⬆️ Bump the codeql-action group with 4 updates (#5365)

The block documenting get_char and tag_handler sat above
get_cbor_negative_integer(), which takes neither, so Doxygen attached it
there and parse_cbor_internal() was left undocumented.

Comment placement only.

Signed-off-by: Dmitry <45711841+darkdi@users.noreply.github.com>

.github/workflows/codeql-analysis.yml

@@ -38,14 +38,14 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
+      uses: github/codeql-action/init@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
       with:
         languages: c-cpp
 
     # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
+      uses: github/codeql-action/autobuild@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
+      uses: github/codeql-action/analyze@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4

.github/workflows/flawfinder.yml

@@ -43,6 +43,6 @@ jobs:
           output: 'flawfinder_results.sarif'
 
       - name: Upload analysis results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
+        uses: github/codeql-action/upload-sarif@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
         with:
           sarif_file: ${{github.workspace}}/flawfinder_results.sarif

.github/workflows/scorecards.yml

@@ -76,6 +76,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
+        uses: github/codeql-action/upload-sarif@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
         with:
           sarif_file: results.sarif

.github/workflows/semgrep.yml

@@ -61,7 +61,7 @@ jobs:
 
       # Upload SARIF file generated in previous step
       - name: Upload SARIF file
-        uses: github/codeql-action/upload-sarif@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
+        uses: github/codeql-action/upload-sarif@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
         with:
           sarif_file: semgrep.sarif
         if: always()

.github/workflows/ubuntu.yml

@@ -25,7 +25,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Get latest CMake and ninja
-        uses: lukka/get-cmake@e6906078ebd1ccb8ce51ab4626ac46a1b5a517e3 # v4.4.0
+        uses: lukka/get-cmake@4a7d025fc60f00db0c7b44ebf783d19b52444830 # v4.4.1
       - name: Run CMake
         run: cmake -S . -B build -DJSON_CI=On
       - name: Build
@@ -47,7 +47,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Get latest CMake and ninja
-        uses: lukka/get-cmake@e6906078ebd1ccb8ce51ab4626ac46a1b5a517e3 # v4.4.0
+        uses: lukka/get-cmake@4a7d025fc60f00db0c7b44ebf783d19b52444830 # v4.4.1
       - name: Run CMake
         run: cmake -S . -B build -DJSON_CI=On
       - name: Build
@@ -70,7 +70,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Get latest CMake and ninja
-        uses: lukka/get-cmake@e6906078ebd1ccb8ce51ab4626ac46a1b5a517e3 # v4.4.0
+        uses: lukka/get-cmake@4a7d025fc60f00db0c7b44ebf783d19b52444830 # v4.4.1
       - name: Run CMake
         run: cmake -S . -B build -DJSON_CI=On
       - name: Build
@@ -89,7 +89,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Get latest CMake and ninja
-        uses: lukka/get-cmake@e6906078ebd1ccb8ce51ab4626ac46a1b5a517e3 # v4.4.0
+        uses: lukka/get-cmake@4a7d025fc60f00db0c7b44ebf783d19b52444830 # v4.4.1
       - name: Run CMake
         run: cmake -S . -B build -DJSON_CI=On
       - name: Build
@@ -108,7 +108,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Get latest CMake and ninja
-        uses: lukka/get-cmake@e6906078ebd1ccb8ce51ab4626ac46a1b5a517e3 # v4.4.0
+        uses: lukka/get-cmake@4a7d025fc60f00db0c7b44ebf783d19b52444830 # v4.4.1
       - name: Run CMake
         run: cmake -S . -B build -DJSON_CI=On
       - name: Build
@@ -184,7 +184,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Get latest CMake and ninja
-        uses: lukka/get-cmake@e6906078ebd1ccb8ce51ab4626ac46a1b5a517e3 # v4.4.0
+        uses: lukka/get-cmake@4a7d025fc60f00db0c7b44ebf783d19b52444830 # v4.4.1
       - name: Run CMake
         run: CXX=g++-${{ matrix.compiler }} cmake -S . -B build -DJSON_CI=On
       - name: Build
@@ -202,7 +202,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Get latest CMake and ninja
-        uses: lukka/get-cmake@e6906078ebd1ccb8ce51ab4626ac46a1b5a517e3 # v4.4.0
+        uses: lukka/get-cmake@4a7d025fc60f00db0c7b44ebf783d19b52444830 # v4.4.1
       - name: Run CMake
         run: cmake -S . -B build -DJSON_CI=On
       - name: Build
@@ -212,14 +212,14 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        compiler: ['3.4', '3.5', '3.6', '3.7', '3.8', '3.9', '4', '5', '6', '7', '8', '9', '10', '11', '12', '13', '14', '15-bullseye', '16', '17', '18', '19', '20', 'latest']
+        compiler: ['3.4', '3.5', '3.6', '3.7', '3.8', '3.9', '4', '5', '6', '7', '8', '9', '10', '11', '12', '13', '14', '15-bullseye', '16', '17', '18', '19', '20', '21', '22', 'latest']
     container: silkeh/clang:${{ matrix.compiler }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Get latest CMake and ninja
-        uses: lukka/get-cmake@e6906078ebd1ccb8ce51ab4626ac46a1b5a517e3 # v4.4.0
+        uses: lukka/get-cmake@4a7d025fc60f00db0c7b44ebf783d19b52444830 # v4.4.1
       - name: Set env FORCE_STDCPPFS_FLAG for clang 7 / 8 / 9 / 10
         run: echo "JSON_FORCED_GLOBAL_COMPILE_OPTIONS=-DJSON_HAS_FILESYSTEM=0;-DJSON_HAS_EXPERIMENTAL_FILESYSTEM=0" >> "$GITHUB_ENV"
         if: ${{ matrix.compiler == '7' || matrix.compiler == '8' || matrix.compiler == '9' || matrix.compiler == '10' }}
@@ -239,7 +239,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Get latest CMake and ninja
-        uses: lukka/get-cmake@e6906078ebd1ccb8ce51ab4626ac46a1b5a517e3 # v4.4.0
+        uses: lukka/get-cmake@4a7d025fc60f00db0c7b44ebf783d19b52444830 # v4.4.1
       - name: Run CMake
         run: cmake -S . -B build -DJSON_CI=On
       - name: Build
@@ -259,7 +259,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Get latest CMake and ninja
-        uses: lukka/get-cmake@e6906078ebd1ccb8ce51ab4626ac46a1b5a517e3 # v4.4.0
+        uses: lukka/get-cmake@4a7d025fc60f00db0c7b44ebf783d19b52444830 # v4.4.1
       - name: Run CMake
         run: cmake -S . -B build -DJSON_CI=On
       - name: Build with libc++
@@ -286,7 +286,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Get latest CMake and ninja
-        uses: lukka/get-cmake@e6906078ebd1ccb8ce51ab4626ac46a1b5a517e3 # v4.4.0
+        uses: lukka/get-cmake@4a7d025fc60f00db0c7b44ebf783d19b52444830 # v4.4.1
       - name: Run CMake
         run: cmake -S . -B build -DJSON_CI=On
       - name: Build
@@ -306,7 +306,7 @@ jobs:
       # import-std support. Its opt-in token is CMake-version-specific, so pin
       # CMake to the version whose token is set in tests/module_cpp20/CMakeLists.txt.
       - name: Get pinned CMake and ninja
-        uses: lukka/get-cmake@e6906078ebd1ccb8ce51ab4626ac46a1b5a517e3 # v4.4.0
+        uses: lukka/get-cmake@4a7d025fc60f00db0c7b44ebf783d19b52444830 # v4.4.1
         with:
           cmakeVersion: 4.3.4
       # Clang: the std library module is provided by libc++ (the image's libstdc++
@@ -332,7 +332,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Get latest CMake and ninja
-        uses: lukka/get-cmake@e6906078ebd1ccb8ce51ab4626ac46a1b5a517e3 # v4.4.0
+        uses: lukka/get-cmake@4a7d025fc60f00db0c7b44ebf783d19b52444830 # v4.4.1
       - name: Run CMake
         run: cmake -S . -B build -DJSON_CI=On
       - name: Build
@@ -347,7 +347,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Get latest CMake and ninja
-        uses: lukka/get-cmake@e6906078ebd1ccb8ce51ab4626ac46a1b5a517e3 # v4.4.0
+        uses: lukka/get-cmake@4a7d025fc60f00db0c7b44ebf783d19b52444830 # v4.4.1
       - name: Run CMake
         run: cmake -S . -B build -DJSON_CI=On
       - name: Build
@@ -359,7 +359,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Get latest CMake and ninja
-        uses: lukka/get-cmake@e6906078ebd1ccb8ce51ab4626ac46a1b5a517e3 # v4.4.0
+        uses: lukka/get-cmake@4a7d025fc60f00db0c7b44ebf783d19b52444830 # v4.4.1
       - name: Run CMake
         run: cmake -S . -B build -DJSON_CI=On
       - name: Build
@@ -379,7 +379,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Get latest CMake and ninja
-        uses: lukka/get-cmake@e6906078ebd1ccb8ce51ab4626ac46a1b5a517e3 # v4.4.0
+        uses: lukka/get-cmake@4a7d025fc60f00db0c7b44ebf783d19b52444830 # v4.4.1
       - name: Run CMake
         run: cmake -S . -B build -DCMAKE_TOOLCHAIN_FILE=$EMSDK/upstream/emscripten/cmake/Modules/Platform/Emscripten.cmake -GNinja
       - name: Build

