TAG_PRECISE_STREAM_POSITION)
+            NLOHMANN_JSON_ABI_TAG_PRECISE_STREAM_POSITION,           \
+            NLOHMANN_JSON_ABI_TAG_STRICT_NUL_HANDLING)

 // Construct the namespace version component
 #define NLOHMANN_JSON_NAMESPACE_VERSION_CONCAT_EX(major, minor, patch) \
@@ -32,6 +32,7 @@
 #include <nlohmann/detail/meta/is_sax.hpp>
 #include <nlohmann/detail/meta/type_traits.hpp>
 #include <nlohmann/detail/string_concat.hpp>
+#include <nlohmann/detail/string_utils.hpp>
 #include <nlohmann/detail/value_t.hpp>

 NLOHMANN_JSON_NAMESPACE_BEGIN
@@ -432,7 +433,21 @@ class binary_reader
                                    exception_message(input_format_t::bson, concat("string length must be at least 1, is ", std::to_string(len)), "string"), nullptr));
        }

-        return get_string(input_format_t::bson, len - static_cast<NumberType>(1), result) && get() != char_traits<char_type>::eof();
+        if (JSON_HEDLEY_UNLIKELY(!get_string(input_format_t::bson, len - static_cast<NumberType>(1), result)))
+        {
+            return false;
+        }
+
+        if (JSON_HEDLEY_UNLIKELY(get() != 0x00))
+        {
+            auto last_token = get_token_string();
+            return sax->parse_error(chars_read, last_token, parse_error::create(112, chars_read,
+                                    exception_message(input_format_t::bson,
+                                            "BSON string is not null-terminated",
+                                            "string"), nullptr));
+        }
+
+        return true;
    }

    /*!
@@ -550,8 +565,6 @@ class binary_reader
        }
    }

-
-
    //////////
    // CBOR //
    //////////
@@ -3304,7 +3317,28 @@ class binary_reader
                    const NumberType len,
                    string_t& result)
    {
-        return get_bytes(format, len, "string", result);
+        // get_bytes() appends to result, and CBOR indefinite-length strings
+        // collect all their chunks in the same result; validating only the
+        // newly read bytes keeps the check linear in the input size
+        const std::size_t old_size = result.size();
+        if (JSON_HEDLEY_UNLIKELY(!get_bytes(format, len, "string", result)))
+        {
+            return false;
+        }
+
+        // RFC 8949 (CBOR) §3.1 and the MessagePack/BSON/UBJSON specifications
+        // all require text strings to be valid UTF-8; reject anything else
+        // right here so malformed input is caught at decode time instead of
+        // only surfacing later as a type_error.316 when the value is dumped
+        // (which would defeat allow_exceptions=false / strict discarding).
+        if (JSON_HEDLEY_UNLIKELY(!is_valid_utf8(result, old_size)))
+        {
+            return sax->parse_error(chars_read, get_token_string(),
+                                    parse_error::create(113, chars_read,
+                                            exception_message(format, "invalid string: ill-formed UTF-8 byte", "string"), nullptr));
+        }
+
+        return true;
    }

    /*!
@@ -596,16 +596,62 @@ void templated_json_throw(ExceptionType exception)

 #define NLOHMANN_JSON_BASIC_TYPE_TEMPLATE(...) template<typename BasicJsonType, nlohmann::detail::enable_if_t<nlohmann::detail::is_basic_json<BasicJsonType>::value, int> = 0> __VA_ARGS__

+// Helpers used to dispatch the NLOHMANN_DEFINE_TYPE_*/NLOHMANN_DEFINE_DERIVED_TYPE_*
+// macros below between a zero-member and a one-or-more-member implementation
+// (issue #4041, e.g. NLOHMANN_DEFINE_TYPE_INTRUSIVE(Type) with no further
+// arguments). NLOHMANN_JSON_TYPE_BODY(Prefix, ...) expands to the macro name
+// Prefix##EMPTY when __VA_ARGS__ is a single argument (Type alone) and to
+// Prefix##MEMBERS for two or more (Type, member...). It reuses the existing
+// 64-slot NLOHMANN_JSON_GET_MACRO dispatch with one extra trailing sentinel
+// token appended so its own trailing "..." is never left completely empty at
+// the lowest supported argument count -- invoking a variadic macro so that
+// "..." matches nothing is only granted unconditionally by the standard since
+// C++20, and pre-C++20 compilers may reject it under -pedantic regardless of
+// what the macro body does.
+//
+// The EMPTY/MEMBERS suffixes are pasted onto Prefix right in the slot table:
+// operands of ## are not macro-expanded, so the dispatch keeps working even if
+// user code defines macros named EMPTY or MEMBERS. Producing the bare suffix
+// first and pasting it later would let such a macro replace it.
+//
+// NLOHMANN_JSON_DERIVED_TYPE_BODY(Prefix, ...) answers the same question for
+// the derived-type macros, whose fixed prefix is Type,BaseType. It drops the
+// leading Type and defers to NLOHMANN_JSON_TYPE_BODY rather than shifting the
+// slot table by one: NLOHMANN_JSON_GET_MACRO only resolves 64 positional
+// arguments, so dispatching on Type,BaseType,member... directly would run out
+// one slot early and cap the derived-type macros at 62 members instead of the
+// 63 that NLOHMANN_JSON_PASTE supports.
+#define NLOHMANN_JSON_TYPE_BODY(Prefix, ...) NLOHMANN_JSON_EXPAND(NLOHMANN_JSON_GET_MACRO(__VA_ARGS__, \
+        Prefix ## MEMBERS, Prefix ## MEMBERS, Prefix ## MEMBERS, Prefix ## MEMBERS, Prefix ## MEMBERS, Prefix ## MEMBERS, Prefix ## MEMBERS, Prefix ## MEMBERS, \
+        Prefix ## MEMBERS, Prefix ## MEMBERS, Prefix ## MEMBERS, Prefix ## MEMBERS, Prefix ## MEMBERS, Prefix ## MEMBERS, Prefix ## MEMBERS, Prefix ## MEMBERS, \
+        Prefix ## MEMBERS, Prefix ## MEMBERS, Prefix ## MEMBERS, Prefix ## MEMBERS, Prefix ## MEMBERS, Prefix ## MEMBERS, Prefix ## MEMBERS, Prefix ## MEMBERS, \
+        Prefix ## MEMBERS, Prefix ## MEMBERS, Prefix ## MEMBERS, Prefix ## MEMBERS, Prefix ## MEMBERS, Prefix ## MEMBERS, Prefix ## MEMBERS, Prefix ## MEMBERS, \
+        Prefix ## MEMBERS, Prefix ## MEMBERS, Prefix ## MEMBERS, Prefix ## MEMBERS, Prefix ## MEMBERS, Prefix ## MEMBERS, Prefix ## MEMBERS, Prefix ## MEMBERS, \
+        Prefix ## MEMBERS, Prefix ## MEMBERS, Prefix ## MEMBERS, Prefix ## MEMBERS, Prefix ## MEMBERS, Prefix ## MEMBERS, Prefix ## MEMBERS, Prefix ## MEMBERS, \
+        Prefix ## MEMBERS, Prefix ## MEMBERS, Prefix ## MEMBERS, Prefix ## MEMBERS, Prefix ## MEMBERS, Prefix ## MEMBERS, Prefix ## MEMBERS, Prefix ## MEMBERS, \
+        Prefix ## MEMBERS, Prefix ## MEMBERS, Prefix ## MEMBERS, Prefix ## MEMBERS, Prefix ## MEMBERS, Prefix ## MEMBERS, Prefix ## MEMBERS, Prefix ## EMPTY, \
+        NLOHMANN_JSON_TYPE_BODY_SENTINEL))
+
+#define NLOHMANN_JSON_DERIVED_TYPE_BODY_(Prefix, Type, ...) NLOHMANN_JSON_TYPE_BODY(Prefix, __VA_ARGS__)
+#define NLOHMANN_JSON_DERIVED_TYPE_BODY(Prefix, ...) NLOHMANN_JSON_EXPAND(NLOHMANN_JSON_DERIVED_TYPE_BODY_(Prefix, __VA_ARGS__))
+
 /*!
@brief macro
@def NLOHMANN_DEFINE_TYPE_INTRUSIVE
@since version 3.9.0
@sa https://json.nlohmann.me/api/macros/nlohmann_define_type_intrusive/
 */
-#define NLOHMANN_DEFINE_TYPE_INTRUSIVE(Type, ...)  \
+#define NLOHMANN_JSON_DEFINE_TYPE_INTRUSIVE_MEMBERS(Type, ...)  \
    NLOHMANN_JSON_BASIC_TYPE_TEMPLATE(friend void to_json(BasicJsonType& nlohmann_json_j, const Type& nlohmann_json_t) { NLOHMANN_JSON_EXPAND(NLOHMANN_JSON_PASTE(NLOHMANN_JSON_TO, __VA_ARGS__)) }) \
    NLOHMANN_JSON_BASIC_TYPE_TEMPLATE(friend void from_json(const BasicJsonType& nlohmann_json_j, Type& nlohmann_json_t) { NLOHMANN_JSON_EXPAND(NLOHMANN_JSON_PASTE(NLOHMANN_JSON_FROM, __VA_ARGS__)) })

+#define NLOHMANN_JSON_DEFINE_TYPE_INTRUSIVE_EMPTY(Type)  \
+    NLOHMANN_JSON_BASIC_TYPE_TEMPLATE(friend void to_json(BasicJsonType& nlohmann_json_j, const Type&) { nlohmann_json_j = BasicJsonType::object(); }) \
+    /* NOLINTNEXTLINE(bugprone-macro-parentheses) Type is used as a declarator type, not in an expression */ \
+    NLOHMANN_JSON_BASIC_TYPE_TEMPLATE(friend void from_json(const BasicJsonType&, Type&) noexcept { })
+
+#define NLOHMANN_DEFINE_TYPE_INTRUSIVE(...) NLOHMANN_JSON_EXPAND(NLOHMANN_JSON_TYPE_BODY(NLOHMANN_JSON_DEFINE_TYPE_INTRUSIVE_, __VA_ARGS__)(__VA_ARGS__))
+
 #define NLOHMANN_DEFINE_TYPE_INTRUSIVE_WITH_NAMES(Type, ...)  \
    NLOHMANN_JSON_BASIC_TYPE_TEMPLATE(friend void to_json(BasicJsonType& nlohmann_json_j, const Type& nlohmann_json_t) { NLOHMANN_JSON_EXPAND(NLOHMANN_JSON_DOUBLE_PASTE(NLOHMANN_JSON_TO_WITH_NAME, __VA_ARGS__)) }) \
    NLOHMANN_JSON_BASIC_TYPE_TEMPLATE(friend void from_json(const BasicJsonType& nlohmann_json_j, Type& nlohmann_json_t) { NLOHMANN_JSON_EXPAND(NLOHMANN_JSON_DOUBLE_PASTE(NLOHMANN_JSON_FROM_WITH_NAME, __VA_ARGS__)) })
@@ -616,10 +662,15 @@ void templated_json_throw(ExceptionType exception)
@since version 3.11.0
@sa https://json.nlohmann.me/api/macros/nlohmann_define_type_intrusive/
 */
-#define NLOHMANN_DEFINE_TYPE_INTRUSIVE_WITH_DEFAULT(Type, ...)  \
+#define NLOHMANN_JSON_DEFINE_TYPE_INTRUSIVE_WITH_DEFAULT_MEMBERS(Type, ...)  \
    NLOHMANN_JSON_BASIC_TYPE_TEMPLATE(friend void to_json(BasicJsonType& nlohmann_json_j, const Type& nlohmann_json_t) { NLOHMANN_JSON_EXPAND(NLOHMANN_JSON_PASTE(NLOHMANN_JSON_TO, __VA_ARGS__)) }) \
    NLOHMANN_JSON_BASIC_TYPE_TEMPLATE(friend void from_json(const BasicJsonType& nlohmann_json_j, Type& nlohmann_json_t) { const Type nlohmann_json_default_obj{}; NLOHMANN_JSON_EXPAND(NLOHMANN_JSON_PASTE(NLOHMANN_JSON_FROM_WITH_DEFAULT, __VA_ARGS__)) })

+// identical to NLOHMANN_JSON_DEFINE_TYPE_INTRUSIVE_EMPTY: with no members there is nothing to default
+#define NLOHMANN_JSON_DEFINE_TYPE_INTRUSIVE_WITH_DEFAULT_EMPTY(Type) NLOHMANN_JSON_DEFINE_TYPE_INTRUSIVE_EMPTY(Type)
+
+#define NLOHMANN_DEFINE_TYPE_INTRUSIVE_WITH_DEFAULT(...) NLOHMANN_JSON_EXPAND(NLOHMANN_JSON_TYPE_BODY(NLOHMANN_JSON_DEFINE_TYPE_INTRUSIVE_WITH_DEFAULT_, __VA_ARGS__)(__VA_ARGS__))
+
 #define NLOHMANN_DEFINE_TYPE_INTRUSIVE_WITH_DEFAULT_WITH_NAMES(Type, ...)  \
    NLOHMANN_JSON_BASIC_TYPE_TEMPLATE(friend void to_json(BasicJsonType& nlohmann_json_j, const Type& nlohmann_json_t) { NLOHMANN_JSON_EXPAND(NLOHMANN_JSON_DOUBLE_PASTE(NLOHMANN_JSON_TO_WITH_NAME, __VA_ARGS__)) }) \
    NLOHMANN_JSON_BASIC_TYPE_TEMPLATE(friend void from_json(const BasicJsonType& nlohmann_json_j, Type& nlohmann_json_t) { const Type nlohmann_json_default_obj{}; NLOHMANN_JSON_EXPAND(NLOHMANN_JSON_DOUBLE_PASTE(NLOHMANN_JSON_FROM_WITH_DEFAULT_WITH_NAME, __VA_ARGS__)) })
@@ -630,9 +681,14 @@ void templated_json_throw(ExceptionType exception)
@since version 3.11.3
@sa https://json.nlohmann.me/api/macros/nlohmann_define_type_intrusive/
 */
-#define NLOHMANN_DEFINE_TYPE_INTRUSIVE_ONLY_SERIALIZE(Type, ...)  \
+#define NLOHMANN_JSON_DEFINE_TYPE_INTRUSIVE_ONLY_SERIALIZE_MEMBERS(Type, ...)  \
    NLOHMANN_JSON_BASIC_TYPE_TEMPLATE(friend void to_json(BasicJsonType& nlohmann_json_j, const Type& nlohmann_json_t) { NLOHMANN_JSON_EXPAND(NLOHMANN_JSON_PASTE(NLOHMANN_JSON_TO, __VA_ARGS__)) })

+#define NLOHMANN_JSON_DEFINE_TYPE_INTRUSIVE_ONLY_SERIALIZE_EMPTY(Type)  \
+    NLOHMANN_JSON_BASIC_TYPE_TEMPLATE(friend void to_json(BasicJsonType& nlohmann_json_j, const Type&) { nlohmann_json_j = BasicJsonType::object(); })
+
+#define NLOHMANN_DEFINE_TYPE_INTRUSIVE_ONLY_SERIALIZE(...) NLOHMANN_JSON_EXPAND(NLOHMANN_JSON_TYPE_BODY(NLOHMANN_JSON_DEFINE_TYPE_INTRUSIVE_ONLY_SERIALIZE_, __VA_ARGS__)(__VA_ARGS__))
+
 #define NLOHMANN_DEFINE_TYPE_INTRUSIVE_ONLY_SERIALIZE_WITH_NAMES(Type, ...)  \
    NLOHMANN_JSON_BASIC_TYPE_TEMPLATE(friend void to_json(BasicJsonType& nlohmann_json_j, const Type& nlohmann_json_t) { NLOHMANN_JSON_EXPAND(NLOHMANN_JSON_DOUBLE_PASTE(NLOHMANN_JSON_TO_WITH_NAME, __VA_ARGS__)) })

@@ -642,10 +698,17 @@ void templated_json_throw(ExceptionType exception)
@since version 3.9.0
@sa https://json.nlohmann.me/api/macros/nlohmann_define_type_non_intrusive/
 */
-#define NLOHMANN_DEFINE_TYPE_NON_INTRUSIVE(Type, ...)  \
+#define NLOHMANN_JSON_DEFINE_TYPE_NON_INTRUSIVE_MEMBERS(Type, ...)  \
    NLOHMANN_JSON_BASIC_TYPE_TEMPLATE(void to_json(BasicJsonType& nlohmann_json_j, const Type& nlohmann_json_t) { NLOHMANN_JSON_EXPAND(NLOHMANN_JSON_PASTE(NLOHMANN_JSON_TO, __VA_ARGS__)) }) \
    NLOHMANN_JSON_BASIC_TYPE_TEMPLATE(void from_json(const BasicJsonType& nlohmann_json_j, Type& nlohmann_json_t) { NLOHMANN_JSON_EXPAND(NLOHMANN_JSON_PASTE(NLOHMANN_JSON_FROM, __VA_ARGS__)) })

+#define NLOHMANN_JSON_DEFINE_TYPE_NON_INTRUSIVE_EMPTY(Type)  \
+    NLOHMANN_JSON_BASIC_TYPE_TEMPLATE(void to_json(BasicJsonType& nlohmann_json_j, const Type&) { nlohmann_json_j = BasicJsonType::object(); }) \
+    /* NOLINTNEXTLINE(bugprone-macro-parentheses) Type is used as a declarator type, not in an expression */ \
+    NLOHMANN_JSON_BASIC_TYPE_TEMPLATE(void from_json(const BasicJsonType&, Type&) noexcept { })
+
+#define NLOHMANN_DEFINE_TYPE_NON_INTRUSIVE(...) NLOHMANN_JSON_EXPAND(NLOHMANN_JSON_TYPE_BODY(NLOHMANN_JSON_DEFINE_TYPE_NON_INTRUSIVE_, __VA_ARGS__)(__VA_ARGS__))
+
 #define NLOHMANN_DEFINE_TYPE_NON_INTRUSIVE_WITH_NAMES(Type, ...)  \
    NLOHMANN_JSON_BASIC_TYPE_TEMPLATE(void to_json(BasicJsonType& nlohmann_json_j, const Type& nlohmann_json_t) { NLOHMANN_JSON_EXPAND(NLOHMANN_JSON_DOUBLE_PASTE(NLOHMANN_JSON_TO_WITH_NAME, __VA_ARGS__)) }) \
    NLOHMANN_JSON_BASIC_TYPE_TEMPLATE(void from_json(const BasicJsonType& nlohmann_json_j, Type& nlohmann_json_t) { NLOHMANN_JSON_EXPAND(NLOHMANN_JSON_DOUBLE_PASTE(NLOHMANN_JSON_FROM_WITH_NAME, __VA_ARGS__)) })
@@ -656,10 +719,15 @@ void templated_json_throw(ExceptionType exception)
@since version 3.11.0
@sa https://json.nlohmann.me/api/macros/nlohmann_define_type_non_intrusive/
 */
-#define NLOHMANN_DEFINE_TYPE_NON_INTRUSIVE_WITH_DEFAULT(Type, ...)  \
+#define NLOHMANN_JSON_DEFINE_TYPE_NON_INTRUSIVE_WITH_DEFAULT_MEMBERS(Type, ...)  \
    NLOHMANN_JSON_BASIC_TYPE_TEMPLATE(void to_json(BasicJsonType& nlohmann_json_j, const Type& nlohmann_json_t) { NLOHMANN_JSON_EXPAND(NLOHMANN_JSON_PASTE(NLOHMANN_JSON_TO, __VA_ARGS__)) }) \
    NLOHMANN_JSON_BASIC_TYPE_TEMPLATE(void from_json(const BasicJsonType& nlohmann_json_j, Type& nlohmann_json_t) { const Type nlohmann_json_default_obj{}; NLOHMANN_JSON_EXPAND(NLOHMANN_JSON_PASTE(NLOHMANN_JSON_FROM_WITH_DEFAULT, __VA_ARGS__)) })

+// identical to NLOHMANN_JSON_DEFINE_TYPE_NON_INTRUSIVE_EMPTY: with no members there is nothing to default
+#define NLOHMANN_JSON_DEFINE_TYPE_NON_INTRUSIVE_WITH_DEFAULT_EMPTY(Type) NLOHMANN_JSON_DEFINE_TYPE_NON_INTRUSIVE_EMPTY(Type)
+
+#define NLOHMANN_DEFINE_TYPE_NON_INTRUSIVE_WITH_DEFAULT(...) NLOHMANN_JSON_EXPAND(NLOHMANN_JSON_TYPE_BODY(NLOHMANN_JSON_DEFINE_TYPE_NON_INTRUSIVE_WITH_DEFAULT_, __VA_ARGS__)(__VA_ARGS__))
+
 #define NLOHMANN_DEFINE_TYPE_NON_INTRUSIVE_WITH_DEFAULT_WITH_NAMES(Type, ...)  \
    NLOHMANN_JSON_BASIC_TYPE_TEMPLATE(void to_json(BasicJsonType& nlohmann_json_j, const Type& nlohmann_json_t) { NLOHMANN_JSON_EXPAND(NLOHMANN_JSON_DOUBLE_PASTE(NLOHMANN_JSON_TO_WITH_NAME, __VA_ARGS__)) }) \
    NLOHMANN_JSON_BASIC_TYPE_TEMPLATE(void from_json(const BasicJsonType& nlohmann_json_j, Type& nlohmann_json_t) { const Type nlohmann_json_default_obj{}; NLOHMANN_JSON_EXPAND(NLOHMANN_JSON_DOUBLE_PASTE(NLOHMANN_JSON_FROM_WITH_DEFAULT_WITH_NAME, __VA_ARGS__)) })
@@ -670,9 +738,14 @@ void templated_json_throw(ExceptionType exception)
@since version 3.11.3
@sa https://json.nlohmann.me/api/macros/nlohmann_define_type_non_intrusive/
 */
-#define NLOHMANN_DEFINE_TYPE_NON_INTRUSIVE_ONLY_SERIALIZE(Type, ...)  \
+#define NLOHMANN_JSON_DEFINE_TYPE_NON_INTRUSIVE_ONLY_SERIALIZE_MEMBERS(Type, ...)  \
    NLOHMANN_JSON_BASIC_TYPE_TEMPLATE(void to_json(BasicJsonType& nlohmann_json_j, const Type& nlohmann_json_t) { NLOHMANN_JSON_EXPAND(NLOHMANN_JSON_PASTE(NLOHMANN_JSON_TO, __VA_ARGS__)) })

