Report an empty array for UBJSON [$N#<n>] instead of n elements (#6079 )

* Report an empty array for UBJSON `[$N#<n>` instead of n elements A no-op (N) is not a value, so an optimized array of type N holds no element whatever count it declares. The reader skipped the elements but still passed the declared count to the SAX parser: a handler was told start_array(n) and no element followed, and the DOM parser reserved min(n, 16384) values (256 KB) for an array that stays empty. Nine bytes (`[$N#l 0x7FFFFFFF`) therefore committed 256 KB: 2000 of them in one input, 18 KB, committed 512 MB of heap (capacity 163,840,000 values for the 10000 arrays of the original probe: 2.6 GB for 70 KB of input). Untouched pages keep the resident size small, but the commit charge and a 32-bit address space are consumed. The reader now announces 0 elements for an optimized array of type N. The loop that skips the elements is unchanged (it never ran). A count that does not fit into std::size_t is still rejected by the count reader; a count that is too large for the array type of the DOM (before: out_of_range.408 "excessive array size" from the DOM handler) is accepted now, because the array is empty. Behaviour change: sax_parse reports start_array(0) for `[$N#n` (before: n); from_ubjson no longer throws out_of_range.408 for an N-typed array whose count exceeds the maximum size of the array type. Signed-off-by: Niels Lohmann <mail@nlohmann.me> * Clarify the reservation note for announced array counts Signed-off-by: Niels Lohmann <mail@nlohmann.me> --------- Signed-off-by: Niels Lohmann <mail@nlohmann.me>
Bound the total number of valueless UBJSON elements per input
2026-11-12 07:00:46 +00:00 · 2026-11-11 22:37:23 +01:00 · 2026-11-11 10:46:24 +01:00 · 2026-11-10 22:30:31 +01:00 · 2026-11-10 22:30:28 +01:00 · 2026-11-10 21:45:05 +01:00
30 changed files with 1079 additions and 3521 deletions
@@ -60,3 +60,10 @@ updates:
      interval: daily
    cooldown:
      default-days: 7
+    ignore:
+      # semgrep pins these packages to exact or compatible-release versions (see its METADATA);
+      # bumping them on their own makes the Semgrep job fail with ResolutionImpossible, so
+      # they only move together with a semgrep release
+      - dependency-name: mcp
+      - dependency-name: boltons
+      - dependency-name: "opentelemetry-*"
@@ -38,7 +38,7 @@ jobs:

    # Initializes the CodeQL tools for scanning.
    - name: Initialize CodeQL
-      uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
+      uses: github/codeql-action/init@1fc58d04a4d4374f921bdac573c3811c240f9c26 # v4.39.2
      with:
        languages: c-cpp
        # Analyze the sources without compiling them. Autobuild compiled the
@@ -47,4 +47,4 @@ jobs:
        build-mode: none

    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
+      uses: github/codeql-action/analyze@1fc58d04a4d4374f921bdac573c3811c240f9c26 # v4.39.2
@@ -48,6 +48,6 @@ jobs:
          output: 'flawfinder_results.sarif'

      - name: Upload analysis results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
+        uses: github/codeql-action/upload-sarif@1fc58d04a4d4374f921bdac573c3811c240f9c26 # v4.39.2
        with:
          sarif_file: ${{github.workspace}}/flawfinder_results.sarif
@@ -80,6 +80,6 @@ jobs:

      # Upload the results to GitHub's code scanning dashboard.
      - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
+        uses: github/codeql-action/upload-sarif@1fc58d04a4d4374f921bdac573c3811c240f9c26 # v4.39.2
        with:
          sarif_file: results.sarif
@@ -65,7 +65,7 @@ jobs:

      # Upload SARIF file generated in previous step
      - name: Upload SARIF file
-        uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
+        uses: github/codeql-action/upload-sarif@1fc58d04a4d4374f921bdac573c3811c240f9c26 # v4.39.2
        with:
          sarif_file: semgrep.sarif
        if: always()
@@ -1,4 +1,4 @@
-.PHONY: all amalgamate check-amalgamation check_build_options pretty install_astyle clean ChangeLog.md release update_hedley update_hedley_undef BUILD.bazel natvis macro_builder_check run_benchmarks pvs_studio serve_header reuse spdx
+.PHONY: all amalgamate check-amalgamation check_build_options pretty install_astyle clean release update_hedley update_hedley_undef BUILD.bazel natvis macro_builder_check run_benchmarks pvs_studio serve_header reuse spdx