.github/workflows/windows.yml

@@ -88,7 +88,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Get latest CMake and ninja
-        uses: lukka/get-cmake@e6906078ebd1ccb8ce51ab4626ac46a1b5a517e3 # v4.4.0
+        uses: lukka/get-cmake@4a7d025fc60f00db0c7b44ebf783d19b52444830 # v4.4.1
       - name: Set extra CXX_FLAGS for latest std_version
         # /wd5285 silences C5285 emitted by the bundled third-party doctest.h, which
         # specializes std::tuple (newly diagnosed by the VS2026 v145 toolset)
@@ -153,10 +153,16 @@ jobs:
         with:
           platform: x64
           version: 12.2.0 # https://github.com/egor-tensin/setup-mingw/issues/14
+      # CMAKE_CXX_FLAGS_DEBUG is overridden to drop the default -g: linking
+      # test-regression2_cpp20 intermittently fails with "relocation truncated
+      # to fit: IMAGE_REL_AMD64_SECREL against `.debug_line'" because the
+      # MinGW linker cannot relocate the debug sections this test produces.
+      # The tests are only built and run here, so the debug info is not used.
       - name: Run CMake
         run: cmake -S . -B build ^
              -DCMAKE_CXX_COMPILER="C:/Program Files/LLVM/bin/clang++.exe" ^
              -DCMAKE_CXX_FLAGS="--target=x86_64-w64-mingw32 -stdlib=libstdc++ -pthread" ^
+             -DCMAKE_CXX_FLAGS_DEBUG="-g0" ^
              -DCMAKE_EXE_LINKER_FLAGS="-lwinpthread" ^
              -G"MinGW Makefiles" ^
              -DCMAKE_BUILD_TYPE=Debug ^
@@ -193,7 +199,7 @@ jobs:
       # import-std support. Its opt-in token is CMake-version-specific, so pin
       # CMake to the version whose token is set in tests/module_cpp20/CMakeLists.txt.
       - name: Get pinned CMake and ninja
-        uses: lukka/get-cmake@e6906078ebd1ccb8ce51ab4626ac46a1b5a517e3 # v4.4.0
+        uses: lukka/get-cmake@4a7d025fc60f00db0c7b44ebf783d19b52444830 # v4.4.1
         with:
           cmakeVersion: 4.3.4
       - name: Run CMake (Debug)

README.md

@@ -42,6 +42,7 @@
   - [Specializing enum conversion](#specializing-enum-conversion)
   - [Binary formats (BSON, CBOR, MessagePack, UBJSON, and BJData)](#binary-formats-bson-cbor-messagepack-ubjson-and-bjdata)
 - [Customers](#customers)
+- [Ecosystem](#ecosystem)
 - [Supported compilers](#supported-compilers)
 - [Integration](#integration)
   - [CMake](#cmake)
@@ -1186,6 +1187,11 @@ The library is used in multiple projects, applications, operating systems, etc.
 
 [![logos of customers using the library](docs/mkdocs/docs/images/customers.png)](https://json.nlohmann.me/home/customers/)
 
+## Ecosystem
+
+Beyond projects that use the library, there are third-party projects that build on top of it - schema validators,
+language bindings, format converters, and the like. See the curated [Ecosystem](https://json.nlohmann.me/community/ecosystem/) page.
+
 ## Supported compilers
 
 Though it's 2026 already, the support for C++11 is still a bit sparse. Currently, the following compilers are known to work:

docs/mkdocs/docs/api/basic_json/sax_parse.md

@@ -69,8 +69,7 @@ The SAX event lister must follow the interface of [`json_sax`](../json_sax/index
      [`input_format_t`](input_format_t.md) for more information
 
 `strict` (in)
-:   whether the input has to be consumed completely (optional, `#!cpp true` by default); when `#!cpp false` and the
-    input is a `#!cpp std::istream`, the stream is left positioned right after the parsed value
+:   whether the input has to be consumed completely (optional, `#!cpp true` by default)
 
 `ignore_comments` (in)
 :   whether comments should be ignored and treated like whitespace (`#!cpp true`) or yield a parse error
@@ -137,8 +136,6 @@ A UTF-8 byte order mark is silently ignored.
 - Added `ignore_trailing_commas` in version 3.13.0.
 - Extended container support (1) to include types with lvalue-only ADL `begin`/`end` (matching `std::begin`/`std::end` semantics) in version 3.13.0.
 - Extended overload (2) to accept heterogeneous iterator+sentinel pairs (C++20 ranges support) in version 3.13.0.
-- Changed in version 4.0.0 to leave a `#!cpp std::istream` positioned right after the parsed value when `strict` is
-  `#!cpp false`; see [`operator>>`](../operator_gtgt.md#notes).
 
 !!! warning "Deprecation"
 

docs/mkdocs/docs/api/operator_gtgt.md

@@ -33,26 +33,41 @@ A UTF-8 byte order mark is silently ignored.
 Invalid Unicode escapes and unpaired surrogates in the input are reported as
 [`parse_error.101`](../home/exceptions.md#jsonexceptionparse_error101) with a detailed message.
 
-`operator>>` parses exactly one JSON value and leaves the stream positioned right after it, so it can be called
-repeatedly to read a sequence of concatenated JSON values from the same stream:
+`operator>>` parses exactly one JSON value, so it can be called repeatedly to read a sequence of concatenated JSON
+values from the same stream:
 
 ```cpp
-std::istringstream input("1true[2]");
-json j1, j2, j3;
-input >> j1;  // j1 == 1,      stream now positioned right after it
-input >> j2;  // j2 == true
-input >> j3;  // j3 == [2]
+json j1, j2;
+input >> j1;  // parses the first value
+input >> j2;  // parses the next value
 ```
 
-!!! note "Changed behavior for numbers"
+!!! warning "A number must be followed by whitespace"
 
-    A number is the only value whose end can be detected solely by reading the character that follows it. Up to
-    version 3.13.0 that character was consumed and not put back, so the stream was left one byte too far whenever a
-    number was immediately followed by another value: reading `1true` yielded `1` and left the stream at `rue`.
-    Values had to be separated by whitespace to work around this.
+    A number is only terminated by the character that follows it. That character is read from the stream to detect the
+    end of the number, and it is **not** put back. When a value that is a number is immediately followed by the next
+    value, the first character of that next value is lost:
 
-    The terminating character is now only looked at and left in the stream, so no separator is required. Code that
-    relied on the extra byte being swallowed will observe it again.
+    ```cpp
+    std::istringstream input("1true");
+    json j1, j2;
+    input >> j1;  // j1 == 1
+    input >> j2;  // throws parse_error.101: the stream now starts at "rue"
+    ```
+
+    Separating the values with whitespace avoids this, because the character that is eaten is then the separator:
+
+    ```cpp
+    std::istringstream input("1 true");
+    json j1, j2;
+    input >> j1;  // j1 == 1
+    input >> j2;  // j2 == true
+    ```
+
+    Only numbers are affected. Values ending in a self-delimiting character do not read past themselves, so
+    `truefalse`, `[1][2]`, `{"a":1}{"b":2}`, and `"a""b"` can be read back to back without a separator.
+
+    This is tracked in [#5340](https://github.com/nlohmann/json/issues/5340).
 