+#define NLOHMANN_JSON_DEFINE_TYPE_NON_INTRUSIVE_ONLY_SERIALIZE_EMPTY(Type)  \
+    NLOHMANN_JSON_BASIC_TYPE_TEMPLATE(void to_json(BasicJsonType& nlohmann_json_j, const Type&) { nlohmann_json_j = BasicJsonType::object(); })
+
+#define NLOHMANN_DEFINE_TYPE_NON_INTRUSIVE_ONLY_SERIALIZE(...) NLOHMANN_JSON_EXPAND(NLOHMANN_JSON_TYPE_BODY(NLOHMANN_JSON_DEFINE_TYPE_NON_INTRUSIVE_ONLY_SERIALIZE_, __VA_ARGS__)(__VA_ARGS__))
+
 #define NLOHMANN_DEFINE_TYPE_NON_INTRUSIVE_ONLY_SERIALIZE_WITH_NAMES(Type, ...)  \
    NLOHMANN_JSON_BASIC_TYPE_TEMPLATE(void to_json(BasicJsonType& nlohmann_json_j, const Type& nlohmann_json_t) { NLOHMANN_JSON_EXPAND(NLOHMANN_JSON_DOUBLE_PASTE(NLOHMANN_JSON_TO_WITH_NAME, __VA_ARGS__)) })

@@ -682,10 +755,17 @@ void templated_json_throw(ExceptionType exception)
@since version 3.12.0
@sa https://json.nlohmann.me/api/macros/nlohmann_define_derived_type/
 */
-#define NLOHMANN_DEFINE_DERIVED_TYPE_INTRUSIVE(Type, BaseType, ...)  \
+#define NLOHMANN_JSON_DEFINE_DERIVED_TYPE_INTRUSIVE_MEMBERS(Type, BaseType, ...)  \
    NLOHMANN_JSON_BASIC_TYPE_TEMPLATE(friend void to_json(BasicJsonType& nlohmann_json_j, const Type& nlohmann_json_t) { nlohmann::to_json(nlohmann_json_j, static_cast<const BaseType &>(nlohmann_json_t)); NLOHMANN_JSON_EXPAND(NLOHMANN_JSON_PASTE(NLOHMANN_JSON_TO, __VA_ARGS__)) }) \
    NLOHMANN_JSON_BASIC_TYPE_TEMPLATE(friend void from_json(const BasicJsonType& nlohmann_json_j, Type& nlohmann_json_t) { nlohmann::from_json(nlohmann_json_j, static_cast<BaseType&>(nlohmann_json_t)); NLOHMANN_JSON_EXPAND(NLOHMANN_JSON_PASTE(NLOHMANN_JSON_FROM, __VA_ARGS__)) })

+#define NLOHMANN_JSON_DEFINE_DERIVED_TYPE_INTRUSIVE_EMPTY(Type, BaseType)  \
+    NLOHMANN_JSON_BASIC_TYPE_TEMPLATE(friend void to_json(BasicJsonType& nlohmann_json_j, const Type& nlohmann_json_t) { nlohmann::to_json(nlohmann_json_j, static_cast<const BaseType &>(nlohmann_json_t)); }) \
+    /* NOLINTNEXTLINE(bugprone-macro-parentheses) Type/BaseType are used as declarator types, not in expressions */ \
+    NLOHMANN_JSON_BASIC_TYPE_TEMPLATE(friend void from_json(const BasicJsonType& nlohmann_json_j, Type& nlohmann_json_t) { nlohmann::from_json(nlohmann_json_j, static_cast<BaseType&>(nlohmann_json_t)); })
+
+#define NLOHMANN_DEFINE_DERIVED_TYPE_INTRUSIVE(...) NLOHMANN_JSON_EXPAND(NLOHMANN_JSON_DERIVED_TYPE_BODY(NLOHMANN_JSON_DEFINE_DERIVED_TYPE_INTRUSIVE_, __VA_ARGS__)(__VA_ARGS__))
+
 #define NLOHMANN_DEFINE_DERIVED_TYPE_INTRUSIVE_WITH_NAMES(Type, BaseType, ...)  \
    NLOHMANN_JSON_BASIC_TYPE_TEMPLATE(friend void to_json(BasicJsonType& nlohmann_json_j, const Type& nlohmann_json_t) { nlohmann::to_json(nlohmann_json_j, static_cast<const BaseType &>(nlohmann_json_t)); NLOHMANN_JSON_EXPAND(NLOHMANN_JSON_DOUBLE_PASTE(NLOHMANN_JSON_TO_WITH_NAME, __VA_ARGS__)) }) \
    NLOHMANN_JSON_BASIC_TYPE_TEMPLATE(friend void from_json(const BasicJsonType& nlohmann_json_j, Type& nlohmann_json_t) { nlohmann::from_json(nlohmann_json_j, static_cast<BaseType&>(nlohmann_json_t)); NLOHMANN_JSON_EXPAND(NLOHMANN_JSON_DOUBLE_PASTE(NLOHMANN_JSON_FROM_WITH_NAME, __VA_ARGS__)) })
@@ -696,10 +776,15 @@ void templated_json_throw(ExceptionType exception)
@since version 3.12.0
@sa https://json.nlohmann.me/api/macros/nlohmann_define_derived_type/
 */
-#define NLOHMANN_DEFINE_DERIVED_TYPE_INTRUSIVE_WITH_DEFAULT(Type, BaseType, ...)  \
+#define NLOHMANN_JSON_DEFINE_DERIVED_TYPE_INTRUSIVE_WITH_DEFAULT_MEMBERS(Type, BaseType, ...)  \
    NLOHMANN_JSON_BASIC_TYPE_TEMPLATE(friend void to_json(BasicJsonType& nlohmann_json_j, const Type& nlohmann_json_t) { nlohmann::to_json(nlohmann_json_j, static_cast<const BaseType&>(nlohmann_json_t)); NLOHMANN_JSON_EXPAND(NLOHMANN_JSON_PASTE(NLOHMANN_JSON_TO, __VA_ARGS__)) }) \
    NLOHMANN_JSON_BASIC_TYPE_TEMPLATE(friend void from_json(const BasicJsonType& nlohmann_json_j, Type& nlohmann_json_t) { nlohmann::from_json(nlohmann_json_j, static_cast<BaseType&>(nlohmann_json_t)); const Type nlohmann_json_default_obj{}; NLOHMANN_JSON_EXPAND(NLOHMANN_JSON_PASTE(NLOHMANN_JSON_FROM_WITH_DEFAULT, __VA_ARGS__)) })

+// identical to NLOHMANN_JSON_DEFINE_DERIVED_TYPE_INTRUSIVE_EMPTY: with no members there is nothing to default
+#define NLOHMANN_JSON_DEFINE_DERIVED_TYPE_INTRUSIVE_WITH_DEFAULT_EMPTY(Type, BaseType) NLOHMANN_JSON_DEFINE_DERIVED_TYPE_INTRUSIVE_EMPTY(Type, BaseType)
+
+#define NLOHMANN_DEFINE_DERIVED_TYPE_INTRUSIVE_WITH_DEFAULT(...) NLOHMANN_JSON_EXPAND(NLOHMANN_JSON_DERIVED_TYPE_BODY(NLOHMANN_JSON_DEFINE_DERIVED_TYPE_INTRUSIVE_WITH_DEFAULT_, __VA_ARGS__)(__VA_ARGS__))
+
 #define NLOHMANN_DEFINE_DERIVED_TYPE_INTRUSIVE_WITH_DEFAULT_WITH_NAMES(Type, BaseType, ...)  \
    NLOHMANN_JSON_BASIC_TYPE_TEMPLATE(friend void to_json(BasicJsonType& nlohmann_json_j, const Type& nlohmann_json_t) { nlohmann::to_json(nlohmann_json_j, static_cast<const BaseType&>(nlohmann_json_t)); NLOHMANN_JSON_EXPAND(NLOHMANN_JSON_DOUBLE_PASTE(NLOHMANN_JSON_TO_WITH_NAME, __VA_ARGS__)) }) \
    NLOHMANN_JSON_BASIC_TYPE_TEMPLATE(friend void from_json(const BasicJsonType& nlohmann_json_j, Type& nlohmann_json_t) { nlohmann::from_json(nlohmann_json_j, static_cast<BaseType&>(nlohmann_json_t)); const Type nlohmann_json_default_obj{}; NLOHMANN_JSON_EXPAND(NLOHMANN_JSON_DOUBLE_PASTE(NLOHMANN_JSON_FROM_WITH_DEFAULT_WITH_NAME, __VA_ARGS__)) })
@@ -710,9 +795,14 @@ void templated_json_throw(ExceptionType exception)
@since version 3.12.0
@sa https://json.nlohmann.me/api/macros/nlohmann_define_derived_type/
 */
-#define NLOHMANN_DEFINE_DERIVED_TYPE_INTRUSIVE_ONLY_SERIALIZE(Type, BaseType, ...)  \
+#define NLOHMANN_JSON_DEFINE_DERIVED_TYPE_INTRUSIVE_ONLY_SERIALIZE_MEMBERS(Type, BaseType, ...)  \
    NLOHMANN_JSON_BASIC_TYPE_TEMPLATE(friend void to_json(BasicJsonType& nlohmann_json_j, const Type& nlohmann_json_t) { nlohmann::to_json(nlohmann_json_j, static_cast<const BaseType &>(nlohmann_json_t)); NLOHMANN_JSON_EXPAND(NLOHMANN_JSON_PASTE(NLOHMANN_JSON_TO, __VA_ARGS__)) })

+#define NLOHMANN_JSON_DEFINE_DERIVED_TYPE_INTRUSIVE_ONLY_SERIALIZE_EMPTY(Type, BaseType)  \
+    NLOHMANN_JSON_BASIC_TYPE_TEMPLATE(friend void to_json(BasicJsonType& nlohmann_json_j, const Type& nlohmann_json_t) { nlohmann::to_json(nlohmann_json_j, static_cast<const BaseType &>(nlohmann_json_t)); })
+
+#define NLOHMANN_DEFINE_DERIVED_TYPE_INTRUSIVE_ONLY_SERIALIZE(...) NLOHMANN_JSON_EXPAND(NLOHMANN_JSON_DERIVED_TYPE_BODY(NLOHMANN_JSON_DEFINE_DERIVED_TYPE_INTRUSIVE_ONLY_SERIALIZE_, __VA_ARGS__)(__VA_ARGS__))
+
 #define NLOHMANN_DEFINE_DERIVED_TYPE_INTRUSIVE_ONLY_SERIALIZE_WITH_NAMES(Type, BaseType, ...)  \
    NLOHMANN_JSON_BASIC_TYPE_TEMPLATE(friend void to_json(BasicJsonType& nlohmann_json_j, const Type& nlohmann_json_t) { nlohmann::to_json(nlohmann_json_j, static_cast<const BaseType &>(nlohmann_json_t)); NLOHMANN_JSON_EXPAND(NLOHMANN_JSON_DOUBLE_PASTE(NLOHMANN_JSON_TO_WITH_NAME, __VA_ARGS__)) })

@@ -723,10 +813,17 @@ void templated_json_throw(ExceptionType exception)
@since version 3.12.0
@sa https://json.nlohmann.me/api/macros/nlohmann_define_derived_type/
 */
-#define NLOHMANN_DEFINE_DERIVED_TYPE_NON_INTRUSIVE(Type, BaseType, ...)  \
+#define NLOHMANN_JSON_DEFINE_DERIVED_TYPE_NON_INTRUSIVE_MEMBERS(Type, BaseType, ...)  \
    NLOHMANN_JSON_BASIC_TYPE_TEMPLATE(void to_json(BasicJsonType& nlohmann_json_j, const Type& nlohmann_json_t) { nlohmann::to_json(nlohmann_json_j, static_cast<const BaseType &>(nlohmann_json_t)); NLOHMANN_JSON_EXPAND(NLOHMANN_JSON_PASTE(NLOHMANN_JSON_TO, __VA_ARGS__)) }) \
    NLOHMANN_JSON_BASIC_TYPE_TEMPLATE(void from_json(const BasicJsonType& nlohmann_json_j, Type& nlohmann_json_t) { nlohmann::from_json(nlohmann_json_j, static_cast<BaseType&>(nlohmann_json_t)); NLOHMANN_JSON_EXPAND(NLOHMANN_JSON_PASTE(NLOHMANN_JSON_FROM, __VA_ARGS__)) })

+#define NLOHMANN_JSON_DEFINE_DERIVED_TYPE_NON_INTRUSIVE_EMPTY(Type, BaseType)  \
+    NLOHMANN_JSON_BASIC_TYPE_TEMPLATE(void to_json(BasicJsonType& nlohmann_json_j, const Type& nlohmann_json_t) { nlohmann::to_json(nlohmann_json_j, static_cast<const BaseType &>(nlohmann_json_t)); }) \
+    /* NOLINTNEXTLINE(bugprone-macro-parentheses) Type/BaseType are used as declarator types, not in expressions */ \
+    NLOHMANN_JSON_BASIC_TYPE_TEMPLATE(void from_json(const BasicJsonType& nlohmann_json_j, Type& nlohmann_json_t) { nlohmann::from_json(nlohmann_json_j, static_cast<BaseType&>(nlohmann_json_t)); })
+
+#define NLOHMANN_DEFINE_DERIVED_TYPE_NON_INTRUSIVE(...) NLOHMANN_JSON_EXPAND(NLOHMANN_JSON_DERIVED_TYPE_BODY(NLOHMANN_JSON_DEFINE_DERIVED_TYPE_NON_INTRUSIVE_, __VA_ARGS__)(__VA_ARGS__))
+
 #define NLOHMANN_DEFINE_DERIVED_TYPE_NON_INTRUSIVE_WITH_NAMES(Type, BaseType, ...)  \
    NLOHMANN_JSON_BASIC_TYPE_TEMPLATE(void to_json(BasicJsonType& nlohmann_json_j, const Type& nlohmann_json_t) { nlohmann::to_json(nlohmann_json_j, static_cast<const BaseType &>(nlohmann_json_t)); NLOHMANN_JSON_EXPAND(NLOHMANN_JSON_DOUBLE_PASTE(NLOHMANN_JSON_TO_WITH_NAME, __VA_ARGS__)) }) \
    NLOHMANN_JSON_BASIC_TYPE_TEMPLATE(void from_json(const BasicJsonType& nlohmann_json_j, Type& nlohmann_json_t) { nlohmann::from_json(nlohmann_json_j, static_cast<BaseType&>(nlohmann_json_t)); NLOHMANN_JSON_EXPAND(NLOHMANN_JSON_DOUBLE_PASTE(NLOHMANN_JSON_FROM_WITH_NAME, __VA_ARGS__)) })
@@ -737,10 +834,15 @@ void templated_json_throw(ExceptionType exception)
@since version 3.12.0
@sa https://json.nlohmann.me/api/macros/nlohmann_define_derived_type/
 */
-#define NLOHMANN_DEFINE_DERIVED_TYPE_NON_INTRUSIVE_WITH_DEFAULT(Type, BaseType, ...)  \
+#define NLOHMANN_JSON_DEFINE_DERIVED_TYPE_NON_INTRUSIVE_WITH_DEFAULT_MEMBERS(Type, BaseType, ...)  \
    NLOHMANN_JSON_BASIC_TYPE_TEMPLATE(void to_json(BasicJsonType& nlohmann_json_j, const Type& nlohmann_json_t) { nlohmann::to_json(nlohmann_json_j, static_cast<const BaseType &>(nlohmann_json_t)); NLOHMANN_JSON_EXPAND(NLOHMANN_JSON_PASTE(NLOHMANN_JSON_TO, __VA_ARGS__)) }) \
    NLOHMANN_JSON_BASIC_TYPE_TEMPLATE(void from_json(const BasicJsonType& nlohmann_json_j, Type& nlohmann_json_t) { nlohmann::from_json(nlohmann_json_j, static_cast<BaseType&>(nlohmann_json_t)); const Type nlohmann_json_default_obj{}; NLOHMANN_JSON_EXPAND(NLOHMANN_JSON_PASTE(NLOHMANN_JSON_FROM_WITH_DEFAULT, __VA_ARGS__)) })

+// identical to NLOHMANN_JSON_DEFINE_DERIVED_TYPE_NON_INTRUSIVE_EMPTY: with no members there is nothing to default
+#define NLOHMANN_JSON_DEFINE_DERIVED_TYPE_NON_INTRUSIVE_WITH_DEFAULT_EMPTY(Type, BaseType) NLOHMANN_JSON_DEFINE_DERIVED_TYPE_NON_INTRUSIVE_EMPTY(Type, BaseType)
+
+#define NLOHMANN_DEFINE_DERIVED_TYPE_NON_INTRUSIVE_WITH_DEFAULT(...) NLOHMANN_JSON_EXPAND(NLOHMANN_JSON_DERIVED_TYPE_BODY(NLOHMANN_JSON_DEFINE_DERIVED_TYPE_NON_INTRUSIVE_WITH_DEFAULT_, __VA_ARGS__)(__VA_ARGS__))
+
 #define NLOHMANN_DEFINE_DERIVED_TYPE_NON_INTRUSIVE_WITH_DEFAULT_WITH_NAMES(Type, BaseType, ...)  \
    NLOHMANN_JSON_BASIC_TYPE_TEMPLATE(void to_json(BasicJsonType& nlohmann_json_j, const Type& nlohmann_json_t) { nlohmann::to_json(nlohmann_json_j, static_cast<const BaseType &>(nlohmann_json_t)); NLOHMANN_JSON_EXPAND(NLOHMANN_JSON_DOUBLE_PASTE(NLOHMANN_JSON_TO_WITH_NAME, __VA_ARGS__)) }) \
    NLOHMANN_JSON_BASIC_TYPE_TEMPLATE(void from_json(const BasicJsonType& nlohmann_json_j, Type& nlohmann_json_t) { nlohmann::from_json(nlohmann_json_j, static_cast<BaseType&>(nlohmann_json_t)); const Type nlohmann_json_default_obj{}; NLOHMANN_JSON_EXPAND(NLOHMANN_JSON_DOUBLE_PASTE(NLOHMANN_JSON_FROM_WITH_DEFAULT_WITH_NAME, __VA_ARGS__)) })
@@ -751,9 +853,14 @@ void templated_json_throw(ExceptionType exception)
@since version 3.12.0
@sa https://json.nlohmann.me/api/macros/nlohmann_define_derived_type/
 */
-#define NLOHMANN_DEFINE_DERIVED_TYPE_NON_INTRUSIVE_ONLY_SERIALIZE(Type, BaseType, ...)  \
+#define NLOHMANN_JSON_DEFINE_DERIVED_TYPE_NON_INTRUSIVE_ONLY_SERIALIZE_MEMBERS(Type, BaseType, ...)  \
    NLOHMANN_JSON_BASIC_TYPE_TEMPLATE(void to_json(BasicJsonType& nlohmann_json_j, const Type& nlohmann_json_t) { nlohmann::to_json(nlohmann_json_j, static_cast<const BaseType &>(nlohmann_json_t)); NLOHMANN_JSON_EXPAND(NLOHMANN_JSON_PASTE(NLOHMANN_JSON_TO, __VA_ARGS__)) })

+#define NLOHMANN_JSON_DEFINE_DERIVED_TYPE_NON_INTRUSIVE_ONLY_SERIALIZE_EMPTY(Type, BaseType)  \
+    NLOHMANN_JSON_BASIC_TYPE_TEMPLATE(void to_json(BasicJsonType& nlohmann_json_j, const Type& nlohmann_json_t) { nlohmann::to_json(nlohmann_json_j, static_cast<const BaseType &>(nlohmann_json_t)); })
+
+#define NLOHMANN_DEFINE_DERIVED_TYPE_NON_INTRUSIVE_ONLY_SERIALIZE(...) NLOHMANN_JSON_EXPAND(NLOHMANN_JSON_DERIVED_TYPE_BODY(NLOHMANN_JSON_DEFINE_DERIVED_TYPE_NON_INTRUSIVE_ONLY_SERIALIZE_, __VA_ARGS__)(__VA_ARGS__))
+
 #define NLOHMANN_DEFINE_DERIVED_TYPE_NON_INTRUSIVE_ONLY_SERIALIZE_WITH_NAMES(Type, BaseType, ...)  \
    NLOHMANN_JSON_BASIC_TYPE_TEMPLATE(void to_json(BasicJsonType& nlohmann_json_j, const Type& nlohmann_json_t) { nlohmann::to_json(nlohmann_json_j, static_cast<const BaseType &>(nlohmann_json_t)); NLOHMANN_JSON_EXPAND(NLOHMANN_JSON_DOUBLE_PASTE(NLOHMANN_JSON_TO_WITH_NAME, __VA_ARGS__)) })

@@ -812,7 +919,3 @@ void templated_json_throw(ExceptionType exception)
 #ifndef JSON_USE_GLOBAL_UDLS
    #define JSON_USE_GLOBAL_UDLS 1
 #endif
-
-#ifndef JSON_STRICT_NUL_HANDLING
-    #define JSON_STRICT_NUL_HANDLING 0
-#endif
@@ -26,7 +26,6 @@
 #undef JSON_NO_UNIQUE_ADDRESS
 #undef JSON_DISABLE_ENUM_SERIALIZATION
 #undef JSON_USE_GLOBAL_UDLS
-#undef JSON_STRICT_NUL_HANDLING

 #ifndef JSON_TEST_KEEP_MACROS
    #undef JSON_CATCH
@@ -46,6 +45,7 @@
    #undef JSON_USE_LEGACY_DISCARDED_VALUE_COMPARISON
    #undef JSON_BRACE_INIT_COPY_SEMANTICS
    #undef JSON_PRECISE_STREAM_POSITION
+    #undef JSON_STRICT_NUL_HANDLING
 #endif

 #include <nlohmann/thirdparty/hedley/hedley_undef.hpp>
@@ -122,7 +122,7 @@ class binary_writer
        {
            case value_t::object:
            {
-                write_bson_object(*j.m_data.m_value.object);
+                write_bson_document(j);
                break;
            }

@@ -1197,35 +1197,6 @@ class binary_writer
        }
    }

-    /*!
-    @brief Writes a BSON element with key @a name and object @a value
-    */
-    void write_bson_object_entry(const string_t& name,
-                                 const typename BasicJsonType::object_t& value)
-    {
-        write_bson_entry_header(name, 0x03); // object
-        write_bson_object(value);
-    }
-
-    /*!
-    @return The size of the BSON-encoded array @a value
-    */
-    static std::size_t calc_bson_array_size(const typename BasicJsonType::array_t& value)
-    {
-        std::size_t array_index = 0ul;
-
-        const std::size_t embedded_document_size = std::accumulate(std::begin(value), std::end(value), static_cast<std::size_t>(0), [&array_index](std::size_t result, const typename BasicJsonType::array_t::value_type & el)
-        {
-            // the index is built as a std::string, while calc_bson_element_size
-            // takes a string_t; convert explicitly, as the two are only
-            // implicitly convertible for some string types
-            const auto key = std::to_string(array_index++);
-            return result + calc_bson_element_size(string_t(key.data(), key.size()), el);
-        });
-
-        return sizeof(std::int32_t) + embedded_document_size + 1ul;
-    }
-
    /*!
    @return The size of the BSON-encoded binary array @a value
    */
@@ -1234,29 +1205,6 @@ class binary_writer
        return sizeof(std::int32_t) + value.size() + 1ul;
    }