 ##########################################################################
 # configuration
@@ -40,7 +40,6 @@ MACRO_SCOPE_HPP=include/nlohmann/detail/macro_scope.hpp
 all:
 	@echo "amalgamate - amalgamate files single_include/nlohmann/json{,_fwd,_literals,_view}.hpp from the include/nlohmann sources"
 	@echo "BUILD.bazel - regenerate the Bazel BUILD file from the include/nlohmann sources"
-	@echo "ChangeLog.md - generate ChangeLog file"
 	@echo "check-amalgamation - check whether sources have been amalgamated and BUILD.bazel is up to date"
 	@echo "check_build_options - check that the Meson build and the pkg-config files offer the options of the CMake target"
 	@echo "clean - remove built files"
@@ -175,22 +174,6 @@ check-amalgamation:
 BUILD.bazel:
 	cmake -P cmake/scripts/gen_bazel_build_file.cmake

-##########################################################################
-# ChangeLog
-##########################################################################
-
-# Create a ChangeLog based on the git log using the GitHub Changelog Generator
-# (<https://github.com/github-changelog-generator/github-changelog-generator>).
-
-# variable to control the diffs between the last released version and the current repository state
-NEXT_VERSION ?= "unreleased"
-
-ChangeLog.md:
-	github_changelog_generator -o ChangeLog.md --user nlohmann --project json --simple-list --release-url https://github.com/nlohmann/json/releases/tag/%s --future-release $(NEXT_VERSION)
-	$(SED) -i 's|https://github.com/nlohmann/json/releases/tag/HEAD|https://github.com/nlohmann/json/tree/HEAD|' ChangeLog.md
-	$(SED) -i '2i All notable changes to this project will be documented in this file. This project adheres to [Semantic Versioning](http://semver.org/).' ChangeLog.md
-
-
 ##########################################################################
 # Release files
 ##########################################################################
@@ -1,4 +1,9 @@
-[![JSON for Modern C++](docs/mkdocs/docs/images/json.gif)](https://github.com/nlohmann/json/releases)
+<a href="https://github.com/nlohmann/json/releases">
+  <picture>
+    <source media="(prefers-color-scheme: dark)" srcset="docs/mkdocs/docs/images/json-dark.svg">
+    <img src="docs/mkdocs/docs/images/json-light.svg" alt="JSON for Modern C++: animated feature slideshow">
+  </picture>
+</a>

 [![Build Status](https://ci.appveyor.com/api/projects/status/1acb366xfyg3qybk/branch/develop?svg=true)](https://ci.appveyor.com/project/nlohmann/json)
 [![Ubuntu](https://github.com/nlohmann/json/workflows/Ubuntu/badge.svg)](https://github.com/nlohmann/json/actions?query=workflow%3AUbuntu)
@@ -39,6 +44,7 @@
  - [Conversions to/from arbitrary types](#arbitrary-types-conversions)
  - [Specializing enum conversion](#specializing-enum-conversion)
  - [Binary formats (BSON, CBOR, MessagePack, UBJSON, BJData, and BON8)](#binary-formats-bson-cbor-messagepack-ubjson-bjdata-and-bon8)
+  - [Zero-copy views](#zero-copy-views)
 - [Customers](#customers)
 - [Ecosystem](#ecosystem)
 - [Supported compilers](#supported-compilers)
@@ -68,7 +74,7 @@ Other aspects were not so important to us:

 - **Memory efficiency**. Each JSON object has an overhead of one pointer (the maximal size of a union) and one enumeration element (1 byte). The default generalization uses the following C++ data types: `std::string` for strings, `int64_t`, `uint64_t` or `double` for numbers, `std::map` for objects, `std::vector` for arrays, and `bool` for Booleans. However, you can template the generalized class `basic_json` to your needs.