 Note that reading concatenated values does **not** work for [JSON Lines](../features/parsing/json_lines.md)
 (newline-delimited JSON) input -- see that page for why and for the recommended alternative.
@@ -87,5 +102,3 @@ Note that reading concatenated values does **not** work for [JSON Lines](../feat
 ## Version history
 
 - Added in version 1.0.0.
-- Changed in version 4.0.0 to leave the character that terminates a number in the stream, so that the stream is
-  positioned right after the parsed value for every value type.

docs/mkdocs/docs/community/ecosystem.md

@@ -0,0 +1,40 @@
+# Ecosystem
+
+The projects below build on top of `nlohmann::json` rather than merely using it - schema validators, language
+bindings, format converters, and similar building blocks. The list is not exhaustive, and is curated rather than
+automatically generated. If you maintain or know of a project that belongs here,
+[please let me know](mailto:mail@nlohmann.me).
+
+For products, applications, and organizations that use the library, see [Customers](../home/customers.md) instead.
+
+## Schema validation
+
+- [**json-schema-validator**](https://github.com/pboettch/json-schema-validator), a JSON Schema (draft 7) validator
+  with human-readable error messages
+
+## Serialization and reflection
+
+- [**nlohmann_json_reflect**](https://github.com/1261385937/nlohmann_json_reflect), a reflection extension for
+  (de)serializing nested containers-in-structs-in-containers
+
+## Encodings
+
+- [**base-encode-decode**](https://github.com/saxonnicholls/base-encode-decode), a header-only Base64/32/16/8/4/2
+  (and DNA/RNA) encoding library, with an adapter that serializes binary data through `nlohmann::json`
+
+## Language bindings and interop
+
+- [**pybind11_json**](https://github.com/pybind/pybind11_json), a bidirectional type caster between
+  `nlohmann::json` and Python objects for [pybind11](https://github.com/pybind/pybind11) bindings
+- [**nanobind_json**](https://github.com/ianhbell/nanobind_json), the same idea for
+  [nanobind](https://github.com/wjakob/nanobind) bindings
+- [**nlohmann_json_qt**](https://github.com/dpurgin/nlohmann_json_qt), deserialization helpers for Qt types
+  (`QString`, `QUrl`, `QDateTime`, `QVector`, ...) from `nlohmann::json`
+- [**vulkan2json**](https://github.com/Fadis/vulkan2json), serialization and deserialization of Vulkan API structs
+
+## Format converters
+
+- [**tojson**](https://github.com/mircodz/tojson), a header-only converter between YAML/XML documents and
+  `nlohmann::json`
+- [**json2xml**](https://github.com/testillano/json2xml), a header-only converter from `nlohmann::json` to XML for
+  simple configuration documents

docs/mkdocs/docs/community/index.md

@@ -1,5 +1,6 @@
 # Community
 
+- [Ecosystem](ecosystem.md) - third-party projects built on top of this library
 - [Code of Conduct](code_of_conduct.md) - the rules and norms of this project
 - [Contribution Guidelines](contribution_guidelines.md) - guidelines how to contribute to this project
 - [Governance](governance.md) - the governance model of this project

docs/mkdocs/docs/community/quality_assurance.md

@@ -66,6 +66,7 @@ Note: Some modern features (like C++20 ranges or filesystem support) may be disa
         | Clang 20.1.1                                 | x86_64       | Ubuntu 22.04.1 LTS                | GitHub    |
         | Clang 20.1.8 with GNU-like command-line      | x86_64       | Windows Server 2022 (Build 20348) | GitHub    |
         | Clang 21.1.8                                 | x86_64       | Ubuntu 22.04.1 LTS                | GitHub    |
+        | Clang 22.1.8                                 | x86_64       | Ubuntu 22.04.1 LTS                | GitHub    |
         | CUDA 11.8.0 (nvcc)                           | x86_64       | Ubuntu 22.04 LTS                  | GitHub    |
         | CUDA 12.1.1 (nvcc)                           | x86_64       | Ubuntu 22.04 LTS                  | GitHub    |
         | CUDA 12.6.3 (nvcc)                           | x86_64       | Ubuntu 22.04 LTS                  | GitHub    |

docs/mkdocs/docs/features/binary_formats/bjdata.md

@@ -116,9 +116,19 @@ The library uses the following mapping from JSON values types to BJData types ac
     ```
 
     Likewise, when a JSON object in the above form is serialized using
-    [`to_bjdata`](../../api/basic_json/to_bjdata.md), it is automatically converted into a compact BJData ND-array. The
-    only exception is, that when the 1-dimensional vector stored in `"_ArraySize_"` contains a single integer or two
-    integers with one being 1, a regular 1-D optimized array is generated.
+    [`to_bjdata`](../../api/basic_json/to_bjdata.md), it is automatically converted into a compact BJData ND-array. When
+    the 1-dimensional vector stored in `"_ArraySize_"` contains a single integer or two integers with one being 1, a
+    regular 1-D optimized array is generated instead.
+
+    An object is only converted if the annotation actually describes a packed array; otherwise it is serialized as a
+    regular JSON object. This requires all of the following:
+
+    - `"_ArrayType_"` is one of `uint8`, `int8`, `uint16`, `int16`, `uint32`, `int32`, `uint64`, `int64`, `single`,
+      `double`, `char`, or `byte`,
+    - every entry of `"_ArraySize_"` is a non-negative integer, and their product is representable as a `std::size_t`,
+    - `"_ArrayData_"` holds exactly that many elements, and
+    - every element of `"_ArrayData_"` is a number of the kind named by `"_ArrayType_"` (a floating-point number for
+      `single` and `double`, an integer otherwise).
 
     The current version of this library does not yet support automatic detection of and conversion from a nested JSON
     array input to a BJData ND-array.

docs/mkdocs/mkdocs.yml

@@ -308,6 +308,7 @@ nav:
           - 'NLOHMANN_JSON_VERSION_MAJOR, NLOHMANN_JSON_VERSION_MINOR, NLOHMANN_JSON_VERSION_PATCH': api/macros/nlohmann_json_version_major.md
   - Community:
       - community/index.md
+      - community/ecosystem.md
       - "Code of Conduct": community/code_of_conduct.md
       - community/contribution_guidelines.md
       - community/quality_assurance.md

include/nlohmann/detail/input/binary_reader.hpp

@@ -465,15 +465,6 @@ class binary_reader
     // CBOR //
     //////////
 
-    /*!
-    @param[in] get_char  whether a new character should be retrieved from the
-                         input (true) or whether the last read character should
-                         be considered instead (false)
-    @param[in] tag_handler how CBOR tags should be treated
-
-    @return whether a valid CBOR value was passed to the SAX parser
-    */
-
     template<typename NumberType>
     bool get_cbor_negative_integer()
     {
@@ -492,6 +483,14 @@ class binary_reader
         return sax->number_integer(static_cast<number_integer_t>(-1) - static_cast<number_integer_t>(number));
     }
 