-    /*!
-    @brief Writes a BSON element with key @a name and array @a value
-    */
-    void write_bson_array(const string_t& name,
-                          const typename BasicJsonType::array_t& value)
-    {
-        write_bson_entry_header(name, 0x04); // array
-        write_number<std::int32_t>(to_bson_length(calc_bson_array_size(value)), true);
-
-        std::size_t array_index = 0ul;
-
-        for (const auto& el : value)
-        {
-            // the index is built as a std::string, while write_bson_element takes
-            // a string_t; convert explicitly, as the two are only implicitly
-            // convertible for some string types
-            const auto key = std::to_string(array_index++);
-            write_bson_element(string_t(key.data(), key.size()), el);
-        }
-
-        oa.write_character(to_char_type(0x00));
-    }
-
    /*!
    @brief Writes a BSON element with key @a name and binary value @a value
    */
@@ -1278,43 +1226,37 @@ class binary_writer
    }

    /*!
-    @brief Calculates the size necessary to serialize the JSON value @a j with its @a name
-    @return The calculated size for the BSON document entry for @a j with the given @a name.
+    @return The size of the value of the BSON document entry for @a j, which
+            is neither an object nor an array
    */
-    static std::size_t calc_bson_element_size(const string_t& name,
-            const BasicJsonType& j)
+    static std::size_t calc_bson_value_size(const BasicJsonType& j)
    {
-        const auto header_size = calc_bson_entry_header_size(name, j);
        switch (j.type())
        {
-            case value_t::object:
-                return header_size + calc_bson_object_size(*j.m_data.m_value.object);
-
-            case value_t::array:
-                return header_size + calc_bson_array_size(*j.m_data.m_value.array);
-
            case value_t::binary:
-                return header_size + calc_bson_binary_size(*j.m_data.m_value.binary);
+                return calc_bson_binary_size(*j.m_data.m_value.binary);

            case value_t::boolean:
-                return header_size + 1ul;
+                return 1ul;

            case value_t::number_float:
-                return header_size + 8ul;
+                return 8ul;

            case value_t::number_integer:
-                return header_size + calc_bson_integer_size(j.m_data.m_value.number_integer);
+                return calc_bson_integer_size(j.m_data.m_value.number_integer);

            case value_t::number_unsigned:
-                return header_size + calc_bson_unsigned_size(j.m_data.m_value.number_unsigned);
+                return calc_bson_unsigned_size(j.m_data.m_value.number_unsigned);

            case value_t::string:
-                return header_size + calc_bson_string_size(*j.m_data.m_value.string);
+                return calc_bson_string_size(*j.m_data.m_value.string);

            case value_t::null:
-                return header_size + 0ul;
+                return 0ul;

            // LCOV_EXCL_START
+            case value_t::object:
+            case value_t::array:
            case value_t::discarded:
            default:
                JSON_ASSERT(false); // NOLINT(cert-dcl03-c,hicpp-static-assert,misc-static-assert)
@@ -1324,22 +1266,13 @@ class binary_writer
    }

    /*!
-    @brief Serializes the JSON value @a j to BSON and associates it with the
-           key @a name.
-    @param name The name to associate with the JSON entity @a j within the
-                current BSON document
+    @brief Writes the BSON document entry with key @a name for @a j, which is
+           neither an object nor an array
    */
-    void write_bson_element(const string_t& name,
-                            const BasicJsonType& j)
+    void write_bson_value(const string_t& name, const BasicJsonType& j)
    {
        switch (j.type())
        {
-            case value_t::object:
-                return write_bson_object_entry(name, *j.m_data.m_value.object);
-
-            case value_t::array:
-                return write_bson_array(name, *j.m_data.m_value.array);
-
            case value_t::binary:
                return write_bson_binary(name, *j.m_data.m_value.binary);

@@ -1362,6 +1295,8 @@ class binary_writer
                return write_bson_null(name);

            // LCOV_EXCL_START
+            case value_t::object:
+            case value_t::array:
            case value_t::discarded:
            default:
                JSON_ASSERT(false); // NOLINT(cert-dcl03-c,hicpp-static-assert,misc-static-assert)
@@ -1370,37 +1305,221 @@ class binary_writer
        }
    }

-    /*!
-    @brief Calculates the size of the BSON serialization of the given
-           JSON-object @a j.
-    @param[in] value  JSON value to serialize
-    @pre       value.type() == value_t::object
-    */
-    static std::size_t calc_bson_object_size(const typename BasicJsonType::object_t& value)
+    /// @brief an object or array of the BSON document being sized or written
+    struct bson_frame
    {
-        const std::size_t document_size = std::accumulate(value.begin(), value.end(), static_cast<std::size_t>(0),
-                                          [](size_t result, const typename BasicJsonType::object_t::value_type & el)
+        explicit bson_frame(const BasicJsonType* value_, const std::size_t size_slot_ = 0)
+            : value(value_)
+            , size_slot(size_slot_)
        {
-            return result += calc_bson_element_size(el.first, el.second);
-        });
+            if (value->is_object())
+            {
+                member = value->m_data.m_value.object->cbegin();
+            }
+        }

-        return sizeof(std::int32_t) + document_size + 1ul;
+        /// the object or array
+        const BasicJsonType* value;
+        /// objects: the next member
+        typename BasicJsonType::object_t::const_iterator member{};
+        /// arrays: the index of the next element
+        std::size_t index = 0;
+        /// @ref calc_bson_sizes only: where its size goes in the table
+        std::size_t size_slot;
+        /// @ref calc_bson_sizes only: the size of its entries seen so far
+        std::size_t entries_size = 0;
+    };
+
+    /*!
+    @brief creates the name BSON gives the array element with index @a index
+    @param[out] name  receives the decimal index
+    */
+    static void create_bson_index_name(const std::size_t index, string_t& name)
+    {
+        // the index is built as a std::string; convert explicitly, as the
+        // two are only implicitly convertible for some string types
+        const auto key = std::to_string(index);
+        name = string_t(key.data(), key.size());
    }

    /*!
-    @param[in] value  JSON value to serialize
-    @pre       value.type() == value_t::object
+    @brief Calculates the size of every object and array in the BSON document
+           @a document, including the document itself.
+
+    BSON prefixes every document and array with its size, so all of them have
+    to be known before the first byte is written. They are computed in a
+    single pass, each one from the sizes of its entries, which keeps
+    serializing linear in the size of the document; computing each size by
+    walking the entire value below it made it quadratic in the nesting depth.
+    The pass keeps the objects and arrays it has entered on an explicit stack,
+    so a deeply nested value cannot exhaust the call stack.
+
+    @param[in] document  the JSON object to serialize
+    @param[out] nested_sizes  the sizes of the objects and arrays in
+                              @a document, in the order they are written
+    @return the size of @a document
+    @throw out_of_range.409 if a key contains U+0000, before anything is
+           written
    */
-    void write_bson_object(const typename BasicJsonType::object_t& value)
+    static std::size_t calc_bson_sizes(const BasicJsonType& document, std::vector<std::size_t>& nested_sizes)
    {
-        write_number<std::int32_t>(to_bson_length(calc_bson_object_size(value)), true);
+        // the object or array whose entries are being sized, and the ones it
+        // is in; nothing is allocated unless the document nests
+        bson_frame current(&document);
+        std::vector<bson_frame> parents;
+        // string_t need not be default constructible
+        string_t index_name("", 0);

-        for (const auto& el : value)
+        while (true)
        {
-            write_bson_element(el.first, el.second);
-        }
+            // size entries until the current object or array is done, or an
+            // entry is an object or array itself
+            const BasicJsonType* nested = nullptr;
+            if (current.value->is_object())
+            {
+                const auto& object = *current.value->m_data.m_value.object;
+                while (nested == nullptr && current.member != object.cend())
+                {
+                    const auto& el = *current.member;
+                    ++current.member;
+                    current.entries_size += calc_bson_entry_header_size(el.first, el.second);
+                    if (el.second.is_structured())
+                    {
+                        nested = &el.second;
+                    }
+                    else
+                    {
+                        current.entries_size += calc_bson_value_size(el.second);
+                    }
+                }
+            }
+            else
+            {
+                const auto& array = *current.value->m_data.m_value.array;
+                while (nested == nullptr && current.index < array.size())
+                {
+                    const BasicJsonType& el = array[current.index];
+                    create_bson_index_name(current.index, index_name);
+                    current.entries_size += calc_bson_entry_header_size(index_name, el);
+                    ++current.index;
+                    if (el.is_structured())
+                    {
+                        nested = &el;
+                    }
+                    else
+                    {
+                        current.entries_size += calc_bson_value_size(el);
+                    }
+                }
+            }

-        oa.write_character(to_char_type(0x00));
+            if (nested != nullptr)
+            {
+                // its size is added to the current one's once it is done
+                nested_sizes.push_back(0);
+                parents.push_back(std::move(current));
+                current = bson_frame(nested, nested_sizes.size() - 1);
+                continue;
+            }
+
+            // the int32 size, the entries, and the terminating null byte
+            const std::size_t size = sizeof(std::int32_t) + current.entries_size + 1ul;
+            if (parents.empty())
+            {
+                return size;
+            }
+            nested_sizes[current.size_slot] = size;
+            current = std::move(parents.back());
+            parents.pop_back();
+            current.entries_size += size;
+        }
+    }
+
+    /*!
+    @brief Serializes the JSON object @a document as a BSON document
+
+    Writes the objects and arrays in it without the call stack, keeping the
+    ones it has entered on an explicit stack, so a deeply nested value
+    cannot exhaust the call stack.
+
+    @param[in] document  the JSON object to serialize
+    @pre       document.type() == value_t::object
+    */
+    void write_bson_document(const BasicJsonType& document)
+    {
+        std::vector<std::size_t> nested_sizes;
+        const std::size_t document_size = calc_bson_sizes(document, nested_sizes);
+        write_number<std::int32_t>(to_bson_length(document_size), true);
+
+        // the object or array whose entries are being written, and the ones
+        // it is in
+        bson_frame current(&document);
+        std::vector<bson_frame> parents;
+        std::size_t next_size = 0;
+        // string_t need not be default constructible
+        string_t index_name("", 0);
+
+        while (true)
+        {
+            // write entries until the current object or array is done, or an
+            // entry is an object or array itself
+            const string_t* nested_name = nullptr;
+            const BasicJsonType* nested = nullptr;
+            if (current.value->is_object())
+            {
+                const auto& object = *current.value->m_data.m_value.object;
+                while (nested == nullptr && current.member != object.cend())
+                {
+                    const auto& el = *current.member;
+                    ++current.member;
+                    if (el.second.is_structured())
+                    {
+                        nested_name = &el.first;
+                        nested = &el.second;
+                    }
+                    else
+                    {
+                        write_bson_value(el.first, el.second);
+                    }
+                }
+            }
+            else
+            {
+                const auto& array = *current.value->m_data.m_value.array;
+                while (nested == nullptr && current.index < array.size())
+                {
+                    const BasicJsonType& el = array[current.index];
+                    create_bson_index_name(current.index, index_name);
+                    ++current.index;
+                    if (el.is_structured())
+                    {
+                        nested_name = &index_name;
+                        nested = &el;
+                    }
+                    else
+                    {
+                        write_bson_value(index_name, el);
+                    }
+                }
+            }
+
+            if (nested != nullptr)
+            {
+                write_bson_entry_header(*nested_name, nested->is_object() ? 0x03 : 0x04);
+                write_number<std::int32_t>(to_bson_length(nested_sizes[next_size++]), true);
+                parents.push_back(std::move(current));
+                current = bson_frame(nested);
+                continue;
+            }
+
+            oa.write_character(to_char_type(0x00));
+            if (parents.empty())
+            {
+                return;
+            }
+            current = std::move(parents.back());
+            parents.pop_back();
+        }
    }

    //////////
@@ -32,6 +32,7 @@
 #include <nlohmann/detail/output/output_adapters.hpp>
 #include <nlohmann/detail/recursion_depth_limit.hpp>
 #include <nlohmann/detail/string_concat.hpp>
+#include <nlohmann/detail/string_utils.hpp>
 #include <nlohmann/detail/value_t.hpp>

 NLOHMANN_JSON_NAMESPACE_BEGIN
@@ -58,8 +59,6 @@ class serializer
    using number_integer_t = typename BasicJsonType::number_integer_t;
    using number_unsigned_t = typename BasicJsonType::number_unsigned_t;
    using binary_char_t = typename BasicJsonType::binary_t::value_type;
-    static constexpr std::uint8_t UTF8_ACCEPT = 0;
-    static constexpr std::uint8_t UTF8_REJECT = 1;

  public:
    /*!
@@ -1592,62 +1591,6 @@ class serializer
        }
    }

-    /*!
-    @brief check whether a string is UTF-8 encoded
-
-    The function checks each byte of a string whether it is UTF-8 encoded. The
-    result of the check is stored in the @a state parameter. The function must
-    be called initially with state 0 (accept). State 1 means the string must
-    be rejected, because the current byte is not allowed. If the string is
-    completely processed, but the state is non-zero, the string ended
-    prematurely; that is, the last byte indicated more bytes should have
-    followed.
-
-    @param[in,out] state  the state of the decoding
-    @param[in,out] codep  codepoint (valid only if resulting state is UTF8_ACCEPT)
-    @param[in] byte       next byte to decode
-    @return               new state
-
-    @note The function has been edited: a std::array is used.
-
-    @copyright Copyright (c) 2008-2009 Bjoern Hoehrmann <bjoern@hoehrmann.de>
-    @sa http://bjoern.hoehrmann.de/utf-8/decoder/dfa/
-    */
-    static std::uint8_t decode(std::uint8_t& state, std::uint32_t& codep, const std::uint8_t byte) noexcept
-    {
-        static const std::array<std::uint8_t, 400> utf8d =
-        {
-            {
-                0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, // 00..1F
-                0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, // 20..3F
-                0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, // 40..5F
-                0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, // 60..7F
-                1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 9, 9, 9, 9, 9, 9, 9, 9, 9, 9, 9, 9, 9, 9, 9, 9, // 80..9F
-                7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, // A0..BF
-                8, 8, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, // C0..DF
-                0xA, 0x3, 0x3, 0x3, 0x3, 0x3, 0x3, 0x3, 0x3, 0x3, 0x3, 0x3, 0x3, 0x4, 0x3, 0x3, // E0..EF
-                0xB, 0x6, 0x6, 0x6, 0x5, 0x8, 0x8, 0x8, 0x8, 0x8, 0x8, 0x8, 0x8, 0x8, 0x8, 0x8, // F0..FF
-                0x0, 0x1, 0x2, 0x3, 0x5, 0x8, 0x7, 0x1, 0x1, 0x1, 0x4, 0x6, 0x1, 0x1, 0x1, 0x1, // s0..s0
-                1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 0, 1, 1, 1, 1, 1, 0, 1, 0, 1, 1, 1, 1, 1, 1, // s1..s2
-                1, 2, 1, 1, 1, 1, 1, 2, 1, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 2, 1, 1, 1, 1, 1, 1, 1, 1, // s3..s4
-                1, 2, 1, 1, 1, 1, 1, 1, 1, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 3, 1, 3, 1, 1, 1, 1, 1, 1, // s5..s6
-                1, 3, 1, 1, 1, 1, 1, 3, 1, 3, 1, 1, 1, 1, 1, 1, 1, 3, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1 // s7..s8
-            }
-        };
-
-        JSON_ASSERT(static_cast<std::size_t>(byte) < utf8d.size());
-        const std::uint8_t type = utf8d[byte];
-
-        codep = (state != UTF8_ACCEPT)
-                ? (byte & 0x3fu) | (codep << 6u)
-                : (0xFFu >> type) & (byte);
-
-        const std::size_t index = 256u + (static_cast<size_t>(state) * 16u) + static_cast<size_t>(type);
-        JSON_ASSERT(index < utf8d.size());
-        state = utf8d[index];
-        return state;
-    }
-
    /*
     * Overload to make the compiler happy while it is instantiating
     * dump_integer for number_unsigned_t.
@@ -8,10 +8,13 @@

 #pragma once

+#include <array> // array
 #include <cstddef> // size_t
+#include <cstdint> // uint8_t, uint32_t
 #include <string> // string, to_string

 #include <nlohmann/detail/abi_macros.hpp>
+#include <nlohmann/detail/macro_scope.hpp>

 NLOHMANN_JSON_NAMESPACE_BEGIN
 namespace detail
@@ -33,5 +36,102 @@ StringType to_string(std::size_t value)
    return result;
 }

+///////////////////
+// UTF-8 decoding //
+///////////////////
+
+// UTF-8 decoder states used by decode() below
+static constexpr std::uint8_t UTF8_ACCEPT = 0;
+static constexpr std::uint8_t UTF8_REJECT = 1;
+
+/*!
+@brief process a byte of a UTF-8 sequence
+
+This is a single-byte step of a "shift-based" UTF-8 decoder originally
+written by Björn Hoehrmann. See
+http://bjoern.hoehrmann.de/utf-8/decoder/dfa/ for details.
+
+This decoder is the single source of truth for UTF-8 validation in this
+library: it is used both by the serializer (to escape and, in strict mode,
+reject ill-formed UTF-8 when dumping a string) and by the binary readers
+(to reject ill-formed UTF-8 in CBOR/MessagePack/BSON/UBJSON text strings at
+decode time; see @ref is_valid_utf8 below).
+
+@param[in,out] state  the current decoder state
+@param[in,out] codep  codepoint (valid only if resulting state is UTF8_ACCEPT)
+@param[in] byte       next byte to decode
+@return               new state
+
+@note Original source: http://bjoern.hoehrmann.de/utf-8/decoder/dfa/
+@sa http://bjoern.hoehrmann.de/utf-8/decoder/dfa/
+*/
+inline std::uint8_t decode(std::uint8_t& state, std::uint32_t& codep, const std::uint8_t byte) noexcept
+{
+    static const std::array<std::uint8_t, 400> utf8d =
+    {
+        {
+            0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, // 00..1F
+            0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, // 20..3F
+            0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, // 40..5F
+            0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, // 60..7F
+            1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 9, 9, 9, 9, 9, 9, 9, 9, 9, 9, 9, 9, 9, 9, 9, 9, // 80..9F
+            7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, // A0..BF
+            8, 8, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, // C0..DF
+            0xA, 0x3, 0x3, 0x3, 0x3, 0x3, 0x3, 0x3, 0x3, 0x3, 0x3, 0x3, 0x3, 0x4, 0x3, 0x3, // E0..EF
+            0xB, 0x6, 0x6, 0x6, 0x5, 0x8, 0x8, 0x8, 0x8, 0x8, 0x8, 0x8, 0x8, 0x8, 0x8, 0x8, // F0..FF
+            0x0, 0x1, 0x2, 0x3, 0x5, 0x8, 0x7, 0x1, 0x1, 0x1, 0x4, 0x6, 0x1, 0x1, 0x1, 0x1, // s0..s0
+            1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 0, 1, 1, 1, 1, 1, 0, 1, 0, 1, 1, 1, 1, 1, 1, // s1..s2
+            1, 2, 1, 1, 1, 1, 1, 2, 1, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 2, 1, 1, 1, 1, 1, 1, 1, 1, // s3..s4
+            1, 2, 1, 1, 1, 1, 1, 1, 1, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 3, 1, 3, 1, 1, 1, 1, 1, 1, // s5..s6
+            1, 3, 1, 1, 1, 1, 1, 3, 1, 3, 1, 1, 1, 1, 1, 1, 1, 3, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1 // s7..s8
+        }
+    };
+
+    JSON_ASSERT(static_cast<std::size_t>(byte) < utf8d.size());
+    const std::uint8_t type = utf8d[byte];
+
+    codep = (state != UTF8_ACCEPT)
+            ? (byte & 0x3fu) | (codep << 6u)
+            : (0xFFu >> type) & (byte);
+
+    const std::size_t index = 256u + (static_cast<std::size_t>(state) * 16u) + static_cast<std::size_t>(type);
+    JSON_ASSERT(index < utf8d.size());
+    state = utf8d[index];
+    return state;
+}
+
+/*!
+@brief check whether a string consists solely of valid UTF-8
+
+Used by the CBOR/MessagePack/BSON/UBJSON binary readers to reject text
+strings that are not valid UTF-8 at decode time (RFC 8949 §3.1 and the
+MessagePack/BSON specifications all require text strings to be UTF-8), so
+that malformed input is caught immediately instead of only surfacing later
+as a type_error.316 when the resulting value is dumped.
+
+@param[in] s      the string to check
+@param[in] first  index of the first byte to check; the bytes before it are
+                  assumed to have been validated already and to end on a
+                  code point boundary
+@return whether @a s (from index @a first on) is valid UTF-8
+*/
+template<typename StringType>
+inline bool is_valid_utf8(const StringType& s, const std::size_t first = 0) noexcept
+{
+    std::uint8_t state = UTF8_ACCEPT;
+    std::uint32_t codepoint = 0;
+
+    for (std::size_t i = first; i < s.size(); ++i)
+    {
+        decode(state, codepoint, static_cast<std::uint8_t>(s[i]));
+        if (state == UTF8_REJECT)
+        {
+            return false;
+        }
+    }
+
+    return state == UTF8_ACCEPT;
+}
+
 }  // namespace detail
 NLOHMANN_JSON_NAMESPACE_END
@@ -1003,7 +1003,8 @@ class basic_json // NOLINT(cppcoreguidelines-special-member-functions,hicpp-spec
    using copy_worklist_t = std::vector<std::pair<const basic_json*, basic_json*>>;

    /// scratch space to build the key skeleton of an object copy in one go
-    using copy_scratch_t = std::vector<std::pair<typename object_t::key_type, basic_json>>;
+    using copy_scratch_value_t = std::pair<typename object_t::key_type, basic_json>;
+    using copy_scratch_t = std::vector<copy_scratch_value_t, AllocatorType<copy_scratch_value_t>>;