+    /*!
+    @param[in] get_char  whether a new character should be retrieved from the
+                         input (true) or whether the last read character should
+                         be considered instead (false)
+    @param[in] tag_handler how CBOR tags should be treated
+
+    @return whether a valid CBOR value was passed to the SAX parser
+    */
     bool parse_cbor_internal(const bool get_char,
                              const cbor_tag_handler_t tag_handler)
     {
@@ -1988,7 +1987,11 @@ class binary_reader
     {
         if (get_char)
         {
-            get();  // TODO(niels): may we ignore N here?
+            // no get_ignore_noop() here: the byte read next must be a string
+            // length type specification, and a no-op ('N') is not valid in
+            // that position. No-ops at positions where a value may appear are
+            // already consumed by the callers via get_ignore_noop().
+            get();
         }
 
         if (JSON_HEDLEY_UNLIKELY(!unexpect_eof(input_format, "value")))

include/nlohmann/detail/input/input_adapters.hpp

@@ -101,9 +101,6 @@ class input_stream_adapter
         // maintain ifstream flags, except eof
         if (is != nullptr)
         {
-            // consume the character last returned by get_character() unless it
-            // was given back with release_lookahead()
-            commit_lookahead();
             is->clear(is->rdstate() & std::ios::eofbit);
         }
     }
@@ -118,60 +115,29 @@ class input_stream_adapter
     input_stream_adapter& operator=(input_stream_adapter&&) = delete;
 
     input_stream_adapter(input_stream_adapter&& rhs) noexcept
-        : is(rhs.is), sb(rhs.sb), lookahead(rhs.lookahead)
+        : is(rhs.is), sb(rhs.sb)
     {
         rhs.is = nullptr;
         rhs.sb = nullptr;
-        rhs.lookahead = false;
     }
 
-    // Whether the character last returned by get_character() can be given back
-    // to the input with release_lookahead().
-    static constexpr bool supports_lookahead = true;
-
     // std::istream/std::streambuf use std::char_traits<char>::to_int_type, to
     // ensure that std::char_traits<char>::eof() and the character 0xFF do not
     // end up as the same value, e.g., 0xFFFFFFFF.
-    //
-    // The character is peeked rather than consumed: it is only stepped over
-    // once the next character is requested, or when the adapter is destroyed.
-    // Until then, release_lookahead() can leave it in the input.
     std::char_traits<char>::int_type get_character()
     {
-        if (lookahead)
-        {
-            // step over the character returned by the previous call
-            sb->sbumpc();
-        }
-
-        auto res = sb->sgetc();
+        auto res = sb->sbumpc();
         // set eof manually, as we don't use the istream interface.
         if (JSON_HEDLEY_UNLIKELY(res == std::char_traits<char>::eof()))
         {
-            // there is nothing to step over next time
-            lookahead = false;
             is->clear(is->rdstate() | std::ios::eofbit);
         }
-        else
-        {
-            lookahead = true;
-        }
         return res;
     }
 
-    // Leave the character last returned by get_character() in the input, so
-    // that the next read from the stream - by this adapter or by the caller
-    // once parsing is done - sees it again. Unlike putting a consumed
-    // character back, this cannot fail.
-    void release_lookahead() noexcept
-    {
-        lookahead = false;
-    }
-
     template<class T>
     std::size_t get_elements(T* dest, std::size_t count = 1)
     {
-        commit_lookahead();
         auto res = static_cast<std::size_t>(sb->sgetn(reinterpret_cast<char*>(dest), static_cast<std::streamsize>(count * sizeof(T))));
         if (JSON_HEDLEY_UNLIKELY(res < count * sizeof(T)))
         {
@@ -181,23 +147,9 @@ class input_stream_adapter
     }
 
   private:
-    // Step over the character last returned by get_character(). The character
-    // has already been peeked successfully, so for every streambuf with a get
-    // area this is a pointer increment that cannot fail.
-    void commit_lookahead()
-    {
-        if (lookahead)
-        {
-            lookahead = false;
-            sb->sbumpc();
-        }
-    }
-
     /// the associated input stream
     std::istream* is = nullptr;
     std::streambuf* sb = nullptr;
-    /// whether get_character() peeked a character that is not consumed yet
-    bool lookahead = false;
 };
 #endif  // JSON_NO_IO
 
@@ -393,8 +345,12 @@ struct wide_string_input_helper<BaseInputAdapter, 4>
             }
             else
             {
-                // unknown character
-                utf8_bytes[0] = static_cast<std::char_traits<char>::int_type>(wc);
+                // A code point above U+10FFFF has no UTF-8 encoding. Passing the
+                // unit through would narrow it to int, where 0xFFFFFFFF becomes
+                // char_traits<char>::eof() and would end the input silently, so
+                // emit a byte that is never valid UTF-8 and let the decoder
+                // reject it.
+                utf8_bytes[0] = 0xFF;
                 utf8_bytes_filled = 1;
             }
         }

include/nlohmann/detail/input/json_sax.hpp

@@ -370,8 +370,10 @@ class json_sax_dom_parser
 
                 case value_t::string:
                 {
-                    // include the length of the quotes, which is 2
-                    v.start_position = v.end_position - v.m_data.m_value.string->size() - 2;
+                    // escape sequences make the token longer than the value it
+                    // parses to, so the start position cannot be derived from
+                    // the value; use the offset the lexer recorded instead
+                    v.start_position = m_lexer_ref->get_token_start_position();
                     break;
                 }
 
@@ -769,8 +771,10 @@ class json_sax_dom_callback_parser
 
                 case value_t::string:
                 {
-                    // include the length of the quotes, which is 2
-                    v.start_position = v.end_position - v.m_data.m_value.string->size() - 2;
+                    // escape sequences make the token longer than the value it
+                    // parses to, so the start position cannot be derived from
+                    // the value; use the offset the lexer recorded instead
+                    v.start_position = m_lexer_ref->get_token_start_position();
                     break;
                 }
 

include/nlohmann/detail/input/lexer.hpp

@@ -125,24 +125,6 @@ constexpr bool input_adapter_supports_seek(std::false_type /*detected*/)
     return false;
 }
 
-// Detect whether an input adapter reads with one character of lookahead that
-// can be left in the input (see input_stream_adapter::supports_lookahead),
-// detected like supports_seek above.
-template<typename InputAdapterType>
-using detect_supports_lookahead = decltype(InputAdapterType::supports_lookahead);
-
-template<typename InputAdapterType>
-constexpr bool input_adapter_supports_lookahead(std::true_type /*detected*/)
-{
-    return InputAdapterType::supports_lookahead;
-}
-
-template<typename InputAdapterType>
-constexpr bool input_adapter_supports_lookahead(std::false_type /*detected*/)
-{
-    return false;
-}
-
 /*!
 @brief lexical analysis
 
@@ -164,12 +146,6 @@ class lexer : public lexer_base<BasicJsonType>
     static constexpr bool lazy_token_string =
         input_adapter_supports_seek<InputAdapterType>(is_detected<detect_supports_seek, InputAdapterType> {});
 
-    /// whether a simulated unget can be passed on to the input adapter, which
-    /// then leaves the character in the input; see
-    /// input_adapter_supports_lookahead
-    static constexpr bool can_release_lookahead =
-        input_adapter_supports_lookahead<InputAdapterType>(is_detected<detect_supports_lookahead, InputAdapterType> {});
-
   public:
     using token_type = typename lexer_base<BasicJsonType>::token_type;
 
@@ -1381,6 +1357,11 @@ scan_number_done:
         token_buffer.clear();
         decimal_point_position = std::string::npos;
 
+#if JSON_DIAGNOSTIC_POSITIONS
+        // the first character of the token has already been read, hence the -1
+        token_start_position = position.chars_read_total - 1;
+#endif
+
         note_token_start(std::integral_constant<bool, lazy_token_string> {});
     }
 
@@ -1480,21 +1461,6 @@ scan_number_done:
         uncapture_char(std::integral_constant<bool, lazy_token_string> {});
     }
 
-    /// adapter without lookahead: nothing to do (see release_lookahead)
-    void release_lookahead_impl(std::false_type /*can_release*/) const noexcept {}
-
-    /// adapter with lookahead: leave the character in the input instead
-    void release_lookahead_impl(std::true_type /*can_release*/)
-    {
-        if (next_unget)
-        {
-            // the character is read from the input again rather than replayed
-            // from current, so the adapter must not step over it
-            next_unget = false;
-            ia.release_lookahead();
-        }
-    }
-
     /// seekable adapter: nothing was captured, so nothing to undo
     void uncapture_char(std::true_type /*lazy*/) const noexcept {}
 