    /// @brief copy everything of @a src into @a dst but its type and value
    static void copy_metadata(const basic_json& src, basic_json& dst)
@@ -5992,6 +5993,56 @@ class basic_json // NOLINT(cppcoreguidelines-special-member-functions,hicpp-spec
    JSON_HEDLEY_WARN_UNUSED_RESULT
    static basic_json diff(const basic_json& source, const basic_json& target,
                           const string_t& path = "")
+    {
+        return diff_recursively(source, target, path, 0);
+    }
+
+  private:
+    /// @brief two arrays or two objects @ref diff_iteratively is diffing
+    struct diff_frame
+    {
+        diff_frame(const basic_json* source_, const basic_json* target_, const std::size_t path_length_) noexcept
+            : source(source_), target(target_), path_length(path_length_)
+        {}
+
+        // declared for GCC's -Weffc++, which asks for them in a class with
+        // pointer members and a non-trivial destructor; the exception
+        // specifications are left implicit, as GCC 4.8 rejects explicit ones
+        // that differ from them
+        diff_frame(const diff_frame&) = default;
+        diff_frame(diff_frame&&) = default;
+        diff_frame& operator=(const diff_frame&) = default;
+        diff_frame& operator=(diff_frame&&) = default;
+        ~diff_frame() = default;
+
+        /// the values being diffed, both arrays or both objects
+        const basic_json* source;
+        const basic_json* target;
+        /// the length of their path in `current_path`
+        std::size_t path_length;
+        /// arrays: the next index to diff
+        std::size_t index = 0;
+        /// objects: the next member of source to look at
+        const_iterator member{}; // NOLINT(readability-redundant-member-init)
+        /// objects: the keys common to both, in source's order
+        std::vector<typename object_t::key_type> common_keys{}; // NOLINT(readability-redundant-member-init)
+        /// objects: the next entry of common_keys
+        std::size_t next_common = 0;
+        /// objects: the "add" operations for keys only target has
+        basic_json added_ops{}; // NOLINT(readability-redundant-member-init)
+    };
+
+    /*!
+    @brief @ref diff, for values at nesting level @a depth
+
+    Diffing two arrays or objects calls this function again, once per nesting
+    level, so values nested deeply enough used to exhaust the call stack and
+    terminate the process. The descent is bounded here: once @ref
+    detail::recursion_depth_limit levels have been entered, @ref
+    diff_iteratively diffs what is left without the call stack.
+    */
+    static basic_json diff_recursively(const basic_json& source, const basic_json& target,
+                                       const string_t& path, const std::size_t depth)
    {
        // the patch
        basic_json result(value_t::array);
@@ -6002,6 +6053,11 @@ class basic_json // NOLINT(cppcoreguidelines-special-member-functions,hicpp-spec
            return result;
        }

+        if (JSON_HEDLEY_UNLIKELY(depth >= detail::recursion_depth_limit()))
+        {
+            return diff_iteratively(source, target, path);
+        }
+
        if (source.type() != target.type())
        {
            // different types: replace value
@@ -6021,7 +6077,7 @@ class basic_json // NOLINT(cppcoreguidelines-special-member-functions,hicpp-spec
                while (i < source.size() && i < target.size())
                {
                    // recursive call to compare array values at index i
-                    auto temp_diff = diff(source[i], target[i], detail::concat<string_t>(path, '/', detail::to_string<string_t>(i)));
+                    auto temp_diff = diff_recursively(source[i], target[i], detail::concat<string_t>(path, '/', detail::to_string<string_t>(i)), depth + 1);
                    result.insert(result.end(), temp_diff.begin(), temp_diff.end());
                    ++i;
                }
@@ -6140,7 +6196,7 @@ class basic_json // NOLINT(cppcoreguidelines-special-member-functions,hicpp-spec
                        if (common_it != common_keys_source_order.cend() && it.key() == *common_it)
                        {
                            const auto path_key = detail::concat<string_t>(path, '/', detail::escape(it.key()));
-                            auto temp_diff = diff(it.value(), target[it.key()], path_key);
+                            auto temp_diff = diff_recursively(it.value(), target[it.key()], path_key, depth + 1);
                            result.insert(result.end(), temp_diff.begin(), temp_diff.end());
                            ++common_it;
                        }
@@ -6224,6 +6280,301 @@ class basic_json // NOLINT(cppcoreguidelines-special-member-functions,hicpp-spec

        return result;
    }
+
+    /*!
+    @brief @ref diff without the call stack
+
+    Produces the same patch as @ref diff_recursively. Only reached for values
+    nested more deeply than @ref detail::recursion_depth_limit.
+    */
+    static basic_json diff_iteratively(const basic_json& source, const basic_json& target,
+                                       const string_t& path)
+    {
+        // the patch
+        basic_json result(value_t::array);
+
+        // The arrays and objects being diffed are kept on an explicit stack,
+        // and every pair of elements is still diffed completely before the
+        // next one, so the operations come out in the same order as in
+        // diff_recursively. The path of the values being diffed is kept in
+        // one buffer that grows and shrinks with the stack, rather than in a
+        // new string per level.
+        std::vector<diff_frame> stack;
+        string_t current_path = path;
+
+        // diff `s` against `t`, whose path is current_path: primitives,
+        // values of different types, and objects whose members were reordered
+        // are handled right away; arrays and other objects get a frame
+        const auto enter = [&result, &stack, &current_path](const basic_json & s, const basic_json & t)
+        {
+            // if the values are the same, there is nothing to do. Arrays and
+            // objects are not compared up front: comparing them visits
+            // everything below them, so doing that at every level would take
+            // quadratic time in the nesting depth - equal ones yield no
+            // operations anyway.
+            if ((!s.is_structured() || !t.is_structured()) && s == t)
+            {
+                return;
+            }
+
+            if (s.type() != t.type())
+            {
+                // different types: replace value
+                result.push_back(
+                {
+                    {"op", "replace"}, {"path", current_path}, {"value", t}
+                });
+                return;
+            }
+
+            switch (s.type())
+            {
+                case value_t::array:
+                {
+                    stack.emplace_back(&s, &t, current_path.size());
+                    return;
+                }
+
+                case value_t::object:
+                {
+                    // first pass: record, for every source key, whether it is
+                    // common to both objects (in source's iteration order) or
+                    // was deleted (i.e., in source but not in target) -- this is
+                    // a by-product of the t.find() call already needed to
+                    // tell the two cases apart, so it adds no extra lookups. The
+                    // "remove" ops themselves are emitted later, interleaved
+                    // with the per-key diffs in the fast path below, to match
+                    // source's original iteration order (as the original,
+                    // pre-reordering-aware implementation did) instead of
+                    // grouping all removes before all per-key diffs.
+                    std::vector<typename object_t::key_type> common_keys_source_order;
+                    for (auto it = s.cbegin(); it != s.cend(); ++it)
+                    {
+                        if (t.find(it.key()) != t.end())
+                        {
+                            common_keys_source_order.push_back(it.key());
+                        }
+                    }
+
+                    // second pass: find keys that were added (i.e., in target but
+                    // not in source), and record the keys common to both, in
+                    // target's iteration order -- again a by-product of the
+                    // s.find() call already needed to detect added keys. At
+                    // the same time, determine whether every added key comes
+                    // after every common key in target's order (a precondition
+                    // for the fast path below, which only ever appends new keys
+                    // at the very end): for an object_t whose iteration order is
+                    // a pure function of the key set (e.g. the default std::map,
+                    // which always iterates in sorted key order), the order
+                    // check further below is always true and this whole
+                    // mechanism is effectively a no-op; it only matters for a
+                    // reorderable object_t such as the one backing `ordered_json`.
+                    // patch ops for keys that were added (i.e., in target but not
+                    // in source); built here so the fast path below can reuse
+                    // them without a second s.find() per target key. Only
+                    // used by the fast path -- the slow (reordering) path
+                    // rebuilds "add" ops for every key itself.
+                    std::vector<typename object_t::key_type> common_keys_target_order;
+                    basic_json added_ops(value_t::array);
+                    bool new_keys_form_suffix = true;
+                    bool seen_new_key = false;
+                    for (auto it = t.cbegin(); it != t.cend(); ++it)
+                    {
+                        if (s.find(it.key()) == s.end())
+                        {
+                            seen_new_key = true;
+                            const auto path_key = detail::concat<string_t>(current_path, '/', detail::escape(it.key()));
+                            added_ops.push_back(
+                            {
+                                {"op", "add"}, {"path", path_key},
+                                {"value", it.value()}
+                            });
+                        }
+                        else
+                        {
+                            common_keys_target_order.push_back(it.key());
+                            if (seen_new_key)
+                            {
+                                new_keys_form_suffix = false;
+                            }
+                        }
+                    }
+
+                    if (common_keys_source_order == common_keys_target_order && new_keys_form_suffix)
+                    {
+                        // fast path: order of common keys already matches (or the
+                        // object_t's iteration order does not depend on
+                        // insertion history), so a plain per-key diff is correct
+                        // and minimal, as before. The frame walks source in
+                        // lockstep with common_keys_source_order, which is, by
+                        // construction, the subsequence of source's keys that
+                        // are common to both objects, in source's iteration
+                        // order -- so a cheap key comparison replaces another
+                        // lookup. Deleted keys are interleaved there too, in
+                        // source's original order, and the "add" ops collected
+                        // above are appended once all members are done.
+                        stack.emplace_back(&s, &t, current_path.size());
+                        stack.back().member = s.cbegin();
+                        stack.back().common_keys = std::move(common_keys_source_order);
+                        stack.back().added_ops = std::move(added_ops);
+                        return;
+                    }
+
+                    // slow path: the common keys are in a different relative
+                    // order in source and target (only possible for a
+                    // reorderable object_t like ordered_map). Building a
+                    // minimal reordering patch is a nontrivial (LCS-like)
+                    // problem; instead, remove every source key -- both
+                    // deleted keys (which must be removed regardless) and
+                    // common keys (removed so they can be re-added in
+                    // target's order) -- and re-add every key that should
+                    // remain, with its final target value, in target's
+                    // order. basic_json::patch()'s "add" operation on an
+                    // object uses operator[], which appends at the end for a
+                    // vector-backed insertion-ordered map when the key does
+                    // not already exist -- so removing a key and then adding
+                    // it moves it to the end, fixing its position.
+                    for (auto it = s.cbegin(); it != s.cend(); ++it)
+                    {
+                        const auto path_key = detail::concat<string_t>(current_path, '/', detail::escape(it.key()));
+                        result.push_back(object(
+                        {
+                            {"op", "remove"}, {"path", path_key}
+                        }));
+                    }
+
+                    // add every key that is either common (just removed
+                    // above) or brand new, in target's iteration order, so
+                    // that the final order after applying the patch matches
+                    // target exactly
+                    for (auto it = t.cbegin(); it != t.cend(); ++it)
+                    {
+                        const auto path_key = detail::concat<string_t>(current_path, '/', detail::escape(it.key()));
+                        result.push_back(
+                        {
+                            {"op", "add"}, {"path", path_key},
+                            {"value", it.value()}
+                        });
+                    }
+                    return;
+                }
+
+                case value_t::null:
+                case value_t::string:
+                case value_t::boolean:
+                case value_t::number_integer:
+                case value_t::number_unsigned:
+                case value_t::number_float:
+                case value_t::binary:
+                case value_t::discarded:
+                default:
+                {
+                    // both primitive types: replace value
+                    result.push_back(
+                    {
+                        {"op", "replace"}, {"path", current_path}, {"value", t}
+                    });
+                    return;
+                }
+            }
+        };
+
+        enter(source, target);
+        while (!stack.empty())
+        {
+            diff_frame& frame = stack.back();
+            const std::size_t path_length = frame.path_length;
+            const std::size_t depth = stack.size();
+
+            if (frame.source->is_array())
+            {
+                const auto& source_array = *frame.source->m_data.m_value.array;
+                const auto& target_array = *frame.target->m_data.m_value.array;
+
+                // first pass: traverse common elements
+                if (frame.index < source_array.size() && frame.index < target_array.size())
+                {
+                    const std::size_t i = frame.index++;
+                    detail::concat_into(current_path, '/', detail::to_string<string_t>(i));
+                    enter(source_array[i], target_array[i]); // may push, which invalidates `frame`
+                    if (stack.size() == depth)
+                    {
+                        current_path.resize(path_length);
+                    }
+                    continue;
+                }
+
+                // We now reached the end of at least one array
+                // in a second pass, traverse the remaining elements
+
+                // remove my remaining elements, highest index first; appending
+                // in that order avoids the quadratic reinsertion done before
+                for (std::size_t j = source_array.size(); j > frame.index; --j)
+                {
+                    result.push_back(object(
+                    {
+                        {"op", "remove"},
+                        {"path", detail::concat<string_t>(current_path, '/', detail::to_string<string_t>(j - 1))}
+                    }));
+                }
+
+                // add other remaining elements
+                for (std::size_t i = source_array.size(); i < target_array.size(); ++i)
+                {
+                    result.push_back(
+                    {
+                        {"op", "add"},
+                        {"path", detail::concat<string_t>(current_path, "/-")},
+                        {"value", target_array[i]}
+                    });
+                }
+            }
+            else
+            {
+                if (frame.member != frame.source->cend())
+                {
+                    const const_iterator it = frame.member;
+                    ++frame.member;
+                    if (frame.next_common < frame.common_keys.size() && it.key() == frame.common_keys[frame.next_common])
+                    {
+                        ++frame.next_common;
+                        const basic_json& target_value = (*frame.target)[it.key()];
+                        detail::concat_into(current_path, '/', detail::escape(it.key()));
+                        enter(it.value(), target_value); // may push, which invalidates `frame`
+                        if (stack.size() == depth)
+                        {
+                            current_path.resize(path_length);
+                        }
+                    }
+                    else
+                    {
+                        // found a key that is not in target -> remove it
+                        const auto path_key = detail::concat<string_t>(current_path, '/', detail::escape(it.key()));
+                        result.push_back(object(
+                        {
+                            {"op", "remove"}, {"path", path_key}
+                        }));
+                    }
+                    continue;
+                }
+
+                // append the "add" ops for brand-new keys collected when the
+                // object was entered
+                result.insert(result.end(), frame.added_ops.begin(), frame.added_ops.end());
+            }
+
+            // this array or object is done: continue with the one it is in
+            stack.pop_back();
+            if (!stack.empty())
+            {
+                current_path.resize(stack.back().path_length);
+            }
+        }
+
+        return result;
+    }
+
+  public:
    /// @}

    ////////////////////////////////
@@ -60,6 +60,10 @@
    #define JSON_PRECISE_STREAM_POSITION 0
 #endif

+#ifndef JSON_STRICT_NUL_HANDLING
+    #define JSON_STRICT_NUL_HANDLING 0
+#endif
+
 #if JSON_DIAGNOSTICS
    #define NLOHMANN_JSON_ABI_TAG_DIAGNOSTICS _diag
 #else
@@ -90,14 +94,20 @@
    #define NLOHMANN_JSON_ABI_TAG_PRECISE_STREAM_POSITION
 #endif

+#if JSON_STRICT_NUL_HANDLING
+    #define NLOHMANN_JSON_ABI_TAG_STRICT_NUL_HANDLING _snul
+#else
+    #define NLOHMANN_JSON_ABI_TAG_STRICT_NUL_HANDLING
+#endif
+
 #ifndef NLOHMANN_JSON_NAMESPACE_NO_VERSION
    #define NLOHMANN_JSON_NAMESPACE_NO_VERSION 0
 #endif

 // Construct the namespace ABI tags component
-#define NLOHMANN_JSON_ABI_TAGS_CONCAT_EX(a, b, c, d, e) json_abi ## a ## b ## c ## d ## e
-#define NLOHMANN_JSON_ABI_TAGS_CONCAT(a, b, c, d, e) \
-    NLOHMANN_JSON_ABI_TAGS_CONCAT_EX(a, b, c, d, e)
+#define NLOHMANN_JSON_ABI_TAGS_CONCAT_EX(a, b, c, d, e, f) json_abi ## a ## b ## c ## d ## e ## f
+#define NLOHMANN_JSON_ABI_TAGS_CONCAT(a, b, c, d, e, f) \
+    NLOHMANN_JSON_ABI_TAGS_CONCAT_EX(a, b, c, d, e, f)

 #define NLOHMANN_JSON_ABI_TAGS                                       \
    NLOHMANN_JSON_ABI_TAGS_CONCAT(                                   \
@@ -105,7 +115,8 @@
            NLOHMANN_JSON_ABI_TAG_LEGACY_DISCARDED_VALUE_COMPARISON, \
            NLOHMANN_JSON_ABI_TAG_DIAGNOSTIC_POSITIONS,              \
            NLOHMANN_JSON_ABI_TAG_BRACE_INIT_COPY_SEMANTICS,         \
-            NLOHMANN_JSON_ABI_TAG_PRECISE_STREAM_POSITION)
+            NLOHMANN_JSON_ABI_TAG_PRECISE_STREAM_POSITION,           \
+            NLOHMANN_JSON_ABI_TAG_STRICT_NUL_HANDLING)

 // Construct the namespace version component
 #define NLOHMANN_JSON_NAMESPACE_VERSION_CONCAT_EX(major, minor, patch) \
@@ -40,6 +40,10 @@ TEST_CASE("default namespace")
        expected += "_psp";
 #endif

+#if JSON_STRICT_NUL_HANDLING
+        expected += "_snul";
+#endif
+
        expected += "_v" STRINGIZE(NLOHMANN_JSON_VERSION_MAJOR);
        expected += "_" STRINGIZE(NLOHMANN_JSON_VERSION_MINOR);
        expected += "_" STRINGIZE(NLOHMANN_JSON_VERSION_PATCH) "::basic_json";
@@ -41,6 +41,10 @@ TEST_CASE("default namespace without version component")
        expected += "_psp";
 #endif

+#if JSON_STRICT_NUL_HANDLING
+        expected += "_snul";
+#endif
+
        expected += "::basic_json";

        // fallback for Clang
@@ -1,4 +1,4 @@
-cmake_minimum_required(VERSION 3.11...3.14)
+cmake_minimum_required(VERSION 3.14)
 project(JSON_Benchmarks LANGUAGES CXX)

 # set compiler flags
@@ -6,29 +6,35 @@ if((CMAKE_CXX_COMPILER_ID MATCHES GNU) OR (CMAKE_CXX_COMPILER_ID MATCHES Clang))
    set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -flto -DNDEBUG -O3")
 endif()

-# configure Google Benchmarks
+# configure Google Benchmark; a fixed release, so that results stay comparable
+set(JSON_GOOGLE_BENCHMARK_VERSION 1.9.5)
 include(FetchContent)
-FetchContent_Declare(
-    benchmark
-    GIT_REPOSITORY https://github.com/google/benchmark.git
-    GIT_TAG origin/main
-    GIT_SHALLOW TRUE
-)

-FetchContent_GetProperties(benchmark)
-if(NOT benchmark_POPULATED)
-    FetchContent_Populate(benchmark)
-    set(BENCHMARK_ENABLE_TESTING OFF CACHE INTERNAL "" FORCE)
-    add_subdirectory(${benchmark_SOURCE_DIR} ${benchmark_BINARY_DIR})
-endif()
+# only the library is needed; -Werror would break the pinned release as soon as
+# a newer compiler adds a warning
+set(BENCHMARK_ENABLE_TESTING OFF CACHE BOOL "" FORCE)
+set(BENCHMARK_ENABLE_INSTALL OFF CACHE BOOL "" FORCE)
+set(BENCHMARK_ENABLE_WERROR OFF CACHE BOOL "" FORCE)
+
+FetchContent_Declare(benchmark
+    URL https://github.com/google/benchmark/archive/refs/tags/v${JSON_GOOGLE_BENCHMARK_VERSION}.tar.gz
+    URL_HASH SHA256=9631341c82bac4a288bef951f8b26b41f69021794184ece969f8473977eaa340
+    DOWNLOAD_EXTRACT_TIMESTAMP TRUE
+)
+FetchContent_MakeAvailable(benchmark)

 # download test data
 set(CMAKE_MODULE_PATH ${CMAKE_CURRENT_SOURCE_DIR}/../../cmake ${CMAKE_MODULE_PATH})
 include(download_test_data)

+# the header to benchmark; point this at a directory holding another version's
+# nlohmann/json.hpp to compare versions (see README.md)
+set(JSON_BENCHMARK_INCLUDE_DIR "${CMAKE_CURRENT_SOURCE_DIR}/../../single_include" CACHE PATH
+    "directory containing the nlohmann/json.hpp to benchmark")
+
 # benchmark binary
 add_executable(json_benchmarks src/benchmarks.cpp)
 target_compile_features(json_benchmarks PRIVATE cxx_std_11)
 target_link_libraries(json_benchmarks benchmark ${CMAKE_THREAD_LIBS_INIT})
 add_dependencies(json_benchmarks download_test_data)
-target_include_directories(json_benchmarks PRIVATE ${CMAKE_SOURCE_DIR}/../../single_include ${CMAKE_BINARY_DIR}/include)
+target_include_directories(json_benchmarks PRIVATE ${JSON_BENCHMARK_INCLUDE_DIR} ${CMAKE_BINARY_DIR}/include)
@@ -0,0 +1,130 @@
+# Benchmarks
+
+Micro-benchmarks for parsing, serialization and the binary formats, written with
+[Google Benchmark](https://github.com/google/benchmark). They are not run by CI; see
+[When to run them](#when-to-run-them).
+
+## What is measured
+
+| benchmark | what it does |
+|---|---|
+| `ParseFile`, `ParseString` | parse JSON from a file stream or a string |
+| `ParseIndented` | parse the large files re-indented by 4 spaces, for the lexer's whitespace handling |
+| `Dump` | serialize, compact (`-`) and indented (`4`) |
+| `ToCbor`, `BinaryToCbor` | write CBOR; `BinaryToCbor` writes binary values of growing size |
+| `FromMsgpack` | read MessagePack; unchanged over the years, so its numbers stay comparable across releases |
+| `FromBinaryBuffer`, `FromBinaryFile` | read CBOR, MessagePack, UBJSON, BJData and BSON from a buffer or a `FILE*` |
+| `FromBinaryShape` | read deeply nested, container-heavy and scalar-heavy documents in every binary format |
+| `FromCborChunkedString` | read CBOR strings split into indefinite-length chunks |
+
+The input files are those of [nativejson-benchmark](https://github.com/miloyip/nativejson-benchmark) (`canada`,
+`citm_catalog`, `twitter`), a large `jeopardy` file, and number-heavy files (`floats`, `signed_ints`, ...).
+`bytes_per_second` counts the bytes read or written: the JSON text when parsing, the output when serializing.
+
+## Requirements
+
+- CMake 3.14 or later, a C++11 compiler, and Ninja for the `make` target.
+- Network access on the first configure: CMake downloads Google Benchmark and the
+  [test data](https://github.com/nlohmann/json_test_data) into the build directory. To reuse a download of the test
+  data, pass `-DJSON_TestDataDirectory=<build directory>/test_files`.
+- Google Benchmark is pinned to a release (1.9.5), so that results from different days stay comparable. To update it,
+  change `JSON_GOOGLE_BENCHMARK_VERSION` and the archive's `URL_HASH` in `CMakeLists.txt` together.
+- The benchmarks include `single_include/nlohmann/json.hpp`, so run `make amalgamate` after changing anything in
+  `include/`.
+
+GCC and Clang builds use `-O3 -flto -DNDEBUG`.
+
+## Running them
+
+From the repository root, this builds everything from scratch in `cmake-build-benchmarks` and runs all benchmarks:
+
+```sh
+make run_benchmarks
+```
+
+To build once and run selectively:
+
+```sh
+cmake -S tests/benchmarks -B build-benchmarks -G Ninja -DCMAKE_BUILD_TYPE=Release
+cmake --build build-benchmarks
+build-benchmarks/json_benchmarks --benchmark_filter='ParseString|Dump'
+```
+
+Useful options of `json_benchmarks`:
+
+| option | effect |
+|---|---|
+| `--benchmark_list_tests` | list the benchmarks instead of running them |
+| `--benchmark_filter=<regex>` | run only the benchmarks whose names match |
+| `--benchmark_repetitions=<n>` | run every benchmark `n` times and add mean, median, standard deviation and coefficient of variation |
+| `--benchmark_enable_random_interleaving=true` | run the repetitions in random order, which spreads out drifts such as thermal throttling |
+| `--benchmark_min_time=<seconds>s` | run each benchmark at least this long (e.g. `2s`) |
+| `--benchmark_out=<file> --benchmark_out_format=json` | also write the results to a file, e.g. for `compare.py` |
+
+## Reading the output
+
+Each line shows the wall-clock `Time` and the `CPU` time per iteration, the number of `Iterations` Google Benchmark
+chose, and the throughput in `bytes_per_second`. With repetitions, the lines ending in `_median` are the ones to
+compare. A `_cv` (coefficient of variation) above a few percent means the machine was too noisy for small
+differences to mean anything.
+
+## Comparing two versions
+
+To see what a change or a release did, build the same benchmarks twice: once against the header of the version to
+compare with, and once against the current one. `JSON_BENCHMARK_INCLUDE_DIR` names the directory holding the
+`nlohmann/json.hpp` to benchmark. For example, to compare the current checkout with 3.12.0:
+
+```sh
+# the header of the version to compare with
+mkdir -p build-baseline-header/nlohmann
+git show v3.12.0:single_include/nlohmann/json.hpp > build-baseline-header/nlohmann/json.hpp
+
+# the same benchmarks, built against either header
+cmake -S tests/benchmarks -B build-baseline -G Ninja -DCMAKE_BUILD_TYPE=Release \
+      -DJSON_BENCHMARK_INCLUDE_DIR="$PWD/build-baseline-header"
+cmake -S tests/benchmarks -B build-current -G Ninja -DCMAKE_BUILD_TYPE=Release
+cmake --build build-baseline
+cmake --build build-current
+
+# run both, back to back
+build-baseline/json_benchmarks --benchmark_repetitions=10 --benchmark_enable_random_interleaving=true \
+                               --benchmark_out=build-baseline/results.json --benchmark_out_format=json
+build-current/json_benchmarks --benchmark_repetitions=10 --benchmark_enable_random_interleaving=true \
+                              --benchmark_out=build-current/results.json --benchmark_out_format=json
+```
+
+Google Benchmark ships a tool to compare the two result files. It needs NumPy and SciPy:
+
+```sh
+python3 -m venv build-venv
+build-venv/bin/pip install numpy scipy
+build-venv/bin/python build-current/_deps/benchmark-src/tools/compare.py -a benchmarks build-baseline/results.json build-current/results.json
+```
+
+The tool's own `tools/requirements.txt` pins NumPy and SciPy versions that need Python 3.11 or later; with an older
+Python, unpinned versions work as well. In its output:
+
+- the `Time` and `CPU` columns are relative changes: `-0.35` means 35% faster, `+0.10` means 10% slower;
+- `_pvalue` lines report a Mann-Whitney U test of whether the two versions differ. It needs at least 9
+  repetitions, and a p-value below 0.05 means the difference is unlikely to be noise;
+- `OVERALL_GEOMEAN` summarizes all benchmarks;
+- `-a` shows only the aggregates, not every repetition.
+
+The header you compare with must support everything the benchmarks use. The current benchmarks build against 3.12.0.
+Only benchmarks present in both result files are compared, so for older releases, either filter the benchmarks or
+build that release's own `tests/benchmarks` against its own header.
+
+## Getting stable numbers
+
+- Build and run both versions on the same machine, one right after the other.
+- Keep the machine otherwise idle: no builds, no browser, and a laptop plugged in.
+- On Linux, set the CPU frequency governor to `performance`, e.g. `sudo cpupower frequency-set --governor performance`.
+  Google Benchmark prints a warning when frequency scaling is enabled. Pinning the process to a core
+  (`taskset -c 2 ...`) helps as well.
+- Use 10 or more repetitions with random interleaving, compare medians, and treat changes within the `_cv` as noise.
+
+## When to run them
+
+They are a manual step, not part of CI: shared CI runners vary more between runs than most of the effects measured.
+Run the comparison above before a release, comparing the previous release tag with `develop`, and for pull requests
+that claim to change performance.
@@ -131,7 +131,8 @@ static void Dump(benchmark::State& state, const char* filename, int indent)

    while (state.KeepRunning())
    {
-        j.dump(indent);
+        std::string output = j.dump(indent);
+        benchmark::DoNotOptimize(output);
    }

    state.SetBytesProcessed(state.iterations() * j.dump(indent).size());
@@ -37,12 +37,6 @@ struct bad_allocator : std::allocator<T>
 };
 } // namespace

-TEST_CASE("get_allocator")
-{
-    const auto alloc = nlohmann::json::get_allocator();
-    CHECK(alloc == std::allocator<nlohmann::json>());
-}
-
 TEST_CASE("bad_alloc")
 {
    SECTION("bad_alloc")
@@ -276,6 +270,82 @@ TEST_CASE("controlled bad_alloc")
    }
 }

+namespace
+{
+// counts the allocations of pairs with a non-const first member: the object
+// types store std::pair<const Key, T>, so only the scratch space of the
+// iterative deep copy allocates std::pair<Key, T>
+std::size_t scratch_pair_allocations = 0;
+
+template<class T>
+struct is_scratch_pair : std::false_type {};
+
+template<class K, class V>
+struct is_scratch_pair<std::pair<K, V>> : std::integral_constant < bool, !std::is_const<K>::value > {};
+
+template<class T>
+struct scratch_counting_allocator : std::allocator<T>
+{
+    using std::allocator<T>::allocator;
+
+    T* allocate(std::size_t n)
+    {
+        if (is_scratch_pair<T>::value)
+        {
+            ++scratch_pair_allocations;
+        }
+        return std::allocator<T>::allocate(n);
+    }
+
+#ifdef __cpp_lib_allocate_at_least
+    // std::allocator<T>::allocate_at_least would bypass the counting, and
+    // libc++'s containers prefer it over allocate from C++23 on
+    auto allocate_at_least(std::size_t n)
+    {
+        if (is_scratch_pair<T>::value)
+        {
+            ++scratch_pair_allocations;
+        }
+        return std::allocator<T>::allocate_at_least(n);
+    }
+#endif
+
+    template <class U>
+    struct rebind
+    {
+        using other = scratch_counting_allocator<U>;
+    };
+};
+} // namespace
+
+TEST_CASE("deep copy uses the provided allocator")
+{
+    using counting_json = nlohmann::basic_json<std::map,
+          std::vector,
+          std::string,
+          bool,
+          std::int64_t,
+          std::uint64_t,
+          double,
+          scratch_counting_allocator>;
+
+    // deeper than the 128 levels the copy constructor descends into, so the
+    // innermost objects are copied by the iterative deep copy
+    counting_json j = 1;
+    for (std::size_t i = 0; i < 300; ++i)
+    {
+        counting_json wrapper = counting_json::object();
+        wrapper["a"] = std::move(j);
+        j = std::move(wrapper);
+    }
+
+    scratch_pair_allocations = 0;
+    // NOLINTNEXTLINE(performance-unnecessary-copy-initialization): the copy is what is tested
+    const counting_json copy(j);
+    CHECK(scratch_pair_allocations > 0);
+    CHECK(copy == j);
+}
+
 namespace
 {
 template<class T>
@@ -3763,49 +3763,6 @@ TEST_CASE("BJData")
    }
 }

-TEST_CASE("BJData input that cannot be read is discarded by every overload")
-{
-    std::vector<std::uint8_t> input = json::to_bjdata(json({{"a", {1, 2}}}));
-    input.pop_back();
-
-    json _;
-    CHECK_THROWS_AS(_ = json::from_bjdata(input.begin(), input.end()), json::parse_error&);
-    CHECK(json::from_bjdata(input, true, false).is_discarded());
-    CHECK(json::from_bjdata(input.begin(), input.end(), true, false).is_discarded());
-}
-
-TEST_CASE("BJData SAX parsing stops at every event")
-{
-    // Containers are opened and closed by the loop that reads them; a SAX
-    // handler that rejects any event - including the end of a nested
-    // container - must stop the parse right there.
-    const auto count_events = [](const std::vector<std::uint8_t>& input)
-    {
-        int events = 0;
-        while (true)
-        {
-            SaxCountdown scp(events);
-            if (json::sax_parse(input, &scp, json::input_format_t::bjdata))
-            {
-                return events;
-            }
-            ++events;
-            REQUIRE(events < 1000);
-        }
-    };
-
-    // 20 events: every container kind closes inside another one
-    const json j = json::parse(R"({"a": [1, {"b": []}], "c": {"d": [[2]]}})");
-    CHECK(count_events(json::to_bjdata(j)) == 20);
-    CHECK(count_events(json::to_bjdata(j, true)) == 20);
-    CHECK(count_events(json::to_bjdata(j, true, true)) == 20);
-
-    // an ND-array is announced as an annotated object: start_object, then
-    // _ArrayType_, _ArraySize_ and _ArrayData_ with its elements
-    const json ndarray = json::parse(R"({"_ArrayType_": "uint8", "_ArraySize_": [2, 2], "_ArrayData_": [1, 2, 3, 4]})");
-    CHECK(count_events(json::to_bjdata(ndarray, true, true)) == 16);
-}
-
 TEST_CASE("issue #5405 - array reserve for definite-length BJData arrays")
 {
 #if !defined(JSON_NOEXCEPTION)
@@ -4290,54 +4247,6 @@ TEST_CASE("all BJData first bytes")
 }
 #endif

-TEST_CASE("BJData and UBJSON can be written to a string")
-{
-    const std::vector<json> values =
-    {
-        {{"a", {1, 2.5, "x", nullptr}}, {"b", json::binary({1, 2})}},
-        // an annotated ND-array, and objects that only look like one
-        json::parse(R"({"_ArrayType_": "uint8", "_ArraySize_": [2, 2], "_ArrayData_": [1, 2, 3, 4]})"),
-        json::parse(R"({"_ArrayType_": 1, "_ArraySize_": [2, 2], "_ArrayData_": [1, 2, 3, 4]})"),
-        json::parse(R"({"_ArrayType_": "uint8", "_ArraySize_": 4, "_ArrayData_": [1, 2, 3, 4]})"),
-        json::parse(R"({"_ArrayType_": "uint8", "_ArraySize_": [2, -2], "_ArrayData_": [1, 2, 3, 4]})"),
-        json::parse(R"({"_ArrayType_": "uint8", "_ArraySize_": [2, 2], "_ArrayData_": [1, 2, 3]})"),
-        json::parse(R"({"_ArrayType_": "uint8", "_ArraySize_": [2, 2], "_ArrayData_": 1})"),
-    };
-
-    for (const auto& j : values)
-    {
-        CAPTURE(j.dump());
-        for (const bool use_size :
-                {
-                    false, true
-                })
-        {
-            for (const bool use_type :
-                    {
-                        false, true
-                    })
-            {
-                if (use_type && !use_size)
-                {
-                    continue;
-                }
-                CAPTURE(use_size);
-                CAPTURE(use_type);
-
-                const auto bjdata = json::to_bjdata(j, use_size, use_type);
-                std::string bjdata_string;
-                json::to_bjdata(j, bjdata_string, use_size, use_type);
-                CHECK(bjdata_string == std::string(bjdata.begin(), bjdata.end()));
-
-                const auto ubjson = json::to_ubjson(j, use_size, use_type);
-                std::string ubjson_string;
-                json::to_ubjson(j, ubjson_string, use_size, use_type);
-                CHECK(ubjson_string == std::string(ubjson.begin(), ubjson.end()));
-            }
-        }
-    }
-}
-
 TEST_CASE("BJData use_type requires use_size")
 {
    SECTION("non-empty object throws other_error.502")
@@ -4356,17 +4265,6 @@ TEST_CASE("BJData use_type requires use_size")
                             json::other_error&);
    }

-    SECTION("non-empty binary value throws other_error.502")
-    {
-        const json j = json::binary({1, 2, 3});
-        CHECK_THROWS_WITH_AS(json::to_bjdata(j, false, true),
-                             "[json.exception.other_error.502] use_type requires use_size = true",
-                             json::other_error&);
-        CHECK_THROWS_WITH_AS(json::to_ubjson(j, false, true),
-                             "[json.exception.other_error.502] use_type requires use_size = true",
-                             json::other_error&);
-    }
-
    SECTION("scalars do not throw with use_type=true, use_count=false")
    {
        CHECK_NOTHROW(json::to_bjdata(42, false, true));
@@ -49,7 +49,7 @@ using huge_binary_json = nlohmann::basic_json <
 // for *object keys* (e.g. "s" or "nested" below). Only the designated test
 // value is meant to lie about its size - if every huge_string_t (including
 // keys) reported a huge size, the running totals computed while walking the
-// BSON document (see calc_bson_object_size & friends in binary_writer.hpp)
+// BSON document (see calc_bson_sizes in binary_writer.hpp)
 // would need more than 32 bits, and on platforms where std::size_t is only
 // 32 bits wide that arithmetic would silently wrap around, producing wrong
 // (or even unguarded) lengths. The fake size is therefore opt-in via
@@ -1244,44 +1244,6 @@ TEST_CASE("BSON nesting does not consume the call stack")
    }
 }

-TEST_CASE("BSON input that cannot be read is discarded by every overload")
-{
-    std::vector<std::uint8_t> input = json::to_bson(json({{"a", {1, 2}}}));
-    input.pop_back();
-
-    json _;
-    CHECK_THROWS_AS(_ = json::from_bson(input.begin(), input.end()), json::parse_error&);
-    CHECK(json::from_bson(input, true, false).is_discarded());
-    CHECK(json::from_bson(input.begin(), input.end(), true, false).is_discarded());
-    CHECK(json::from_bson(input.data(), input.size(), true, false).is_discarded());
-    CHECK(json::from_bson({input.data(), input.size()}, true, false).is_discarded());
-}
-
-TEST_CASE("BSON SAX parsing stops at every event")
-{
-    // Containers are opened and closed by the loop that reads them; a SAX
-    // handler that rejects any event - including the end of a nested
-    // container - must stop the parse right there.
-    const auto count_events = [](const std::vector<std::uint8_t>& input)
-    {
-        int events = 0;
-        while (true)
-        {
-            SaxCountdown scp(events);
-            if (json::sax_parse(input, &scp, json::input_format_t::bson))
-            {
-                return events;
-            }
-            ++events;
-            REQUIRE(events < 1000);
-        }
-    };
-
-    // 20 events: every container kind closes inside another one
-    const json j = json::parse(R"({"a": [1, {"b": []}], "c": {"d": [[2]]}})");
-    CHECK(count_events(json::to_bson(j)) == 20);
-}
-
 TEST_CASE("BSON numerical data")
 {
    SECTION("number")
@@ -1735,3 +1697,140 @@ TEST_CASE("BSON roundtrips" * doctest::skip())
        }
    }
 }
+
+TEST_CASE("BSON: deeply nested values")
+{
+    SECTION("documents and arrays round-trip at every depth")
+    {
+        // nested documents and arrays, with siblings on every level, so
+        // every length prefix covers entries of both kinds
+        json value = "leaf";
+        for (std::size_t depth = 0; depth <= 300; ++depth)
+        {
+            CAPTURE(depth);
+            const json document = {{"value", value}, {"n", depth}};
+            CHECK(json::from_bson(json::to_bson(document)) == document);
+
+value = depth % 2 == 0 ? json{{"a", std::move(value)}, {"b", {1, "x"}}} :
+            json::array({std::move(value), depth, json::object()});
+        }
+    }
+
+    SECTION("a key containing U+0000 is rejected before anything is written")
+    {
+        json value = json::object({{std::string("bad\0key", 7), 1}});
+        for (std::size_t depth = 0; depth < 200; ++depth)
+        {
+            value = json{{"a", {{"b", 1}}}, {"z", std::move(value)}};
+        }
+        std::vector<std::uint8_t> output;
+        CHECK_THROWS_AS(json::to_bson(value, output), json::out_of_range&);
+        CHECK(output.empty());
+    }
+
+    SECTION("values nested too deeply for the call stack (#5392)")
+    {
+        // serializing recursed once per nesting level, and computed every
+        // nested document's length by walking everything below it again.
+        // The values are only parsed, serialized and walked, never copied or
+        // compared, since those recurse too.
+        const std::size_t depth = 100000;
+        for (const bool objects :
+                {
+                    false, true
+                })
+        {
+            CAPTURE(objects);
+            std::string text = "{\"a\":";
+            for (std::size_t i = 0; i < depth; ++i)
+            {
+                text += objects ? "{\"a\":" : "[";
+            }
+            text += "1";
+            text.append(depth, objects ? '}' : ']');
+            text += "}";
+
+            const auto bson = json::to_bson(json::parse(text));
+            const auto result = json::from_bson(bson);
+            const json* p = &result.at("a");
+            for (std::size_t i = 0; i < depth; ++i)
+            {
+                p = objects ? &p->at("a") : &p->at(0);
+            }
+            CHECK(*p == 1);
+        }
+    }
+}
+
+TEST_CASE("Invalid document size handling")
+{
+    SECTION("document size must be at least 5")
+    {
+        std::vector<std::uint8_t> const v = {0x04, 0x00, 0x00, 0x00, 0x00};
+        json _;
+        CHECK_THROWS_WITH_AS(_ = json::from_bson(v), "[json.exception.parse_error.112] parse error at byte 5: syntax error while parsing BSON document: document size 4 does not match the number of bytes read (5)", json::parse_error&);
+        CHECK(json::from_bson(v, true, false).is_discarded());
+    }
+
+    SECTION("declared document size must match consumed bytes (extra trailing element)")
+    {
+        // Declares 5-byte empty document but appends an int32 element after the declared end.
+        std::vector<std::uint8_t> const v =
+        {
+            0x05, 0x00, 0x00, 0x00,
+            0x10, 'a', 'd', 'm', 'i', 'n', 0x00,
+            0x01, 0x00, 0x00, 0x00,
+            0x00
+        };
+        json _;
+        CHECK_THROWS_WITH_AS(_ = json::from_bson(v), "[json.exception.parse_error.112] parse error at byte 16: syntax error while parsing BSON document: document size 5 does not match the number of bytes read (16)", json::parse_error&);
+        CHECK(json::from_bson(v, true, false).is_discarded());
+    }
+
+    SECTION("declared document size must match consumed bytes (premature terminator)")
+    {
+        // Declares 32-byte document but only contains the size field followed by an immediate terminator.
+        std::vector<std::uint8_t> const v =
+        {
+            0x20, 0x00, 0x00, 0x00,
+            0x00
+        };
+        json _;
+        CHECK_THROWS_WITH_AS(_ = json::from_bson(v), "[json.exception.parse_error.112] parse error at byte 5: syntax error while parsing BSON document: document size 32 does not match the number of bytes read (5)", json::parse_error&);
+        CHECK(json::from_bson(v, true, false).is_discarded());
+    }
+
+    SECTION("array declared size must match consumed bytes")
+    {
+        // Outer object contains an array "a" that declares 5 bytes (empty) but
+        // actually contains an int32 element before its terminator.
+        std::vector<std::uint8_t> const v =
+        {
+            0x14, 0x00, 0x00, 0x00,                         // object size = 20
+            0x04, 'a', 0x00,                                // key "a", array type
+            0x05, 0x00, 0x00, 0x00,                         // array declared size = 5 (empty)
+            0x10, '0', 0x00, 0x01, 0x00, 0x00, 0x00,        // extra int32 element "0" = 1
+            0x00,                                           // array terminator
+            0x00                                            // object terminator
+        };
+        json _;
+        CHECK_THROWS_WITH_AS(_ = json::from_bson(v), "[json.exception.parse_error.112] parse error at byte 19: syntax error while parsing BSON document: document size 5 does not match the number of bytes read (12)", json::parse_error&);
+        CHECK(json::from_bson(v, true, false).is_discarded());
+    }
+
+    SECTION("BSON string must end with 0x00")
+    {
+        // Length-prefixed string whose terminator byte is 'X' (0x58), not 0x00.
+        std::vector<std::uint8_t> const v =
+        {
+            0x0F, 0x00, 0x00, 0x00,
+            0x02, 's', 0x00,
+            0x02, 0x00, 0x00, 0x00,
+            'A', 'X',
+            0x00
+        };
+        json _;
+        CHECK_THROWS_WITH_AS(_ = json::from_bson(v), "[json.exception.parse_error.112] parse error at byte 13: syntax error while parsing BSON string: BSON string is not null-terminated", json::parse_error&);
+        CHECK(json::from_bson(v, true, false).is_discarded());
+    }
+}
@@ -15,7 +15,6 @@ using nlohmann::json;
 #include <sstream>
 #include <iomanip>
 #include <limits>
-#include <list>
 #include <set>
 #include "make_test_data_available.hpp"
 #include "test_utils.hpp"
@@ -1834,6 +1833,59 @@ TEST_CASE("CBOR")
            CHECK(json::from_cbor(std::vector<uint8_t>({0xa1, 0xff, 0x01}), true, false).is_discarded());
        }