@@ -1558,28 +1524,14 @@ scan_number_done:
         return position;
     }
 
-    /*!
-    @brief pass a pending simulated unget on to the input
-
-    unget() only rewinds the lexer's own bookkeeping, so the character that
-    terminated the last token (e.g. the character after a number) would still
-    be stepped over when the input adapter is done. Callers that hand the
-    input back to the user afterwards - operator>> and non-strict sax_parse -
-    call this once when scanning is done, so that the input is positioned
-    right after the value.
-
-    Adapters without lookahead (see input_adapter_supports_lookahead) are not
-    handed back to the user, so this is a no-op for them.
-
-    Scanning may continue after this call: @a next_unget is cleared, and the
-    character is read from the input again instead of being replayed from
-    @a current. A pending unget of EOF needs no special case, because reaching
-    EOF leaves no lookahead to release.
-    */
-    void release_lookahead()
+#if JSON_DIAGNOSTIC_POSITIONS
+    /// return the offset of the first character of the last read token; unlike
+    /// the token's parsed value, this accounts for escape sequences
+    constexpr std::size_t get_token_start_position() const noexcept
     {
-        release_lookahead_impl(std::integral_constant<bool, can_release_lookahead> {});
+        return token_start_position;
     }
+#endif
 
     /// seekable adapter: rebuild the last read token from the input on demand
     const std::vector<char_type>& collect_token_chars(std::vector<char_type>& out, std::true_type /*lazy*/) const
@@ -1781,6 +1733,12 @@ scan_number_done:
     /// the last read token on error for seekable adapters (see collect_token_chars)
     std::size_t token_string_start = 0;
 
+#if JSON_DIAGNOSTIC_POSITIONS
+    /// start offset of the current token within the input, used to report
+    /// diagnostic positions (see reset())
+    std::size_t token_start_position = 0;
+#endif
+
     /// buffer for variable-length tokens (numbers, strings)
     string_t token_buffer {};
 

include/nlohmann/detail/input/parser.hpp

@@ -99,14 +99,8 @@ class parser
             json_sax_dom_callback_parser<BasicJsonType, InputAdapterType> sdp(result, callback, allow_exceptions, &m_lexer);
             sax_parse_internal(&sdp);
 
-            if (!strict)
-            {
-                // the caller keeps using the input: position it right after
-                // the value by leaving the character that terminated it
-                m_lexer.release_lookahead();
-            }
             // in strict mode, input must be completely read
-            else if (get_token() != token_type::end_of_input)
+            if (strict && (get_token() != token_type::end_of_input))
             {
                 sdp.parse_error(m_lexer.get_position(),
                                 m_lexer.get_token_string(),
@@ -133,13 +127,8 @@ class parser
             json_sax_dom_parser<BasicJsonType, InputAdapterType> sdp(result, allow_exceptions, &m_lexer);
             sax_parse_internal(&sdp);
 
-            if (!strict)
-            {
-                // see above
-                m_lexer.release_lookahead();
-            }
             // in strict mode, input must be completely read
-            else if (get_token() != token_type::end_of_input)
+            if (strict && (get_token() != token_type::end_of_input))
             {
                 sdp.parse_error(m_lexer.get_position(),
                                 m_lexer.get_token_string(),
@@ -176,14 +165,8 @@ class parser
         (void)detail::is_sax_static_asserts<SAX, BasicJsonType> {};
         const bool result = sax_parse_internal(sax);
 
-        if (result && !strict)
-        {
-            // the caller keeps using the input: position it right after the
-            // value by leaving the character that terminated it
-            m_lexer.release_lookahead();
-        }
         // strict mode: next byte must be EOF
-        else if (result && strict && (get_token() != token_type::end_of_input))
+        if (result && strict && (get_token() != token_type::end_of_input))
         {
             return sax->parse_error(m_lexer.get_position(),
                                     m_lexer.get_token_string(),

include/nlohmann/detail/output/binary_writer.hpp

@@ -1670,7 +1670,23 @@ class binary_writer
             {
                 return true;
             }
-            len *= static_cast<std::size_t>(el.template get<std::uint64_t>());
+
+            // a dimension that does not fit into std::size_t, or a product that
+            // overflows it, would wrap around and could match the size of
+            // _ArrayData_ by accident; the resulting header announces an
+            // element count that no reader can honor (the binary reader rejects
+            // it with out_of_range.408), so encode as a plain object instead
+            const auto dim = el.template get<std::uint64_t>();
+            if (!value_in_range_of<std::size_t>(dim))
+            {
+                return true;
+            }
+            const auto dim_size = static_cast<std::size_t>(dim);
+            if (dim_size != 0 && len > (std::numeric_limits<std::size_t>::max)() / dim_size)
+            {
+                return true;
+            }
+            len *= dim_size;
         }
 
         key = "_ArrayData_";

single_include/nlohmann/json.hpp

@@ -7104,9 +7104,6 @@ class input_stream_adapter
         // maintain ifstream flags, except eof
         if (is != nullptr)
         {
-            // consume the character last returned by get_character() unless it
-            // was given back with release_lookahead()
-            commit_lookahead();
             is->clear(is->rdstate() & std::ios::eofbit);
         }
     }
@@ -7121,60 +7118,29 @@ class input_stream_adapter
     input_stream_adapter& operator=(input_stream_adapter&&) = delete;
 
     input_stream_adapter(input_stream_adapter&& rhs) noexcept
-        : is(rhs.is), sb(rhs.sb), lookahead(rhs.lookahead)
+        : is(rhs.is), sb(rhs.sb)
     {
         rhs.is = nullptr;
         rhs.sb = nullptr;
-        rhs.lookahead = false;
     }
 
-    // Whether the character last returned by get_character() can be given back
-    // to the input with release_lookahead().
-    static constexpr bool supports_lookahead = true;
-
     // std::istream/std::streambuf use std::char_traits<char>::to_int_type, to
     // ensure that std::char_traits<char>::eof() and the character 0xFF do not
     // end up as the same value, e.g., 0xFFFFFFFF.
-    //
-    // The character is peeked rather than consumed: it is only stepped over
-    // once the next character is requested, or when the adapter is destroyed.
-    // Until then, release_lookahead() can leave it in the input.
     std::char_traits<char>::int_type get_character()
     {
-        if (lookahead)
-        {
-            // step over the character returned by the previous call
-            sb->sbumpc();
-        }
-
-        auto res = sb->sgetc();
+        auto res = sb->sbumpc();
         // set eof manually, as we don't use the istream interface.
         if (JSON_HEDLEY_UNLIKELY(res == std::char_traits<char>::eof()))
         {
-            // there is nothing to step over next time
-            lookahead = false;
             is->clear(is->rdstate() | std::ios::eofbit);
         }
-        else
-        {
-            lookahead = true;
-        }
         return res;
     }
 
-    // Leave the character last returned by get_character() in the input, so
-    // that the next read from the stream - by this adapter or by the caller
-    // once parsing is done - sees it again. Unlike putting a consumed
-    // character back, this cannot fail.
-    void release_lookahead() noexcept
-    {
-        lookahead = false;
-    }
-
     template<class T>
     std::size_t get_elements(T* dest, std::size_t count = 1)
     {
-        commit_lookahead();
         auto res = static_cast<std::size_t>(sb->sgetn(reinterpret_cast<char*>(dest), static_cast<std::streamsize>(count * sizeof(T))));
         if (JSON_HEDLEY_UNLIKELY(res < count * sizeof(T)))
         {
@@ -7184,23 +7150,9 @@ class input_stream_adapter
     }
 
   private:
-    // Step over the character last returned by get_character(). The character
-    // has already been peeked successfully, so for every streambuf with a get
-    // area this is a pointer increment that cannot fail.
-    void commit_lookahead()
-    {
-        if (lookahead)
-        {
-            lookahead = false;
-            sb->sbumpc();
-        }
-    }
-
     /// the associated input stream
     std::istream* is = nullptr;
     std::streambuf* sb = nullptr;
-    /// whether get_character() peeked a character that is not consumed yet
-    bool lookahead = false;
 };
 #endif  // JSON_NO_IO
 