+        SECTION("invalid UTF-8 in string (see #5529)")
+        {
+            // a two-character text string (major type 3) whose bytes are not
+            // valid UTF-8 (0xC0 0xAE is an overlong encoding of '.') must be
+            // rejected at decode time, matching every other kind of
+            // malformed binary input, rather than only failing later when
+            // the resulting value is dumped
+            json _;
+            CHECK_THROWS_WITH_AS(_ = json::from_cbor(std::vector<uint8_t>({0x62, 0xc0, 0xae})), "[json.exception.parse_error.113] parse error at byte 3: syntax error while parsing CBOR string: invalid string: ill-formed UTF-8 byte", json::parse_error&);
+            CHECK(json::from_cbor(std::vector<uint8_t>({0x62, 0xc0, 0xae}), true, false).is_discarded());
+
+            // a CBOR byte string (major type 2) with the very same bytes is
+            // NOT text and must still be accepted as-is
+            CHECK_NOTHROW(_ = json::from_cbor(std::vector<uint8_t>({0x42, 0xc0, 0xae})));
+            CHECK(_ == json::binary(std::vector<std::uint8_t>({0xc0, 0xae})));
+
+            // valid UTF-8 must still round-trip
+            const json j = "h\xc3\xa9llo, w\xc3\xb6rld! \xe6\x97\xa5\xe6\x9c\xac\xe8\xaa\x9e"; // héllo, wörld! 日本語
+            CHECK(json::from_cbor(json::to_cbor(j)) == j);
+        }
+
+        SECTION("invalid UTF-8 in indefinite-length string")
+        {
+            json _;
+
+            // every chunk must be valid UTF-8 on its own (RFC 8949, Section
+            // 3.2.3), so a code point split across two chunks is rejected
+            CHECK_THROWS_WITH_AS(_ = json::from_cbor(std::vector<uint8_t>({0x7f, 0x61, 0xc3, 0x61, 0xa9, 0xff})), "[json.exception.parse_error.113] parse error at byte 3: syntax error while parsing CBOR string: invalid string: ill-formed UTF-8 byte", json::parse_error&);
+            CHECK(json::from_cbor(std::vector<uint8_t>({0x7f, 0x61, 0xc3, 0x61, 0xa9, 0xff}), true, false).is_discarded());
+
+            // an ill-formed later chunk is rejected after valid ones
+            CHECK_THROWS_WITH_AS(_ = json::from_cbor(std::vector<uint8_t>({0x7f, 0x62, 0xc3, 0xa9, 0x62, 0xc0, 0xae, 0xff})), "[json.exception.parse_error.113] parse error at byte 7: syntax error while parsing CBOR string: invalid string: ill-formed UTF-8 byte", json::parse_error&);
+
+            // valid multi-byte chunks are accepted
+            CHECK(json::from_cbor(std::vector<uint8_t>({0x7f, 0x62, 0xc3, 0xa9, 0x62, 0xc3, 0xb6, 0xff})) == "\xc3\xa9\xc3\xb6");
+        }
+
+        SECTION("many chunks in indefinite-length string")
+        {
+            // only the newly read chunk is validated, not the whole string
+            // collected so far; validating the latter made this input take
+            // quadratic time (about ten seconds for 100000 chunks)
+            constexpr std::size_t chunks = 100000;
+            std::vector<uint8_t> v{0x7f};
+            for (std::size_t i = 0; i < chunks; ++i)
+            {
+                v.push_back(0x61);
+                v.push_back('a');
+            }
+            v.push_back(0xff);
+            CHECK(json::from_cbor(v) == std::string(chunks, 'a'));
+        }
+
        SECTION("strict mode")
        {
            std::vector<uint8_t> const vec = {0xf6, 0xf6};
@@ -2123,52 +2175,6 @@ TEST_CASE("CBOR nesting does not consume the call stack")
    }
 }

-TEST_CASE("CBOR input that cannot be read is discarded by every overload")
-{
-    std::vector<std::uint8_t> input = json::to_cbor(json({{"a", {1, 2}}}));
-    input.pop_back();
-
-    json _;
-    CHECK_THROWS_AS(_ = json::from_cbor(input.begin(), input.end()), json::parse_error&);
-    CHECK(json::from_cbor(input, true, false).is_discarded());
-    CHECK(json::from_cbor(input.begin(), input.end(), true, false).is_discarded());
-    CHECK(json::from_cbor(input.data(), input.size(), true, false).is_discarded());
-    CHECK(json::from_cbor({input.data(), input.size()}, true, false).is_discarded());
-
-    // a string that ends early, read through iterators that are not
-    // contiguous and have to be copied from one element at a time
-    const std::list<std::uint8_t> truncated_string = {0x63, 'a', 'b'};
-    CHECK(json::from_cbor(truncated_string.begin(), truncated_string.end(), true, false).is_discarded());
-    const std::list<std::uint8_t> complete_string = {0x63, 'a', 'b', 'c'};
-    CHECK(json::from_cbor(complete_string.begin(), complete_string.end()) == "abc");
-}
-
-TEST_CASE("CBOR SAX parsing stops at every event")
-{
-    // Containers are opened and closed by the loop that reads them; a SAX
-    // handler that rejects any event - including the end of a nested
-    // container - must stop the parse right there.
-    const auto count_events = [](const std::vector<std::uint8_t>& input)
-    {
-        int events = 0;
-        while (true)
-        {
-            SaxCountdown scp(events);
-            if (json::sax_parse(input, &scp, json::input_format_t::cbor))
-            {
-                return events;
-            }
-            ++events;
-            REQUIRE(events < 1000);
-        }
-    };
-
-    // 20 events: every container kind closes inside another one
-    const json j = json::parse(R"({"a": [1, {"b": []}], "c": {"d": [[2]]}})");
-    CHECK(count_events(json::to_cbor(j)) == 20);
-    CHECK(count_events(std::vector<std::uint8_t>({0xBF, 0x61, 'a', 0x9F, 0x01, 0xFF, 0xFF})) == 6);
-}
-
 TEST_CASE("CBOR indefinite-length strings do not recurse per chunk")
 {
    // Reading an indefinite-length string or byte array used to call itself
@@ -43,13 +43,6 @@ TEST_CASE("const_iterator class")
            json::const_iterator const it(&j);
            json::const_iterator it2(&j);
            it2 = it;
-
-            // assigning an iterator to itself leaves it unchanged
-            json const a = {1, 2, 3};
-            json::const_iterator it3 = a.cbegin() + 1;
-            json::const_iterator& same = it3;
-            it3 = same;
-            CHECK(*it3 == 2);
        }

        SECTION("copy constructor from non-const iterator")
@@ -12,7 +12,6 @@
 #include <nlohmann/json.hpp>
 using nlohmann::json;

-#include <cfloat> // FLT_EVAL_METHOD
 #include <cstdlib> // strtod
 #include <sstream> // stringstream
 #include <string> // string
@@ -658,45 +657,3 @@ TEST_CASE("lexer string fast path")
        }
    }
 }
-
-TEST_CASE("parse_float_fast declines what it cannot convert exactly")
-{
-    // The lexer only hands well-formed numbers to parse_float_fast, so the
-    // malformed ones below can only be passed to it directly. Declining is
-    // always safe: the caller then falls back to a slower, exact conversion.
-    const auto fast = [](const std::string & s, double & out)
-    {
-        return nlohmann::detail::parse_float_fast(s.data(), s.data() + s.size(), '.', out);
-    };
-    double out = 0;
-
-#if defined(FLT_EVAL_METHOD) && FLT_EVAL_METHOD != 0
-    // without true double precision, the fast path declines everything
-    CHECK_FALSE(fast("1.5", out));
-#else
-    CHECK(fast("1.5", out));
-    CHECK(out == 1.5);
-    CHECK(fast("+2.5e1", out));
-    CHECK(out == 25.0);
-    CHECK(fast("-25E-1", out));
-    CHECK(out == -2.5);
-    CHECK(fast("1e", out));
-    CHECK(out == 1.0);
-#endif
-
-    // not a number
-    CHECK_FALSE(fast("", out));
-    CHECK_FALSE(fast("-", out));
-    CHECK_FALSE(fast(".", out));
-    CHECK_FALSE(fast("1.2.3", out));
-    CHECK_FALSE(fast("1x", out));
-    CHECK_FALSE(fast("1e+", out));
-    CHECK_FALSE(fast("1e1x", out));
-
-    // numbers that are not represented exactly on the fast path
-    CHECK_FALSE(fast("12345678901234567890", out));
-    CHECK_FALSE(fast("1e10000", out));
-    CHECK_FALSE(fast("9007199254740993", out));
-    CHECK_FALSE(fast("1e23", out));
-    CHECK_FALSE(fast("1e-23", out));
-}
@@ -11,11 +11,15 @@
 // capture whether JSON_STRICT_NUL_HANDLING was enabled on the command line
 // (e.g. -DJSON_STRICT_NUL_HANDLING=1) *before* including json.hpp, since the
 // library #undefs JSON_STRICT_NUL_HANDLING itself once the header has been
-// fully processed (see include/nlohmann/detail/macro_unscope.hpp)
+// fully processed unless JSON_TEST_KEEP_MACROS is defined (see
+// include/nlohmann/detail/macro_unscope.hpp)
 #if defined(JSON_STRICT_NUL_HANDLING) && (JSON_STRICT_NUL_HANDLING == 1)
    #define JSON_TEST_STRICT_NUL_HANDLING_ENABLED 1
 #endif

+#define JSON_TEST_STRINGIZE_EX(x) #x
+#define JSON_TEST_STRINGIZE(x) JSON_TEST_STRINGIZE_EX(x)
+
 #define JSON_TESTS_PRIVATE
 #include <nlohmann/json.hpp>
 using nlohmann::json;
@@ -566,6 +570,16 @@ TEST_CASE("parser class")
            // left at its default or forced to 1 (e.g. by the dedicated
            // ci_test_strict_nul_handling CI target), so only the section
            // matching the actual, compiled-in behavior can pass.
+            SECTION("the macro is part of the ABI tag")
+            {
+                const std::string ns = JSON_TEST_STRINGIZE(NLOHMANN_JSON_NAMESPACE);
+#if defined(JSON_TEST_STRICT_NUL_HANDLING_ENABLED)
+                CHECK(ns.find("_snul") != std::string::npos);
+#else
+                CHECK(ns.find("_snul") == std::string::npos);
+#endif
+            }
+
 #if !defined(JSON_TEST_STRICT_NUL_HANDLING_ENABLED)
            SECTION("default behavior (macro not enabled)")
            {
@@ -359,15 +359,6 @@ TEST_CASE("lexicographical comparison operators")
            CHECK(json(1) < json(1.5));
            CHECK(json(1.5) < json(2));
            CHECK(json(2) > json(1.5));
-            CHECK(json(-1) > json(-1.5));
-            CHECK(json(-1.5) < json(-1));
-            CHECK(json(-2) < json(-1.5));
-
-            // a float below the range of the integer type
-            CHECK(json(0) > json(-1e30));
-            CHECK(json(-1e30) < json(0));
-            CHECK(json(0u) > json(-0.5));
-            CHECK(json(-0.5) < json(0u));

            // a NaN operand stays unordered against either integer kind
            CHECK_FALSE(json(1) == json(nan));
@@ -744,84 +735,3 @@ TEST_CASE("regression #3868 - heterogeneous comparisons compile under C++20 (P24
    }
 }
 #endif
-
-TEST_CASE("containers are compared element by element")
-{
-    // Containers nested deeper than a bound are compared without the call
-    // stack, by code of their own; every relation is checked both at the top
-    // level and below that bound.
-    const auto deep = [](const json & j, const std::size_t depth)
-    {
-        json result = j;
-        for (std::size_t i = 0; i < depth; ++i)
-        {
-            result = json::array({std::move(result)});
-        }
-        return result;
-    };
-
-    for (const std::size_t depth : std::vector<std::size_t> {0, 200})
-    {
-        CAPTURE(depth);
-
-        // objects with different keys
-        {
-            const json a = deep({{"a", 1}}, depth);
-            const json b = deep({{"b", 1}}, depth);
-            CHECK_FALSE(a == b);
-            CHECK(a != b);
-            CHECK(a < b);
-            CHECK(b > a);
-            CHECK_FALSE(b < a);
-#if JSON_HAS_THREE_WAY_COMPARISON
-            // JSON_HAS_CPP_20 (do not remove; see note at top of file)
-            CHECK((a <=> b) == std::partial_ordering::less); // *NOPAD*
-            CHECK((b <=> a) == std::partial_ordering::greater); // *NOPAD*
-            CHECK((a <=> a) == std::partial_ordering::equivalent); // *NOPAD*
-#endif
-        }
-
-        // a container that is a prefix of the other one
-        {
-            // the one that runs out of elements first is the smaller one
-            const json shorter = deep({1}, depth);
-            const json longer = deep({1, 2}, depth);
-            CHECK(shorter < longer);
-            CHECK(longer > shorter);
-            CHECK_FALSE(longer < shorter);
-            CHECK_FALSE(shorter == longer);
-
-            const json smaller_object = deep({{"a", 1}}, depth);
-            const json larger_object = deep({{"a", 1}, {"b", 2}}, depth);
-            CHECK(smaller_object < larger_object);
-            CHECK(larger_object > smaller_object);
-            CHECK_FALSE(smaller_object == larger_object);
-#if JSON_HAS_THREE_WAY_COMPARISON
-            // JSON_HAS_CPP_20 (do not remove; see note at top of file)
-            CHECK((shorter <=> longer) == std::partial_ordering::less); // *NOPAD*
-            CHECK((longer <=> shorter) == std::partial_ordering::greater); // *NOPAD*
-#endif
-        }
-
-        // elements that cannot be ordered
-        {
-            const double nan = std::numeric_limits<double>::quiet_NaN();
-            const json lhs = deep({nan, 1}, depth);
-            const json rhs = deep({nan, 2}, depth);
-
-            CHECK_FALSE(lhs == lhs);
-            CHECK_FALSE(rhs < lhs);
-#if JSON_HAS_THREE_WAY_COMPARISON
-            // JSON_HAS_CPP_20 (do not remove; see note at top of file)
-            // operator<=> stops there, as std::lexicographical_compare_three_way
-            // does, and operator< is derived from it
-            CHECK((lhs <=> rhs) == std::partial_ordering::unordered); // *NOPAD*
-            CHECK_FALSE(lhs < rhs);
-#else
-            // operator< skips a pair of elements that cannot be ordered, as
-            // std::lexicographical_compare does, and the next pair decides
-            CHECK(lhs < rhs);
-#endif
-        }
-    }
-}
@@ -49,16 +49,6 @@ TEST_CASE("binary type whose value type is not std::uint8_t")
        CHECK(char_binary_json::binary({}).dump() == R"({"bytes":[],"subtype":null})");
    }

-    SECTION("a value is converted to the binary type if it is binary or an array")
-    {
-        const std::vector<char> chars{'\0', '\x01', '\x7F'};
-        CHECK(char_binary_json::binary(chars).get<std::vector<char>>() == chars);
-        CHECK(char_binary_json({0, 1, 127}).get<std::vector<char>>() == chars);
-        CHECK_THROWS_WITH_AS(char_binary_json(1).get<std::vector<char>>(),
-                             "[json.exception.type_error.302] type must be binary or array, but is number",
-                             char_binary_json::type_error&);
-    }
-
    SECTION("the default binary type is unchanged")
    {
        CHECK(nlohmann::json::binary({0, 1, 255}, 42).dump() == R"({"bytes":[0,1,255],"subtype":42})");
@@ -1240,9 +1240,9 @@ TEST_CASE("deserialization")
        // the stream is left one byte too far after a number (and only after a
        // number). JSON_PRECISE_STREAM_POSITION changes this; see
        // unit-precise-stream-position.cpp. These checks pin the default.
-        const auto remaining = [](std::istream & is)
+        const auto remaining = [](std::istream & is) -> std::string
        {
-            return std::string(std::istreambuf_iterator<char>(is), std::istreambuf_iterator<char>());
+            return {std::istreambuf_iterator<char>(is), std::istreambuf_iterator<char>()};
        };

        SECTION("the character after a number is consumed")
@@ -1266,7 +1266,9 @@ TEST_CASE("deserialization")
        SECTION("comma-separated numbers can be read one by one")
        {
            std::istringstream ss("1,2,3");
-            json j1, j2, j3;
+            json j1;
+            json j2;
+            json j3;
            ss >> j1 >> j2 >> j3;
            CHECK(j1 == 1);
            CHECK(j2 == 2);
@@ -156,38 +156,3 @@ TEST_CASE("Better diagnostics with positions")
 #endif
    }
 }
-
-TEST_CASE("values read from a binary format have no positions")
-{
-    // only the JSON lexer knows where a value started and ended
-    const json source = {{"a", {1, "x", json::binary({1})}}, {"b", {{"c", true}}}, {"d", nullptr}, {"e", 1.5}};
-    const std::vector<std::uint8_t> cbor = json::to_cbor(source);
-
-    const auto check_no_positions = [](const json & j)
-    {
-        CHECK(j.start_pos() == std::string::npos);
-        CHECK(j.end_pos() == std::string::npos);
-        CHECK(j.at("a").start_pos() == std::string::npos);
-        CHECK(j.at("a").at(1).end_pos() == std::string::npos);
-        CHECK(j.at("b").at("c").start_pos() == std::string::npos);
-    };
-
-    SECTION("DOM parser")
-    {
-        const json j = json::from_cbor(cbor);
-        CHECK(j == source);
-        check_no_positions(j);
-    }
-
-    SECTION("DOM parser with a callback")
-    {
-        json j;
-        nlohmann::detail::json_sax_dom_callback_parser<json, decltype(nlohmann::detail::input_adapter(cbor))> sdp(j, [](int /*unused*/, json::parse_event_t /*unused*/, const json& /*unused*/) noexcept
-        {
-            return true;
-        });
-        CHECK(json::sax_parse(cbor, &sdp, json::input_format_t::cbor));
-        CHECK(j == source);
-        check_no_positions(j);
-    }
-}
@@ -1517,16 +1517,6 @@ TEST_CASE_TEMPLATE("element access 2 (throwing tests)", Json, nlohmann::json, nl
                    CHECK(j.value("/not/existing"_json_pointer, Json({{"foo", "bar"}})) == Json({{"foo", "bar"}}));
                    CHECK(j.value("/not/existing"_json_pointer, Json({10, 100})) == Json({10, 100}));

-                    // an array index that is out of range, too large to be
-                    // represented, or "-", and a token below a scalar
-                    CHECK(j.value("/array/3"_json_pointer, 2) == 2);
-                    CHECK(j.value("/array/-"_json_pointer, 2) == 2);
-                    CHECK(j.value("/array/99999999999999999999999999"_json_pointer, 2) == 2);
-                    CHECK(j.value("/integer/0"_json_pointer, 2) == 2);
-                    CHECK(j.value("/string/x"_json_pointer, 2) == 2);
-                    CHECK(j.value("/null/x"_json_pointer, 2) == 2);
-                    CHECK(j.value("/array/0"_json_pointer, 2) == 1);
-
                    CHECK(j_const.value("/not/existing"_json_pointer, 2) == 2);
                    CHECK(j_const.value("/not/existing"_json_pointer, 2u) == 2u);
                    CHECK(j_const.value("/not/existing"_json_pointer, false) == false);
@@ -15,8 +15,65 @@ using nlohmann::json;
 #endif

 #include <fstream>
+#include <string>
+#include <vector>
 #include "make_test_data_available.hpp"

+namespace
+{
+// alternating objects and arrays nested `depth` levels deep, with members that
+// depend on `variant` at some levels, so diffing two variants yields
+// operations on many levels: replacing the innermost value, adding, removing,
+// and (for ordered_json) reordering members, and changing array lengths
+template<typename BasicJsonType>
+BasicJsonType nested(const std::size_t depth, const int variant)
+{
+    BasicJsonType value = variant;
+    for (std::size_t i = 0; i < depth; ++i)
+    {
+        if (i % 2 == 0)
+        {
+            BasicJsonType object = BasicJsonType::object();
+            if ((i + static_cast<std::size_t>(variant)) % 7 == 0)
+            {
+                object["x"] = i;
+            }
+            if (variant == 2 && i % 11 == 0)
+            {
+                object["z"] = "z";
+            }
+            object["a"] = std::move(value);
+            if (variant == 1 && i % 5 == 0)
+            {
+                object["y"] = 1;
+            }
+            value = std::move(object);
+        }
+        else
+        {
+            BasicJsonType array = BasicJsonType::array({std::move(value)});
+            if ((i + static_cast<std::size_t>(variant)) % 3 == 0)
+            {
+                array.push_back(i);
+            }
+            value = std::move(array);
+        }
+    }
+    return value;
+}
+
+// a path of `depth` reference tokens, as nested() nests its values
+std::string nested_path(const std::size_t depth)
+{
+    std::string path;
+    for (std::size_t i = depth; i > 0; --i)
+    {
+        path += (i - 1) % 2 == 0 ? "/a" : "/0";
+    }
+    return path;
+}
+} // namespace
+
 TEST_CASE("JSON patch")
 {
    SECTION("examples from RFC 6902")
@@ -1752,71 +1809,98 @@ TEST_CASE("JSON patch - diff emits array removals in descending index order")
    }
 }

-TEST_CASE("JSON patch - every operation on ordered_json")
+TEST_CASE("JSON patch: diff of deeply nested values")
 {
-    using nlohmann::ordered_json;
-
-    const ordered_json doc = {{"foo", "bar"}, {"arr", {1, 2, 3}}, {"obj", {{"a", 1}}}};
-
-    SECTION("successful operations")
+    SECTION("the diff reproduces the target at every depth")
    {
-        const ordered_json patch = ordered_json::parse(R"([
-            {"op": "add", "path": "/obj/b", "value": 2},
-            {"op": "add", "path": "/arr/1", "value": 9},
-            {"op": "add", "path": "/arr/-", "value": 4},
-            {"op": "remove", "path": "/arr/0"},
-            {"op": "remove", "path": "/obj/a"},
-            {"op": "replace", "path": "/foo", "value": "baz"},
-            {"op": "move", "from": "/foo", "path": "/moved"},
-            {"op": "copy", "from": "/obj", "path": "/copied"},
-            {"op": "test", "path": "/copied/b", "value": 2}
-        ])");
+        // depths on either side of the nesting depth up to which diff()
+        // recurses (detail::recursion_depth_limit(), 128); not every depth up
+        // to 300, as the test would then time out under Valgrind
+        std::vector<std::size_t> depths;
+        for (std::size_t depth = 0; depth <= 16; ++depth)
+        {
+            depths.push_back(depth);
+        }
+        for (std::size_t depth = 120; depth <= 136; ++depth)
+        {
+            depths.push_back(depth);
+        }
+        depths.push_back(300);