@@ -7396,8 +7348,12 @@ struct wide_string_input_helper<BaseInputAdapter, 4>
             }
             else
             {
-                // unknown character
-                utf8_bytes[0] = static_cast<std::char_traits<char>::int_type>(wc);
+                // A code point above U+10FFFF has no UTF-8 encoding. Passing the
+                // unit through would narrow it to int, where 0xFFFFFFFF becomes
+                // char_traits<char>::eof() and would end the input silently, so
+                // emit a byte that is never valid UTF-8 and let the decoder
+                // reject it.
+                utf8_bytes[0] = 0xFF;
                 utf8_bytes_filled = 1;
             }
         }
@@ -7887,24 +7843,6 @@ constexpr bool input_adapter_supports_seek(std::false_type /*detected*/)
     return false;
 }
 
-// Detect whether an input adapter reads with one character of lookahead that
-// can be left in the input (see input_stream_adapter::supports_lookahead),
-// detected like supports_seek above.
-template<typename InputAdapterType>
-using detect_supports_lookahead = decltype(InputAdapterType::supports_lookahead);
-
-template<typename InputAdapterType>
-constexpr bool input_adapter_supports_lookahead(std::true_type /*detected*/)
-{
-    return InputAdapterType::supports_lookahead;
-}
-
-template<typename InputAdapterType>
-constexpr bool input_adapter_supports_lookahead(std::false_type /*detected*/)
-{
-    return false;
-}
-
 /*!
 @brief lexical analysis
 
@@ -7926,12 +7864,6 @@ class lexer : public lexer_base<BasicJsonType>
     static constexpr bool lazy_token_string =
         input_adapter_supports_seek<InputAdapterType>(is_detected<detect_supports_seek, InputAdapterType> {});
 
-    /// whether a simulated unget can be passed on to the input adapter, which
-    /// then leaves the character in the input; see
-    /// input_adapter_supports_lookahead
-    static constexpr bool can_release_lookahead =
-        input_adapter_supports_lookahead<InputAdapterType>(is_detected<detect_supports_lookahead, InputAdapterType> {});
-
   public:
     using token_type = typename lexer_base<BasicJsonType>::token_type;
 
@@ -9143,6 +9075,11 @@ scan_number_done:
         token_buffer.clear();
         decimal_point_position = std::string::npos;
 
+#if JSON_DIAGNOSTIC_POSITIONS
+        // the first character of the token has already been read, hence the -1
+        token_start_position = position.chars_read_total - 1;
+#endif
+
         note_token_start(std::integral_constant<bool, lazy_token_string> {});
     }
 
@@ -9242,21 +9179,6 @@ scan_number_done:
         uncapture_char(std::integral_constant<bool, lazy_token_string> {});
     }
 
-    /// adapter without lookahead: nothing to do (see release_lookahead)
-    void release_lookahead_impl(std::false_type /*can_release*/) const noexcept {}
-
-    /// adapter with lookahead: leave the character in the input instead
-    void release_lookahead_impl(std::true_type /*can_release*/)
-    {
-        if (next_unget)
-        {
-            // the character is read from the input again rather than replayed
-            // from current, so the adapter must not step over it
-            next_unget = false;
-            ia.release_lookahead();
-        }
-    }
-
     /// seekable adapter: nothing was captured, so nothing to undo
     void uncapture_char(std::true_type /*lazy*/) const noexcept {}
 
@@ -9320,28 +9242,14 @@ scan_number_done:
         return position;
     }
 
-    /*!
-    @brief pass a pending simulated unget on to the input
-
-    unget() only rewinds the lexer's own bookkeeping, so the character that
-    terminated the last token (e.g. the character after a number) would still
-    be stepped over when the input adapter is done. Callers that hand the
-    input back to the user afterwards - operator>> and non-strict sax_parse -
-    call this once when scanning is done, so that the input is positioned
-    right after the value.
-
-    Adapters without lookahead (see input_adapter_supports_lookahead) are not
-    handed back to the user, so this is a no-op for them.
-
-    Scanning may continue after this call: @a next_unget is cleared, and the
-    character is read from the input again instead of being replayed from
-    @a current. A pending unget of EOF needs no special case, because reaching
-    EOF leaves no lookahead to release.
-    */
-    void release_lookahead()
+#if JSON_DIAGNOSTIC_POSITIONS
+    /// return the offset of the first character of the last read token; unlike
+    /// the token's parsed value, this accounts for escape sequences
+    constexpr std::size_t get_token_start_position() const noexcept
     {
-        release_lookahead_impl(std::integral_constant<bool, can_release_lookahead> {});
+        return token_start_position;
     }
+#endif
 
     /// seekable adapter: rebuild the last read token from the input on demand
     const std::vector<char_type>& collect_token_chars(std::vector<char_type>& out, std::true_type /*lazy*/) const
@@ -9543,6 +9451,12 @@ scan_number_done:
     /// the last read token on error for seekable adapters (see collect_token_chars)
     std::size_t token_string_start = 0;
 
+#if JSON_DIAGNOSTIC_POSITIONS
+    /// start offset of the current token within the input, used to report
+    /// diagnostic positions (see reset())
+    std::size_t token_start_position = 0;
+#endif
+
     /// buffer for variable-length tokens (numbers, strings)
     string_t token_buffer {};
 
@@ -9919,8 +9833,10 @@ class json_sax_dom_parser
 
                 case value_t::string:
                 {
-                    // include the length of the quotes, which is 2
-                    v.start_position = v.end_position - v.m_data.m_value.string->size() - 2;
+                    // escape sequences make the token longer than the value it
+                    // parses to, so the start position cannot be derived from
+                    // the value; use the offset the lexer recorded instead
+                    v.start_position = m_lexer_ref->get_token_start_position();
                     break;
                 }
 
@@ -10318,8 +10234,10 @@ class json_sax_dom_callback_parser
 
                 case value_t::string:
                 {
-                    // include the length of the quotes, which is 2
-                    v.start_position = v.end_position - v.m_data.m_value.string->size() - 2;
+                    // escape sequences make the token longer than the value it
+                    // parses to, so the start position cannot be derived from
+                    // the value; use the offset the lexer recorded instead
+                    v.start_position = m_lexer_ref->get_token_start_position();
                     break;
                 }
 
@@ -11169,15 +11087,6 @@ class binary_reader
     // CBOR //
     //////////
 
-    /*!
-    @param[in] get_char  whether a new character should be retrieved from the
-                         input (true) or whether the last read character should
-                         be considered instead (false)
-    @param[in] tag_handler how CBOR tags should be treated
-
-    @return whether a valid CBOR value was passed to the SAX parser
-    */
-
     template<typename NumberType>
     bool get_cbor_negative_integer()
     {
@@ -11196,6 +11105,14 @@ class binary_reader
         return sax->number_integer(static_cast<number_integer_t>(-1) - static_cast<number_integer_t>(number));
     }
 
+    /*!
+    @param[in] get_char  whether a new character should be retrieved from the
+                         input (true) or whether the last read character should
+                         be considered instead (false)
+    @param[in] tag_handler how CBOR tags should be treated
+
+    @return whether a valid CBOR value was passed to the SAX parser
+    */
     bool parse_cbor_internal(const bool get_char,
                              const cbor_tag_handler_t tag_handler)
     {
@@ -12692,7 +12609,11 @@ class binary_reader
     {
         if (get_char)
         {
-            get();  // TODO(niels): may we ignore N here?
+            // no get_ignore_noop() here: the byte read next must be a string
+            // length type specification, and a no-op ('N') is not valid in
+            // that position. No-ops at positions where a value may appear are
+            // already consumed by the callers via get_ignore_noop().
+            get();
         }
 
         if (JSON_HEDLEY_UNLIKELY(!unexpect_eof(input_format, "value")))
@@ -14075,14 +13996,8 @@ class parser
             json_sax_dom_callback_parser<BasicJsonType, InputAdapterType> sdp(result, callback, allow_exceptions, &m_lexer);
             sax_parse_internal(&sdp);
 
-            if (!strict)
-            {
-                // the caller keeps using the input: position it right after
-                // the value by leaving the character that terminated it
-                m_lexer.release_lookahead();
-            }
             // in strict mode, input must be completely read
-            else if (get_token() != token_type::end_of_input)
+            if (strict && (get_token() != token_type::end_of_input))
             {
                 sdp.parse_error(m_lexer.get_position(),
                                 m_lexer.get_token_string(),
@@ -14109,13 +14024,8 @@ class parser
             json_sax_dom_parser<BasicJsonType, InputAdapterType> sdp(result, allow_exceptions, &m_lexer);
             sax_parse_internal(&sdp);
 
-            if (!strict)
-            {
-                // see above
-                m_lexer.release_lookahead();
-            }
             // in strict mode, input must be completely read
-            else if (get_token() != token_type::end_of_input)
+            if (strict && (get_token() != token_type::end_of_input))
             {
                 sdp.parse_error(m_lexer.get_position(),
                                 m_lexer.get_token_string(),
@@ -14152,14 +14062,8 @@ class parser
         (void)detail::is_sax_static_asserts<SAX, BasicJsonType> {};
         const bool result = sax_parse_internal(sax);
 
-        if (result && !strict)
-        {
-            // the caller keeps using the input: position it right after the
-            // value by leaving the character that terminated it
-            m_lexer.release_lookahead();
-        }
         // strict mode: next byte must be EOF
-        else if (result && strict && (get_token() != token_type::end_of_input))
+        if (result && strict && (get_token() != token_type::end_of_input))
         {
             return sax->parse_error(m_lexer.get_position(),
                                     m_lexer.get_token_string(),
@@ -18700,7 +18604,23 @@ class binary_writer
             {
                 return true;
             }
-            len *= static_cast<std::size_t>(el.template get<std::uint64_t>());
+
+            // a dimension that does not fit into std::size_t, or a product that
+            // overflows it, would wrap around and could match the size of
+            // _ArrayData_ by accident; the resulting header announces an
+            // element count that no reader can honor (the binary reader rejects
+            // it with out_of_range.408), so encode as a plain object instead
+            const auto dim = el.template get<std::uint64_t>();
+            if (!value_in_range_of<std::size_t>(dim))
+            {
+                return true;
+            }
+            const auto dim_size = static_cast<std::size_t>(dim);
+            if (dim_size != 0 && len > (std::numeric_limits<std::size_t>::max)() / dim_size)
+            {
+                return true;
+            }
+            len *= dim_size;
         }
 
         key = "_ArrayData_";

tests/src/unit-bjdata.cpp

@@ -2730,6 +2730,27 @@ TEST_CASE("BJData")
                 CHECK(json::from_bjdata(json::to_bjdata(j_type), true, true) == j_type);
                 CHECK(json::from_bjdata(json::to_bjdata(j_size), true, true) == j_size);
             }
+
+            SECTION("ndarray whose dimensions overflow stays as object")
+            {
+                // the product of the dimensions wraps around std::size_t to 0
+                // and so matches the size of the empty _ArrayData_; writing this
+                // as an ndarray would announce an element count no reader can
+                // honor, so it has to stay a plain object
+                json j_overflow = json({{"_ArrayData_", json::array()}, {"_ArraySize_", {9223372036854775808ull, 2}}, {"_ArrayType_", "uint8"}});
+                CHECK(json::from_bjdata(json::to_bjdata(j_overflow), true, true) == j_overflow);
+
+                // a single dimension that does not fit into std::size_t is
+                // rejected for the same reason (only observable where
+                // std::size_t is narrower than 64 bit)
+                json j_huge = json({{"_ArrayData_", json::array()}, {"_ArraySize_", {18446744073709551615ull}}, {"_ArrayType_", "uint8"}});
+                CHECK(json::from_bjdata(json::to_bjdata(j_huge), true, true) == j_huge);
+
+                // a well-formed ndarray is still encoded as one
+                json j_ok = json({{"_ArrayData_", {1, 2, 3, 4, 5, 6}}, {"_ArraySize_", {2, 3}}, {"_ArrayType_", "uint8"}});
+                CHECK(json::to_bjdata(j_ok) == std::vector<uint8_t>({'[', '$', 'U', '#', '[', 'i', 2, 'i', 3, ']', 1, 2, 3, 4, 5, 6}));
+                CHECK(json::from_bjdata(json::to_bjdata(j_ok), true, true) == j_ok);
+            }
         }
     }
 

tests/src/unit-deserialization.cpp

@@ -14,15 +14,10 @@ using nlohmann::json;
     using namespace nlohmann::literals; // NOLINT(google-build-using-namespace)
 #endif
 
-#include <cstddef>
 #include <iostream>
 #include <iterator>
 #include <sstream>
-#include <streambuf>
-#include <string>
-#include <utility>
 #include <valarray>
-#include <vector>
 
 #if defined(_WIN32)
     #define NOMINMAX
@@ -224,58 +219,6 @@ class proxy_iterator
     iterator* m_it = nullptr;
 };
 
-// A streambuf that keeps no get area at all and refuses every putback: with an
-// empty get area, sungetc() always ends up in pbackfail(). Used to check that
-// the character terminating a number is left in the input without relying on
-// the streambuf being able to put a consumed character back.
-class no_putback_streambuf : public std::streambuf
-{
-  public:
-    explicit no_putback_streambuf(std::string s) : m_data(std::move(s)) {}
-
-  protected:
-    // peek at the next character without consuming it
-    int_type underflow() override
-    {
-        if (m_pos >= m_data.size())
-        {
-            return traits_type::eof();
-        }
-        return traits_type::to_int_type(m_data[m_pos]);
-    }
-
-    // consume the next character
-    int_type uflow() override
-    {
-        if (m_pos >= m_data.size())
-        {
-            return traits_type::eof();
-        }
-        return traits_type::to_int_type(m_data[m_pos++]);
-    }
-
-    int_type pbackfail(int_type /*c*/) override
-    {
-        return traits_type::eof();
-    }
-
-  private:
-    std::string m_data;
-    std::size_t m_pos = 0;
-};
-
-// read the characters that are left in a stream
-std::string remaining(std::istream& is)
-{
-    std::string result;
-    char c = 0;
-    while (is.get(c))
-    {
-        result += c;
-    }
-    return result;
-}
-
 // JSON_HAS_CPP_20
 #if defined(__cpp_char8_t)
 bool check_utf8()
@@ -1238,122 +1181,6 @@ TEST_CASE("deserialization")
         }
     }
 