-        const ordered_json expected = ordered_json::parse(R"({
-            "arr": [9, 2, 3, 4], "obj": {"b": 2}, "moved": "baz", "copied": {"b": 2}
-        })");
+        for (const auto depth : depths)
+        {
+            CAPTURE(depth);
+            for (int from = 0; from < 3; ++from)
+            {
+                for (int to = 0; to < 3; ++to)
+                {
+                    CAPTURE(from);
+                    CAPTURE(to);
+                    const auto source = nested<json>(depth, from);
+                    const auto target = nested<json>(depth, to);
+                    const auto patch = json::diff(source, target);
+                    CHECK(source.patch(patch) == target);
+                    CHECK(patch.empty() == (from == to));

-        CHECK(doc.patch(patch) == expected);
-
-        // adding to the root replaces the document
-        CHECK(doc.patch(ordered_json::parse(R"([{"op": "add", "path": "", "value": [1]}])")) == ordered_json({1}));
+                    const auto ordered_source = nested<nlohmann::ordered_json>(depth, from);
+                    const auto ordered_target = nested<nlohmann::ordered_json>(depth, to);
+                    CHECK(ordered_source.patch(nlohmann::ordered_json::diff(ordered_source, ordered_target)) == ordered_target);
+                }
+            }
+        }
    }

-    SECTION("failing operations")
+    SECTION("a difference only in the innermost value is one replace operation")
    {
-        ordered_json _;
-        CHECK_THROWS_WITH_AS(_ = doc.patch(ordered_json::parse(R"([{"op": "add", "path": "/arr/4", "value": 1}])")),
-                             "[json.exception.out_of_range.401] array index 4 is out of range", ordered_json::out_of_range&);
-        CHECK_THROWS_WITH_AS(_ = doc.patch(ordered_json::parse(R"([{"op": "add", "path": "/nope/x", "value": 1}])")),
-                             "[json.exception.out_of_range.403] key 'nope' not found", ordered_json::out_of_range&);
-        CHECK_THROWS_WITH_AS(_ = doc.patch(ordered_json::parse(R"([{"op": "remove", "path": "/obj/nope"}])")),
-                             "[json.exception.out_of_range.403] key 'nope' not found", ordered_json::out_of_range&);
-        CHECK_THROWS_WITH_AS(_ = doc.patch(ordered_json::parse(R"([{"op": "remove", "path": "/arr/3"}])")),
-                             "[json.exception.out_of_range.401] array index 3 is out of range", ordered_json::out_of_range&);
-        CHECK_THROWS_WITH_AS(_ = doc.patch(ordered_json::parse(R"([{"op": "test", "path": "/foo", "value": "qux"}])")),
-                             "[json.exception.other_error.501] unsuccessful: {\"op\":\"test\",\"path\":\"/foo\",\"value\":\"qux\"}", ordered_json::other_error&);
-        CHECK_THROWS_WITH_AS(_ = doc.patch(ordered_json::parse(R"([{"op": "add", "path": "/foo"}])")),
-                             "[json.exception.parse_error.105] parse error: operation 'add' must have member 'value'", ordered_json::parse_error&);
-        CHECK_THROWS_WITH_AS(_ = doc.patch(ordered_json::parse(R"([{"op": "move", "from": "/obj", "path": "/obj/a/b"}])")),
-                             "[json.exception.out_of_range.414] cannot move value: 'from' path '/obj' is a proper prefix of 'path' '/obj/a/b'", ordered_json::out_of_range&);
+        for (std::size_t depth = 0; depth <= 300; ++depth)
+        {
+            CAPTURE(depth);
+            json source = 1;
+            json target = 2;
+            for (std::size_t i = 0; i < depth; ++i)
+            {
+                source = i % 2 == 0 ? json::object({{"a", std::move(source)}}) : json::array({std::move(source)});
+                target = i % 2 == 0 ? json::object({{"a", std::move(target)}}) : json::array({std::move(target)});
+            }
+            CHECK(json::diff(source, target, "/root") == json::array({{{"op", "replace"}, {"path", "/root" + nested_path(depth)}, {"value", 2}}}));
+        }
    }

-    SECTION("diff reproduces the target")
+    SECTION("values nested too deeply for the call stack (#5393)")
    {
-        const ordered_json source = {{"a", 1}, {"b", 2}, {"c", {{"x", 1}}}, {"l", {1, 2, 3}}};
-        const std::vector<ordered_json> targets =
+        // diff() used to recurse once per nesting level, and compared the
+        // values with operator== on every level. The values are only
+        // parsed and diffed, never copied or compared, since those recurse
+        // too.
+        const std::size_t depth = 100000;
+        for (const bool objects :
+                {
+                    false, true
+                })
        {
-            // a key removed, a key added, a nested change, a shorter array
-            {{"a", 1}, {"c", {{"x", 2}}}, {"l", {1}}, {"d", 4}},
-            // the same keys in another order
-            {{"c", {{"x", 1}}}, {"a", 1}, {"b", 2}, {"l", {1, 2, 3}}},
-            // new keys ahead of the common ones
-            {{"new", true}, {"a", 1}, {"b", 3}, {"c", {{"x", 1}}}, {"l", {1, 2, 3}}},
-        };
-        for (const auto& target : targets)
-        {
-            CAPTURE(target.dump());
-            CHECK(source.patch(ordered_json::diff(source, target)) == target);
+            CAPTURE(objects);
+            std::string source_text;
+            std::string target_text;
+            std::string equal_text;
+            std::string path;
+            for (std::size_t i = 0; i < depth; ++i)
+            {
+                source_text += objects ? "{\"a\":" : "[";
+                path += objects ? "/a" : "/0";
+            }
+            target_text = source_text + "2";
+            equal_text = source_text + "1";
+            source_text += "1";
+            const std::string closing(depth, objects ? '}' : ']');
+            const auto source = json::parse(source_text + closing);
+
+            const auto patch = json::diff(source, json::parse(target_text + closing));
+            REQUIRE(patch.size() == 1);
+            CHECK(patch[0]["op"] == "replace");
+            CHECK(patch[0]["path"] == path);
+            CHECK(patch[0]["value"] == 2);
+
+            CHECK(json::diff(source, json::parse(equal_text + closing)).empty());
        }
    }
 }
@@ -872,16 +872,3 @@ TEST_CASE("JSON pointers")
    }
 #endif
 }
-
-TEST_CASE("unescaping keeps a '~' that does not start an escape sequence")
-{
-    // the parser of a JSON pointer rejects such reference tokens before it
-    // unescapes them, so this is only reachable by calling unescape directly
-    std::string s = "a~2b~";
-    nlohmann::detail::unescape(s);
-    CHECK(s == "a~2b~");
-
-    s = "~0~1~";
-    nlohmann::detail::unescape(s);
-    CHECK(s == "~/~");
-}
@@ -158,17 +158,6 @@ TEST_CASE("locale-dependent test (LC_NUMERIC=de_DE)")
            json::sax_parse("12.34", &sax);
            CHECK(sax.float_string_copy == "12.34");
        }
-
-        SECTION("serializing a long double")
-        {
-            // a floating-point type that is not a float or a double is written
-            // with snprintf, whose locale-specific decimal point and thousands
-            // separator are undone afterwards
-            using long_double_json = nlohmann::basic_json<std::map, std::vector, std::string, bool, std::int64_t, std::uint64_t, long double>;
-            CHECK(long_double_json(12345.5L).dump() == "12345.5");
-            CHECK(long_double_json(1.0L).dump() == "1.0");
-            CHECK(long_double_json(-0.25L).dump() == "-0.25");
-        }
    }
    else
    {
@@ -345,32 +345,3 @@ TEST_CASE("JSON Merge Patch on deeply nested values")
        CHECK(p->at("x") == 1);
    }
 }
-
-TEST_CASE("JSON Merge Patch and update on ordered_json")
-{
-    using nlohmann::ordered_json;
-
-    SECTION("merge_patch")
-    {
-        ordered_json target = ordered_json::parse(R"({"a": {"b": 1, "c": 2}, "d": 3, "e": [1]})");
-        target.merge_patch(ordered_json::parse(R"({"a": {"b": null, "f": 4}, "d": {"x": {"y": null}}, "e": null, "g": {"h": 5}})"));
-        CHECK(target == ordered_json::parse(R"({"a": {"c": 2, "f": 4}, "d": {"x": {}}, "g": {"h": 5}})"));
-
-        // a patch that is not an object replaces the target
-        target.merge_patch(ordered_json({1, 2}));
-        CHECK(target == ordered_json({1, 2}));
-        // an object patch turns a target that is not an object into one
-        target.merge_patch(ordered_json::parse(R"({"k": {"l": null}})"));
-        CHECK(target == ordered_json::parse(R"({"k": {}})"));
-    }
-
-    SECTION("update with merge_objects")
-    {
-        ordered_json target = ordered_json::parse(R"({"a": {"b": 1, "c": {"d": 2}}, "e": 3})");
-        target.update(ordered_json::parse(R"({"a": {"c": {"x": 1}, "f": 4}, "e": {"y": 5}, "g": 6})"), true);
-        CHECK(target == ordered_json::parse(R"({"a": {"b": 1, "c": {"d": 2, "x": 1}, "f": 4}, "e": {"y": 5}, "g": 6})"));
-
-        target.update(ordered_json::parse(R"({"a": 1})"), false);
-        CHECK(target == ordered_json::parse(R"({"a": 1, "e": {"y": 5}, "g": 6})"));
-    }
-}
@@ -1554,6 +1554,27 @@ TEST_CASE("MessagePack")
            CHECK(json::from_msgpack(std::vector<uint8_t>({0x81, 0xff, 0x01}), true, false).is_discarded());
        }

+        SECTION("invalid UTF-8 in string (see #5529)")
+        {
+            // a fixstr of length 2 (0xA0 | 2) whose bytes are not valid UTF-8
+            // (0xC0 0xAE is an overlong encoding of '.') must be rejected at
+            // decode time, matching every other kind of malformed binary
+            // input, rather than only failing later when the resulting
+            // value is dumped
+            json _;
+            CHECK_THROWS_WITH_AS(_ = json::from_msgpack(std::vector<uint8_t>({0xa2, 0xc0, 0xae})), "[json.exception.parse_error.113] parse error at byte 3: syntax error while parsing MessagePack string: invalid string: ill-formed UTF-8 byte", json::parse_error&);
+            CHECK(json::from_msgpack(std::vector<uint8_t>({0xa2, 0xc0, 0xae}), true, false).is_discarded());
+
+            // a MessagePack bin8 blob with the very same bytes is NOT text
+            // and must still be accepted as-is
+            CHECK_NOTHROW(_ = json::from_msgpack(std::vector<uint8_t>({0xc4, 0x02, 0xc0, 0xae})));
+            CHECK(_ == json::binary(std::vector<std::uint8_t>({0xc0, 0xae})));
+
+            // valid UTF-8 must still round-trip
+            const json j = "h\xc3\xa9llo, w\xc3\xb6rld! \xe6\x97\xa5\xe6\x9c\xac\xe8\xaa\x9e"; // héllo, wörld! 日本語
+            CHECK(json::from_msgpack(json::to_msgpack(j)) == j);
+        }
+
        SECTION("strict mode")
        {
            std::vector<uint8_t> const vec = {0xc0, 0xc0};
@@ -1759,44 +1780,6 @@ TEST_CASE("MessagePack nesting does not consume the call stack")
    }
 }

-TEST_CASE("MessagePack input that cannot be read is discarded by every overload")
-{
-    std::vector<std::uint8_t> input = json::to_msgpack(json({{"a", {1, 2}}}));
-    input.pop_back();
-
-    json _;
-    CHECK_THROWS_AS(_ = json::from_msgpack(input.begin(), input.end()), json::parse_error&);
-    CHECK(json::from_msgpack(input, true, false).is_discarded());
-    CHECK(json::from_msgpack(input.begin(), input.end(), true, false).is_discarded());
-    CHECK(json::from_msgpack(input.data(), input.size(), true, false).is_discarded());
-    CHECK(json::from_msgpack({input.data(), input.size()}, true, false).is_discarded());
-}
-
-TEST_CASE("MessagePack SAX parsing stops at every event")
-{
-    // Containers are opened and closed by the loop that reads them; a SAX
-    // handler that rejects any event - including the end of a nested
-    // container - must stop the parse right there.
-    const auto count_events = [](const std::vector<std::uint8_t>& input)
-    {
-        int events = 0;
-        while (true)
-        {
-            SaxCountdown scp(events);
-            if (json::sax_parse(input, &scp, json::input_format_t::msgpack))
-            {
-                return events;
-            }
-            ++events;
-            REQUIRE(events < 1000);
-        }
-    };
-
-    // 20 events: every container kind closes inside another one
-    const json j = json::parse(R"({"a": [1, {"b": []}], "c": {"d": [[2]]}})");
-    CHECK(count_events(json::to_msgpack(j)) == 20);
-}
-
 TEST_CASE("single MessagePack roundtrip")
 {
    SECTION("sample.json")
@@ -94,6 +94,16 @@ TEST_CASE("serialization")
            CHECK(j.dump(-1, ' ', true, json::error_handler_t::replace) == "\"\\u00e4\\ufffd\\u00fc\"");
        }

+        SECTION("invalid character (regression guard for shared UTF-8 decoder, see #5529)")
+        {
+            // dump_escaped_impl() now calls the UTF-8 decoder shared with the
+            // binary readers (detail::decode() in string_utils.hpp) instead
+            // of a private copy; the exact type_error.316 message/behavior
+            // must stay byte-for-byte the same as before that extraction
+            const json j = "ä\xA9ü";
+            CHECK_THROWS_WITH_AS(utils::ignore_return_value(j.dump()), "[json.exception.type_error.316] invalid UTF-8 byte at index 2: 0xA9", json::type_error&);
+        }
+
        SECTION("ending with incomplete character")
        {
            const json j = "123\xC2";
@@ -629,153 +639,3 @@ TEST_CASE("serialization of deeply nested values")
        }
    }
 }
-
-namespace
-{
-// wraps @a inner into @a depth single-element arrays
-json wrap_in_arrays(const json& inner, const std::size_t depth)
-{
-    json j = inner;
-    for (std::size_t i = 0; i < depth; ++i)
-    {
-        j = json::array({std::move(j)});
-    }
-    return j;
-}
-
-// what wrap_in_arrays(inner, depth).dump(2) is expected to be: the arrays
-// around inner.dump(2), with inner's own lines indented by the depth
-std::string expected_pretty_in_arrays(const json& inner, const std::size_t depth)
-{
-    std::string expected;
-    for (std::size_t i = 0; i < depth; ++i)
-    {
-        expected += std::string(2 * i, ' ') + "[\n";
-    }
-
-    const std::string indent(2 * depth, ' ');
-    expected += indent;
-    for (const char c : inner.dump(2))
-    {
-        expected += c;
-        if (c == '\n')
-        {
-            expected += indent;
-        }
-    }
-
-    for (std::size_t i = depth; i > 0; --i)
-    {
-        expected += '\n' + std::string(2 * (i - 1), ' ') + ']';
-    }
-    return expected;
-}
-} // namespace
-
-TEST_CASE("serialization of every kind of value below the bound of the descent")
-{
-    // Values nested deeper than the bound are written without the call stack,
-    // by code of their own; each kind of value must come out the same there as
-    // it does at the top level, compact and pretty-printed.
-    std::vector<json> values =
-    {
-        json::parse(R"({"a": 1, "b": [1, 2, {"c": "x"}], "d": {}, "e": []})"),
-        json::parse(R"([1, [2, 3], {"k": null}, "s"])"),
-        json::object(),
-        json::array(),
-        json::binary({1, 2, 3}, 42),
-        json::binary({1, 2, 3}),
-        json::binary({}, 7),
-        json::binary({}),
-        "a string with \"escapes\"\n",
-        true,
-        false,
-        -42,
-        42u,
-        1.5,
-        nullptr,
-        json(json::value_t::discarded),
-    };
-    // a pretty-printed object whose members are themselves deep
-    values.push_back({{"x", wrap_in_arrays(1, 5)}, {"y", {{"z", 2}}}});
-
-    for (const std::size_t depth : std::vector<std::size_t> {1, 200})
-    {
-        CAPTURE(depth);
-        for (const auto& inner : values)
-        {
-            CAPTURE(inner.dump());
-            const json j = wrap_in_arrays(inner, depth);
-            CHECK(j.dump() == std::string(depth, '[') + inner.dump() + std::string(depth, ']'));
-            CHECK(j.dump(2) == expected_pretty_in_arrays(inner, depth));
-        }
-    }
-
-    SECTION("pretty-printed objects across the bound")
-    {
-        for (std::size_t d = 120; d <= 140; ++d)
-        {
-            CAPTURE(d);
-
-            // built from the inside out: {"k": <level below>, "n": <level>}
-            json j = 7;
-            std::string expected = "7";
-            for (std::size_t i = d; i > 0; --i)
-            {
-                j = json({{"k", std::move(j)}, {"n", i}});
-
-                const std::string indent(2 * i, ' ');
-                const std::string outer_indent(2 * (i - 1), ' ');
-                expected = "{\n" + indent + "\"k\": " + expected + ",\n"
-                           + indent + "\"n\": " + std::to_string(i) + "\n" + outer_indent + "}";
-            }
-
-            CHECK(j.dump(2) == expected);
-            CHECK(json::parse(j.dump(2)) == j);
-            CHECK(json::parse(j.dump()) == j);
-        }
-    }
-}
-
-TEST_CASE("serializer buffers are flushed mid-string and mid-binary")
-{
-    SECTION("a long run of escaped characters")
-    {
-        // each character is escaped on its own, so the escape buffer fills up
-        const json newlines = std::string(600, '\n');
-        std::string expected = "\"";
-        for (int i = 0; i < 600; ++i)
-        {
-            expected += "\\n";
-        }
-        expected += '"';
-        CHECK(newlines.dump() == expected);
-
-        // every character is \u-escaped under ensure_ascii
-        std::string umlauts;
-        std::string escaped_umlauts = "\"";
-        for (int i = 0; i < 300; ++i)
-        {
-            umlauts += "\xC3\xA4";
-            escaped_umlauts += "\\u00e4";
-        }
-        escaped_umlauts += '"';
-        CHECK(json(umlauts).dump(-1, ' ', true) == escaped_umlauts);
-    }
-
-    SECTION("a large binary value")
-    {
-        std::vector<std::uint8_t> bytes(3000);
-        std::string expected_bytes;
-        std::string expected_pretty_bytes;
-        for (std::size_t i = 0; i < bytes.size(); ++i)
-        {
-            bytes[i] = static_cast<std::uint8_t>(i % 256);
-            expected_bytes += (i == 0 ? "" : ",") + std::to_string(i % 256);
-            expected_pretty_bytes += (i == 0 ? "" : ", ") + std::to_string(i % 256);
-        }
-        const json j = json::binary(bytes);
-        CHECK(j.dump() == "{\"bytes\":[" + expected_bytes + "],\"subtype\":null}");
-        CHECK(j.dump(2) == "{\n  \"bytes\": [" + expected_pretty_bytes + "],\n  \"subtype\": null\n}");
-    }
-}
@@ -102,29 +102,6 @@ TEST_CASE("std::formatter<nlohmann::json>")
        CHECK_THROWS_AS(std::vformat("{:{}}", std::make_format_args(j, dynamic_width)), std::format_error); // dynamic width
    }

-    SECTION("a format spec may run to the end of the parse context")
-    {
-        // std::format always hands parse() a range that still holds the closing
-        // '}', but a parse context may also end right after the spec
-        const auto parse = [](const char* spec)
-        {
-            std::format_parse_context ctx(spec);
-            std::formatter<json> f;
-            CHECK(f.parse(ctx) == ctx.end());
-            return f;
-        };
-
-        CHECK(parse("").indent == -1);
-        CHECK(parse(">").indent == -1);
-        CHECK(parse("#").indent == 4);
-        CHECK(parse("3").indent == 3);
-        CHECK(parse("#12").indent == 12);
-
-        const auto f = parse(".>");
-        CHECK(f.indent == -1);
-        CHECK(f.indent_char == '.');
-    }
-
    SECTION("std::format_to writes through an arbitrary output iterator")
    {
        const json j = {{"foo", 1}, {"bar", {1, 2, 3}}};
@@ -1640,29 +1640,6 @@ TEST_CASE("UBJSON")
                });
                CHECK_THROWS_AS(_ = json::sax_parse(v_ubjson, &scp, json::input_format_t::ubjson), json::out_of_range&);
            }
-
-            SECTION("array with a known size, read with a callback")
-            {
-                // a sized array announces its length to start_array()
-                std::vector<uint8_t> const v_ubjson = {'[', '#', 'i', 2, 'i', 1, 'i', 2};
-                json j;
-                nlohmann::detail::json_sax_dom_callback_parser<json, decltype(nlohmann::detail::input_adapter(v_ubjson))> scp(j, [](int /*unused*/, json::parse_event_t /*unused*/, const json& /*unused*/) noexcept
-                {
-                    return true;
-                });
-                CHECK(json::sax_parse(v_ubjson, &scp, json::input_format_t::ubjson));
-                CHECK(j == json({1, 2}));
-
-                // the readers reject a size this large before they announce
-                // it, so it can only reach start_array() directly (the largest
-                // value stands for an unknown size and is never checked)
-                json k;
-                nlohmann::detail::json_sax_dom_callback_parser<json, decltype(nlohmann::detail::input_adapter(v_ubjson))> scp2(k, [](int /*unused*/, json::parse_event_t /*unused*/, const json& /*unused*/) noexcept
-                {
-                    return true;
-                });
-                CHECK_THROWS_AS(scp2.start_array((std::numeric_limits<std::size_t>::max)() - 1), json::out_of_range&);
-            }
        }
    }

@@ -2278,46 +2255,6 @@ TEST_CASE("UBJSON nesting does not consume the call stack")
    }
 }