-    SECTION("stream position after extraction (#5340)")
-    {
-        SECTION("a number does not consume the character that terminates it")
-        {
-            // a number is only terminated by the character following it; that
-            // character must be given back so the stream is positioned right
-            // after the value
-            const std::vector<std::pair<std::string, std::string>> tests =
-            {
-                {"1true", "true"},
-                {"1[2]", "[2]"},
-                {"1{}", "{}"},
-                {R"(1"a")", R"("a")"},
-                {"1 true", " true"},
-                {"12,", ","},
-                {"-0.5e3x", "x"},
-                {"1null", "null"}
-            };
-
-            for (const auto& test : tests)
-            {
-                CAPTURE(test.first);
-                std::istringstream ss(test.first);
-                json j;
-                ss >> j;
-                CHECK(j == json::parse(test.first.substr(0, test.first.size() - test.second.size())));
-                CHECK(remaining(ss) == test.second);
-            }
-        }
-
-        SECTION("values that are self-delimiting are unaffected")
-        {
-            const std::vector<std::pair<std::string, std::string>> tests =
-            {
-                {"truefalse", "false"},
-                {"[1][2]", "[2]"},
-                {R"({"a":1}{"b":2})", R"({"b":2})"},
-                {R"("a""b")", R"("b")"},
-                {"null null", " null"}
-            };
-
-            for (const auto& test : tests)
-            {
-                CAPTURE(test.first);
-                std::istringstream ss(test.first);
-                json j;
-                ss >> j;
-                CHECK(remaining(ss) == test.second);
-            }
-        }
-
-        SECTION("a number at the end of the input leaves nothing behind")
-        {
-            for (const std::string s :
-                    {"1", "12", "-3.5e2", " 7 "
-                    })
-            {
-                CAPTURE(s);
-                std::istringstream ss(s);
-                json j;
-                ss >> j;
-                CHECK(remaining(ss).find_first_not_of(" \t\n\r") == std::string::npos);
-            }
-        }
-
-        SECTION("repeated extraction of concatenated values")
-        {
-            std::istringstream ss(R"(1true[2]3"x"{"a":4}5)");
-            const std::vector<json> expected =
-            {
-                json(1), json(true), json::parse("[2]"), json(3),
-                json("x"), json::parse(R"({"a":4})"), json(5)
-            };
-
-            for (const auto& e : expected)
-            {
-                json j;
-                ss >> j;
-                CHECK(j == e);
-            }
-        }
-
-        SECTION("sax_parse with strict == false")
-        {
-            std::istringstream ss("1true");
-            SaxEventLogger l;
-            CHECK(json::sax_parse(ss, &l, nlohmann::detail::input_format_t::json, false));
-            CHECK(l.events.size() == 1);
-            CHECK(l.events[0] == "number_unsigned(1)");
-            CHECK(remaining(ss) == "true");
-        }
-
-        SECTION("strict parsing still rejects trailing data")
-        {
-            std::istringstream ss("1true");
-            json _;
-            CHECK_THROWS_WITH_AS(_ = json::parse(ss),
-                                 "[json.exception.parse_error.101] parse error at line 1, column 5: syntax error while parsing value - unexpected true literal; expected end of input", json::parse_error&);
-
-            std::istringstream ss2("1true");
-            CHECK_FALSE(json::accept(ss2));
-        }
-
-        SECTION("a streambuf that cannot put back is not needed")
-        {
-            // the terminating character is never consumed, so no putback
-            // position is required
-            no_putback_streambuf buf("1true");
-            std::istream is(&buf);
-            json j;
-            is >> j;
-            CHECK(j == json(1));
-            CHECK(remaining(is) == "true");
-        }
-    }
-
     // build with C++20
     // JSON_HAS_CPP_20
 #if defined(__cpp_char8_t)

tests/src/unit-diagnostic-positions.cpp

@@ -38,6 +38,36 @@ TEST_CASE("Better diagnostics with positions")
                              "[json.exception.type_error.302] type must be number, but is string", json::type_error);
     }
 
+    SECTION("positions of strings containing escape sequences")
+    {
+        // escape sequences make the token longer than the string it parses to,
+        // so the positions must not be derived from the parsed value's length
+        const auto check = [](const std::string & text, const std::string & token)
+        {
+            CAPTURE(text)
+            CAPTURE(token)
+            const json j = json::parse(text);
+            const json& v = j.at("a");
+            CHECK(text.substr(v.start_pos(), v.end_pos() - v.start_pos()) == token);
+        };
+
+        check(R"({"a":"plain"})", R"("plain")");
+        check(R"({"a":"tab\there"})", R"("tab\there")");
+        check(R"({"a":"\n\n\n\n\n\n"})", R"("\n\n\n\n\n\n")");
+        check(R"({"a":"\""})", R"("\"")");
+        check(R"({"a":"\\"})", R"("\\")");
+        check(R"({"a":"é"})", R"("é")");
+        check(R"({"a":"🌞"})", R"("🌞")");
+        check("{\"a\":\"\xc3\xa9\"}", "\"\xc3\xa9\"");  // multi-byte UTF-8, no escapes
+
+        // a string at the root, where an escape would otherwise push the
+        // reported start position past the opening quote
+        const std::string root = R"("a\tb")";
+        const json j = json::parse(root);
+        CHECK(j.start_pos() == 0);
+        CHECK(j.end_pos() == root.size());
+    }
+
     SECTION("JSON patch add to primitive parent (#4292)")
     {
         // the JSON Patch "add" target /foo/bar/baz has a string parent

tests/src/unit-ubjson.cpp

@@ -1713,6 +1713,44 @@ TEST_CASE("UBJSON")
             CHECK(json::to_ubjson(json::from_ubjson(s_L)) == s_i);
         }
 
+        SECTION("no-op markers")
+        {
+            // A no-op ('N') is valid wherever a value may start; it is consumed
+            // by get_ignore_noop() before the value is read. It is not valid
+            // where a string length type specification is expected.
+
+            SECTION("accepted where a value may start")
+            {
+                // at top level, also repeated
+                CHECK(json::from_ubjson(std::vector<uint8_t>({'N', 'i', 1})) == json(1));
+                CHECK(json::from_ubjson(std::vector<uint8_t>({'N', 'N', 'N', 'i', 1})) == json(1));
+
+                // inside an array of unknown size, before and after an element
+                CHECK(json::from_ubjson(std::vector<uint8_t>({'[', 'N', 'i', 1, ']'})) == json({1}));
+                CHECK(json::from_ubjson(std::vector<uint8_t>({'[', 'i', 1, 'N', ']'})) == json({1}));
+
+                // inside an object of unknown size: before a key, between key
+                // and value, and before the closing '}'
+                CHECK(json::from_ubjson(std::vector<uint8_t>({'{', 'N', 'U', 1, 'a', 'i', 1, '}'})) == json({{"a", 1}}));
+                CHECK(json::from_ubjson(std::vector<uint8_t>({'{', 'U', 1, 'a', 'N', 'i', 1, '}'})) == json({{"a", 1}}));
+                CHECK(json::from_ubjson(std::vector<uint8_t>({'{', 'U', 1, 'a', 'i', 1, 'N', '}'})) == json({{"a", 1}}));
+            }
+
+            SECTION("rejected where a length type specification is expected")
+            {
+                json _;
+
+                // after the 'S' marker of a string value
+                std::vector<uint8_t> const v_S = {'S', 'N', 'U', 1, 'a'};
+                CHECK_THROWS_WITH_AS(_ = json::from_ubjson(v_S), "[json.exception.parse_error.113] parse error at byte 2: syntax error while parsing UBJSON string: expected length type specification (U, i, I, l, L); last byte: 0x4E", json::parse_error&);
+
+                // as the key length of an object with a known size, where
+                // no-ops are not permitted in the first place
+                std::vector<uint8_t> const v_key = {'{', '#', 'i', 1, 'N', 'U', 1, 'a', 'i', 1};
+                CHECK_THROWS_WITH_AS(_ = json::from_ubjson(v_key), "[json.exception.parse_error.113] parse error at byte 5: syntax error while parsing UBJSON string: expected length type specification (U, i, I, l, L); last byte: 0x4E", json::parse_error&);
+            }
+        }
+
         SECTION("number")
         {
             SECTION("float")

tests/src/unit-wstring.cpp

@@ -125,6 +125,16 @@ TEST_CASE("wide strings")
             std::u32string const w = U"\"\x110000";
             json _;
             CHECK_THROWS_AS(_ = json::parse(w), json::parse_error&);
+
+            // a code unit above U+10FFFF must not be narrowed onto the EOF
+            // sentinel: 0xFFFFFFFF would otherwise end the document silently and
+            // let everything following it pass the strict end-of-input check
+            std::u32string const trailing{U'[', U'1', U']', static_cast<char32_t>(0xFFFFFFFF), U'x'};
+            CHECK_THROWS_WITH_AS(_ = json::parse(trailing), "[json.exception.parse_error.101] parse error at line 1, column 4: syntax error while parsing value - invalid literal; last read: '1]\xFF'; expected end of input", json::parse_error&);
+            CHECK(!json::accept(trailing));
+
+            // the same unit inside a string is reported as an ill-formed byte
+            CHECK_THROWS_WITH_AS(_ = json::parse(std::u32string{U'"', static_cast<char32_t>(0xFFFFFFFF), U'"'}), "[json.exception.parse_error.101] parse error at line 1, column 2: syntax error while parsing value - invalid string: ill-formed UTF-8 byte; last read: '\"\xFF'", json::parse_error&);
         }
     }
 }