-TEST_CASE("UBJSON input that cannot be read is discarded by every overload")
-{
-    std::vector<std::uint8_t> input = json::to_ubjson(json({{"a", {1, 2}}}));
-    input.pop_back();
-
-    json _;
-    CHECK_THROWS_AS(_ = json::from_ubjson(input.begin(), input.end()), json::parse_error&);
-    CHECK(json::from_ubjson(input, true, false).is_discarded());
-    CHECK(json::from_ubjson(input.begin(), input.end(), true, false).is_discarded());
-    CHECK(json::from_ubjson(input.data(), input.size(), true, false).is_discarded());
-    CHECK(json::from_ubjson({input.data(), input.size()}, true, false).is_discarded());
-}
-
-TEST_CASE("UBJSON SAX parsing stops at every event")
-{
-    // Containers are opened and closed by the loop that reads them; a SAX
-    // handler that rejects any event - including the end of a nested
-    // container - must stop the parse right there.
-    const auto count_events = [](const std::vector<std::uint8_t>& input)
-    {
-        int events = 0;
-        while (true)
-        {
-            SaxCountdown scp(events);
-            if (json::sax_parse(input, &scp, json::input_format_t::ubjson))
-            {
-                return events;
-            }
-            ++events;
-            REQUIRE(events < 1000);
-        }
-    };
-
-    // 20 events: every container kind closes inside another one
-    const json j = json::parse(R"({"a": [1, {"b": []}], "c": {"d": [[2]]}})");
-    CHECK(count_events(json::to_ubjson(j)) == 20);
-    CHECK(count_events(json::to_ubjson(j, true)) == 20);
-    CHECK(count_events(json::to_ubjson(j, true, true)) == 20);
-}
-
 TEST_CASE("UBJSON optimized arrays of a valueless type are bounded")
 {
    // An element of type 'Z', 'T' or 'F' is encoded by its marker alone, so an
@@ -778,6 +778,193 @@ class derived_person_only_serialize_private_3 : person_without_default_construct
    NLOHMANN_DEFINE_DERIVED_TYPE_INTRUSIVE_ONLY_SERIALIZE_WITH_NAMES(derived_person_only_serialize_private_3, person_without_default_constructor_3, "json_hair_color", hair_color)
 };

+// Zero-member types for issue #4041: NLOHMANN_DEFINE_TYPE_* and
+// NLOHMANN_DEFINE_DERIVED_TYPE_* must compile and produce a valid (empty)
+// JSON object when no member arguments are given.
+class empty_intrusive
+{
+  public:
+    bool operator==(const empty_intrusive& /*rhs*/) const
+    {
+        return true;
+    }
+    NLOHMANN_DEFINE_TYPE_INTRUSIVE(empty_intrusive)
+};
+
+class empty_intrusive_with_default
+{
+  public:
+    bool operator==(const empty_intrusive_with_default& /*rhs*/) const
+    {
+        return true;
+    }
+    NLOHMANN_DEFINE_TYPE_INTRUSIVE_WITH_DEFAULT(empty_intrusive_with_default)
+};
+
+class empty_intrusive_only_serialize
+{
+  public:
+    NLOHMANN_DEFINE_TYPE_INTRUSIVE_ONLY_SERIALIZE(empty_intrusive_only_serialize)
+};
+
+class empty_non_intrusive
+{
+  public:
+    bool operator==(const empty_non_intrusive& /*rhs*/) const
+    {
+        return true;
+    }
+};
+// NOLINTNEXTLINE(misc-use-internal-linkage)
+NLOHMANN_DEFINE_TYPE_NON_INTRUSIVE(empty_non_intrusive)
+
+class empty_non_intrusive_with_default
+{
+  public:
+    bool operator==(const empty_non_intrusive_with_default& /*rhs*/) const
+    {
+        return true;
+    }
+};
+// NOLINTNEXTLINE(misc-use-internal-linkage)
+NLOHMANN_DEFINE_TYPE_NON_INTRUSIVE_WITH_DEFAULT(empty_non_intrusive_with_default)
+
+class empty_non_intrusive_only_serialize {};
+// NOLINTNEXTLINE(misc-use-internal-linkage)
+NLOHMANN_DEFINE_TYPE_NON_INTRUSIVE_ONLY_SERIALIZE(empty_non_intrusive_only_serialize)
+
+class empty_derived_intrusive : public person_with_private_data
+{
+  public:
+    empty_derived_intrusive() = default;
+    empty_derived_intrusive(std::string name_, int age_, json metadata_)
+        : person_with_private_data(std::move(name_), age_, std::move(metadata_))
+    {}
+    NLOHMANN_DEFINE_DERIVED_TYPE_INTRUSIVE(empty_derived_intrusive, person_with_private_data)
+};
+
+class empty_derived_intrusive_with_default : public person_with_private_data
+{
+  public:
+    empty_derived_intrusive_with_default() = default;
+    empty_derived_intrusive_with_default(std::string name_, int age_, json metadata_)
+        : person_with_private_data(std::move(name_), age_, std::move(metadata_))
+    {}
+    NLOHMANN_DEFINE_DERIVED_TYPE_INTRUSIVE_WITH_DEFAULT(empty_derived_intrusive_with_default, person_with_private_data)
+};
+
+class empty_derived_intrusive_only_serialize : public person_with_private_data
+{
+  public:
+    empty_derived_intrusive_only_serialize() = default;
+    empty_derived_intrusive_only_serialize(std::string name_, int age_, json metadata_)
+        : person_with_private_data(std::move(name_), age_, std::move(metadata_))
+    {}
+    NLOHMANN_DEFINE_DERIVED_TYPE_INTRUSIVE_ONLY_SERIALIZE(empty_derived_intrusive_only_serialize, person_with_private_data)
+};
+
+class empty_derived_non_intrusive : public person_with_private_data
+{
+  public:
+    empty_derived_non_intrusive() = default;
+    empty_derived_non_intrusive(std::string name_, int age_, json metadata_)
+        : person_with_private_data(std::move(name_), age_, std::move(metadata_))
+    {}
+};
+// NOLINTNEXTLINE(misc-use-internal-linkage)
+NLOHMANN_DEFINE_DERIVED_TYPE_NON_INTRUSIVE(empty_derived_non_intrusive, person_with_private_data)
+
+class empty_derived_non_intrusive_with_default : public person_with_private_data
+{
+  public:
+    empty_derived_non_intrusive_with_default() = default;
+    empty_derived_non_intrusive_with_default(std::string name_, int age_, json metadata_)
+        : person_with_private_data(std::move(name_), age_, std::move(metadata_))
+    {}
+};
+// NOLINTNEXTLINE(misc-use-internal-linkage)
+NLOHMANN_DEFINE_DERIVED_TYPE_NON_INTRUSIVE_WITH_DEFAULT(empty_derived_non_intrusive_with_default, person_with_private_data)
+
+class empty_derived_non_intrusive_only_serialize : public person_with_private_data
+{
+  public:
+    empty_derived_non_intrusive_only_serialize() = default;
+    empty_derived_non_intrusive_only_serialize(std::string name_, int age_, json metadata_)
+        : person_with_private_data(std::move(name_), age_, std::move(metadata_))
+    {}
+};
+// NOLINTNEXTLINE(misc-use-internal-linkage)
+NLOHMANN_DEFINE_DERIVED_TYPE_NON_INTRUSIVE_ONLY_SERIALIZE(empty_derived_non_intrusive_only_serialize, person_with_private_data)
+
+// Types at the documented maximum member count (63) for issue #4041's
+// argument-count dispatch. The derived-type macros carry a two-token
+// Type,BaseType prefix, so they reach two slots further into
+// NLOHMANN_JSON_GET_MACRO than the non-derived ones and are the first to break
+// if the tag dispatch runs out of positional slots.
+class max_members
+{
+  public:
+    int m1{}, m2{}, m3{}, m4{}, m5{}, m6{}, m7{}, m8{}, m9{}, m10{}, m11{}, m12{}, m13{}, m14{}, m15{}, m16{}, m17{}, m18{}, m19{}, m20{}, m21{}, m22{}, m23{}, m24{}, m25{}, m26{}, m27{}, m28{}, m29{}, m30{}, m31{}, m32{}, m33{}, m34{}, m35{}, m36{}, m37{}, m38{}, m39{}, m40{}, m41{}, m42{}, m43{}, m44{}, m45{}, m46{}, m47{}, m48{}, m49{}, m50{}, m51{}, m52{}, m53{}, m54{}, m55{}, m56{}, m57{}, m58{}, m59{}, m60{}, m61{}, m62{}, m63{};
+
+    NLOHMANN_DEFINE_TYPE_INTRUSIVE(max_members, m1, m2, m3, m4, m5, m6, m7, m8, m9, m10, m11, m12, m13, m14, m15, m16, m17, m18, m19, m20, m21, m22, m23, m24, m25, m26, m27, m28, m29, m30, m31, m32, m33, m34, m35, m36, m37, m38, m39, m40, m41, m42, m43, m44, m45, m46, m47, m48, m49, m50, m51, m52, m53, m54, m55, m56, m57, m58, m59, m60, m61, m62, m63)
+};
+
+class max_members_base
+{
+  public:
+    int base_value = 0;
+
+    NLOHMANN_DEFINE_TYPE_INTRUSIVE(max_members_base, base_value)
+};
+
+class max_members_derived : public max_members_base
+{
+  public:
+    int m1{}, m2{}, m3{}, m4{}, m5{}, m6{}, m7{}, m8{}, m9{}, m10{}, m11{}, m12{}, m13{}, m14{}, m15{}, m16{}, m17{}, m18{}, m19{}, m20{}, m21{}, m22{}, m23{}, m24{}, m25{}, m26{}, m27{}, m28{}, m29{}, m30{}, m31{}, m32{}, m33{}, m34{}, m35{}, m36{}, m37{}, m38{}, m39{}, m40{}, m41{}, m42{}, m43{}, m44{}, m45{}, m46{}, m47{}, m48{}, m49{}, m50{}, m51{}, m52{}, m53{}, m54{}, m55{}, m56{}, m57{}, m58{}, m59{}, m60{}, m61{}, m62{}, m63{};
+
+    NLOHMANN_DEFINE_DERIVED_TYPE_INTRUSIVE(max_members_derived, max_members_base, m1, m2, m3, m4, m5, m6, m7, m8, m9, m10, m11, m12, m13, m14, m15, m16, m17, m18, m19, m20, m21, m22, m23, m24, m25, m26, m27, m28, m29, m30, m31, m32, m33, m34, m35, m36, m37, m38, m39, m40, m41, m42, m43, m44, m45, m46, m47, m48, m49, m50, m51, m52, m53, m54, m55, m56, m57, m58, m59, m60, m61, m62, m63)
+};
+
+// User macros named like the dispatch suffixes (EMPTY is a common empty-macro
+// idiom) must not leak into the NLOHMANN_DEFINE_TYPE_* dispatch.
+#define EMPTY
+#define MEMBERS clobbered_by_user_macro
+
+class dispatch_with_user_macros_empty
+{
+  public:
+    NLOHMANN_DEFINE_TYPE_INTRUSIVE(dispatch_with_user_macros_empty)
+};
+
+class dispatch_with_user_macros_members
+{
+  public:
+    int value = 0;
+
+    NLOHMANN_DEFINE_TYPE_INTRUSIVE(dispatch_with_user_macros_members, value)
+};
+
+class dispatch_with_user_macros_derived_empty : public dispatch_with_user_macros_members
+{
+};
+// NOLINTNEXTLINE(misc-use-internal-linkage)
+NLOHMANN_DEFINE_DERIVED_TYPE_NON_INTRUSIVE(dispatch_with_user_macros_derived_empty, dispatch_with_user_macros_members)
+
+class dispatch_with_user_macros_derived_members : public dispatch_with_user_macros_members
+{
+  public:
+    int own = 0;
+};
+// NOLINTNEXTLINE(misc-use-internal-linkage)
+NLOHMANN_DEFINE_DERIVED_TYPE_NON_INTRUSIVE(dispatch_with_user_macros_derived_members, dispatch_with_user_macros_members, own)
+
+// testing for the macros also keeps -Wunused-macros from rejecting them
+#if !defined(EMPTY) || !defined(MEMBERS)
+    #error "EMPTY and MEMBERS must stay defined for the tests above"
+#endif
+#undef EMPTY
+#undef MEMBERS
+
 } // namespace persons

 TEST_CASE_TEMPLATE("Serialization/deserialization via NLOHMANN_DEFINE_TYPE_INTRUSIVE and NLOHMANN_DEFINE_TYPE_NON_INTRUSIVE", Pair, // NOLINT(readability-math-missing-parentheses, bugprone-throwing-static-initialization)
@@ -1191,3 +1378,183 @@ TEST_CASE_TEMPLATE("Serialization of non-default-constructible classes via NLOHM
        }
    }
 }
+
+// Regression tests for issue #4041: NLOHMANN_DEFINE_TYPE_* and
+// NLOHMANN_DEFINE_DERIVED_TYPE_* macros must compile and produce valid
+// (empty, or base-only for the derived case) JSON objects when no member
+// arguments are given, on every supported C++ standard.
+TEST_CASE_TEMPLATE("Serialization/deserialization of zero-member types via NLOHMANN_DEFINE_TYPE_* (issue #4041)", Json, // NOLINT(readability-math-missing-parentheses, bugprone-throwing-static-initialization)
+                   nlohmann::json, nlohmann::ordered_json)
+{
+    constexpr bool is_ordered = std::is_same<Json, nlohmann::ordered_json>::value;
+    const char* const derived_dump = is_ordered
+                                     ? R"({"age":1,"name":"Erik","metadata":null})"
+                                     : R"({"age":1,"metadata":null,"name":"Erik"})";
+
+    SECTION("NLOHMANN_DEFINE_TYPE_INTRUSIVE with zero members")
+    {
+        persons::empty_intrusive obj{};
+        Json j = obj;
+        CHECK(j.dump() == "{}");
+        CHECK(j.template get<persons::empty_intrusive>() == obj);
+    }
+
+    SECTION("NLOHMANN_DEFINE_TYPE_INTRUSIVE_WITH_DEFAULT with zero members")
+    {
+        persons::empty_intrusive_with_default obj{};
+        Json j = obj;
+        CHECK(j.dump() == "{}");
+        CHECK(j.template get<persons::empty_intrusive_with_default>() == obj);
+    }
+
+    SECTION("NLOHMANN_DEFINE_TYPE_INTRUSIVE_ONLY_SERIALIZE with zero members")
+    {
+        const persons::empty_intrusive_only_serialize obj{};
+        Json j = obj;
+        CHECK(j.dump() == "{}");
+    }
+
+    SECTION("NLOHMANN_DEFINE_TYPE_NON_INTRUSIVE with zero members")
+    {
+        persons::empty_non_intrusive obj{};
+        Json j = obj;
+        CHECK(j.dump() == "{}");
+        CHECK(j.template get<persons::empty_non_intrusive>() == obj);
+    }
+
+    SECTION("NLOHMANN_DEFINE_TYPE_NON_INTRUSIVE_WITH_DEFAULT with zero members")
+    {
+        persons::empty_non_intrusive_with_default obj{};
+        Json j = obj;
+        CHECK(j.dump() == "{}");
+        CHECK(j.template get<persons::empty_non_intrusive_with_default>() == obj);
+    }
+
+    SECTION("NLOHMANN_DEFINE_TYPE_NON_INTRUSIVE_ONLY_SERIALIZE with zero members")
+    {
+        const persons::empty_non_intrusive_only_serialize obj{};
+        Json j = obj;
+        CHECK(j.dump() == "{}");
+    }
+
+    SECTION("NLOHMANN_DEFINE_DERIVED_TYPE_INTRUSIVE with zero own members")
+    {
+        persons::empty_derived_intrusive obj{"Erik", 1, nullptr};
+        Json j = obj;
+        CHECK(j.dump() == derived_dump);
+        CHECK(j.template get<persons::empty_derived_intrusive>() == obj);
+    }
+
+    SECTION("NLOHMANN_DEFINE_DERIVED_TYPE_INTRUSIVE_WITH_DEFAULT with zero own members")
+    {
+        persons::empty_derived_intrusive_with_default obj{"Erik", 1, nullptr};
+        Json j = obj;
+        CHECK(j.dump() == derived_dump);
+        CHECK(j.template get<persons::empty_derived_intrusive_with_default>() == obj);
+    }
+
+    SECTION("NLOHMANN_DEFINE_DERIVED_TYPE_INTRUSIVE_ONLY_SERIALIZE with zero own members")
+    {
+        const persons::empty_derived_intrusive_only_serialize obj{"Erik", 1, nullptr};
+        Json j = obj;
+        CHECK(j.dump() == derived_dump);
+    }
+
+    SECTION("NLOHMANN_DEFINE_DERIVED_TYPE_NON_INTRUSIVE with zero own members")
+    {
+        persons::empty_derived_non_intrusive obj{"Erik", 1, nullptr};
+        Json j = obj;
+        CHECK(j.dump() == derived_dump);
+        CHECK(j.template get<persons::empty_derived_non_intrusive>() == obj);
+    }
+
+    SECTION("NLOHMANN_DEFINE_DERIVED_TYPE_NON_INTRUSIVE_WITH_DEFAULT with zero own members")
+    {
+        persons::empty_derived_non_intrusive_with_default obj{"Erik", 1, nullptr};
+        Json j = obj;
+        CHECK(j.dump() == derived_dump);
+        CHECK(j.template get<persons::empty_derived_non_intrusive_with_default>() == obj);
+    }
+
+    SECTION("NLOHMANN_DEFINE_DERIVED_TYPE_NON_INTRUSIVE_ONLY_SERIALIZE with zero own members")
+    {
+        const persons::empty_derived_non_intrusive_only_serialize obj{"Erik", 1, nullptr};
+        Json j = obj;
+        CHECK(j.dump() == derived_dump);
+    }
+}
+
+// Regression test for the argument-count dispatch added for issue #4041: the
+// documented maximum of 63 members must keep working, including for the
+// derived-type macros whose Type,BaseType prefix consumes two dispatch slots.
+TEST_CASE_TEMPLATE("Serialization/deserialization of maximum-member-count types via NLOHMANN_DEFINE_TYPE_*", Json, // NOLINT(readability-math-missing-parentheses, bugprone-throwing-static-initialization)
+                   nlohmann::json, nlohmann::ordered_json)
+{
+    SECTION("NLOHMANN_DEFINE_TYPE_INTRUSIVE with 63 members")
+    {
+        persons::max_members obj{};
+        obj.m1 = 1;
+        obj.m63 = 63;
+        Json j = obj;
+        CHECK(j.size() == 63);
+        const auto obj2 = j.template get<persons::max_members>();
+        CHECK(obj2.m1 == 1);
+        CHECK(obj2.m63 == 63);
+    }
+
+    SECTION("NLOHMANN_DEFINE_DERIVED_TYPE_INTRUSIVE with 63 own members")
+    {
+        persons::max_members_derived obj{};
+        obj.base_value = 7;
+        obj.m1 = 1;
+        obj.m63 = 63;
+        Json j = obj;
+        CHECK(j.size() == 64);
+        const auto obj2 = j.template get<persons::max_members_derived>();
+        CHECK(obj2.base_value == 7);
+        CHECK(obj2.m1 == 1);
+        CHECK(obj2.m63 == 63);
+    }
+}
+
+TEST_CASE_TEMPLATE("NLOHMANN_DEFINE_TYPE_* dispatch is unaffected by user macros named EMPTY or MEMBERS", Json, // NOLINT(readability-math-missing-parentheses, bugprone-throwing-static-initialization)
+                   nlohmann::json, nlohmann::ordered_json)
+{
+    SECTION("zero members")
+    {
+        const persons::dispatch_with_user_macros_empty obj{};
+        const Json j = obj;
+        CHECK(j == Json::object());
+        CHECK_NOTHROW(j.template get<persons::dispatch_with_user_macros_empty>());
+    }
+
+    SECTION("one member")
+    {
+        persons::dispatch_with_user_macros_members obj{};
+        obj.value = 42;
+        const Json j = obj;
+        CHECK(j == Json({{"value", 42}}));
+        CHECK(j.template get<persons::dispatch_with_user_macros_members>().value == 42);
+    }
+
+    SECTION("derived with zero own members")
+    {
+        persons::dispatch_with_user_macros_derived_empty obj{};
+        obj.value = 42;
+        const Json j = obj;
+        CHECK(j == Json({{"value", 42}}));
+        CHECK(j.template get<persons::dispatch_with_user_macros_derived_empty>().value == 42);
+    }
+
+    SECTION("derived with own members")
+    {
+        persons::dispatch_with_user_macros_derived_members obj{};
+        obj.value = 42;
+        obj.own = 7;
+        const Json j = obj;
+        CHECK(j == Json({{"value", 42}, {"own", 7}}));
+        const auto obj2 = j.template get<persons::dispatch_with_user_macros_derived_members>();
+        CHECK(obj2.value == 42);
+        CHECK(obj2.own == 7);
+    }
+}
@@ -70,8 +70,6 @@ TEST_CASE("wide strings")
            CHECK_THROWS_WITH_AS(_ = json::parse(std::wstring{L'"', static_cast<wchar_t>(0xDC00), L'"'}), error_low_surrogate, json::parse_error&);
            // a high surrogate followed by a non-low-surrogate unit is invalid
            CHECK_THROWS_WITH_AS(_ = json::parse(std::wstring{L'"', static_cast<wchar_t>(0xD800), L'a', L'"'}), error_high_surrogate, json::parse_error&);
-            // ... also when the unit is above the low surrogates
-            CHECK_THROWS_WITH_AS(_ = json::parse(std::wstring{L'"', static_cast<wchar_t>(0xD800), static_cast<wchar_t>(0xE000), L'"'}), error_high_surrogate, json::parse_error&);
            // a lone low surrogate must not swallow the following unit: pairing
            // it with any second unit would produce valid UTF-8, so the error
            // has to report an ill-formed byte at the surrogate's own position
@@ -101,8 +99,6 @@ TEST_CASE("wide strings")
            CHECK_THROWS_WITH_AS(_ = json::parse(std::u16string{u'"', 0xDC00, u'"'}), "[json.exception.parse_error.101] parse error at line 1, column 2: syntax error while parsing value - invalid string: ill-formed UTF-8 byte; last read: '\"<U+0000>'", json::parse_error&);
            // a high surrogate followed by a non-low-surrogate unit is invalid
            CHECK_THROWS_WITH_AS(_ = json::parse(std::u16string{u'"', 0xD800, u'a', u'"'}), "[json.exception.parse_error.101] parse error at line 1, column 2: syntax error while parsing value - invalid string: ill-formed UTF-8 byte; last read: '\"<U+0000>'", json::parse_error&);
-            // ... also when the unit is above the low surrogates
-            CHECK_THROWS_WITH_AS(_ = json::parse(std::u16string{u'"', 0xD800, 0xE000, u'"'}), "[json.exception.parse_error.101] parse error at line 1, column 2: syntax error while parsing value - invalid string: ill-formed UTF-8 byte; last read: '\"<U+0000>'", json::parse_error&);
            // a lone low surrogate must not swallow the following unit: pairing
            // it with any second unit would produce valid UTF-8, so the error
            // has to report an ill-formed byte at the surrogate's own position
@@ -20,7 +20,7 @@ if __name__ == '__main__':

    namespaces = ['nlohmann']
    abi_prefix = 'json_abi'
-    abi_tags = ['_diag', '_ldvcmp', '_dp', '_bics', '_psp']
+    abi_tags = ['_diag', '_ldvcmp', '_dp', '_bics', '_psp', '_snul']
    version = '_v' + args.version.replace('.', '_')
    inline_namespaces = []