- **Speed**. There are certainly [faster JSON libraries](https://github.com/miloyip/nativejson-benchmark#parsing-time) out there. However, if your goal is to speed up your development by adding JSON support with a single header, then this library is the way to go. If you know how to use a `std::vector` or `std::map`, you are already set.
+- **Speed**. There are certainly [faster JSON libraries](https://github.com/miloyip/nativejson-benchmark#parsing-time) out there. However, if your goal is to speed up your development by adding JSON support with a single header, then this library is the way to go. If you know how to use a `std::vector` or `std::map`, you are already set. The [performance](https://json.nlohmann.me/features/performance/) page shows how to get the most out of the library.

 See the [contribution guidelines](https://github.com/nlohmann/json/blob/develop/.github/CONTRIBUTING.md#please-dont) for more information.

@@ -1052,7 +1058,7 @@ struct less_than_32_serializer {
 Be **very** careful when reimplementing your serializer, you can stack overflow if you don't pay attention:

 ```cpp
-template <typename T, void>
+template <typename T, typename = void>
 struct bad_serializer
 {
    template <typename BasicJsonType>
@@ -1063,10 +1069,10 @@ struct bad_serializer
    }

    template <typename BasicJsonType>
-    static void to_json(const BasicJsonType& j, T& value) {
+    static void from_json(const BasicJsonType& j, T& value) {
      // this calls BasicJsonType::json_serializer<T>::from_json(j, value)
      // if BasicJsonType::json_serializer == bad_serializer ... oops!
-      value = j.get<T>(); // oops!
+      value = j.template get<T>(); // oops!
    }
 };
 ```
@@ -1769,7 +1775,7 @@ I deeply appreciate the help of the following people.
 330. [AniketDhemare](https://github.com/AniketDhemare) fixed a version in the documentation.
 331. [Philip Müller](https://github.com/philip-paul-mueller) fixed an example.
 332. [Leila Shcheglova](https://github.com/LeilaShcheglova) fixed a warning in a test.
-333. [Alex Prabhat Bara](https://github.com/alexprabhat99) fixed a function name in the documentation.
+333. [Alex Prabhat Bara](https://github.com/alexprabhat99) fixed a function name in the documentation and avoided temporary `basic_json` values for CBOR and MessagePack object keys.
 334. [laterlaugh](https://github.com/laterlaugh) fixed some typos.
 335. [Yuanhao Jia](https://github.com/MrJia1997) fixed the GDB pretty printer.
 336. [Fallen_Breath](https://github.com/Fallen-Breath) fixed an example for JSON Pointer.
@@ -1847,7 +1853,7 @@ I deeply appreciate the help of the following people.
 408. [Luke Banicevic](https://github.com/banaboi) fixed corrupt BSON output for lengths exceeding `INT32_MAX`, cleaned up the BSON writer, and improved the documentation.
 409. [Patrick Armstrong](https://github.com/Patrick10199) updated the CBOR references and the half-precision float assertions.
 410. [Yash Bavadiya](https://github.com/xevrion) added checks to all BSON reads.
-411. [hum4nBeing](https://github.com/hum4nBeing) fixed the overflow handling of high-precision numbers in UBJSON.
+411. [hum4nBeing](https://github.com/hum4nBeing) and [AJ369ninja](https://github.com/AJ369ninja) fixed the overflow handling of high-precision numbers in UBJSON.
 412. [tomatotomata](https://github.com/tomatotomata) added checks for reading CBOR tagged subtypes.
 413. [YingqiDuan](https://github.com/YingqiDuan) documented the BSON interoperability.
 414. [KBS](https://github.com/youdie006) documented the standards compliance and the strictness of `parse()` and `operator>>`.
@@ -1861,6 +1867,26 @@ I deeply appreciate the help of the following people.
 422. [Avionic Harshit](https://github.com/avionicharshit-byte) made `diff()` linear when an array shrinks.
 423. [Qatadaha Bin Matloob](https://github.com/qatcod) fixed comparisons between integers and floats and fixed unparsable BJData output.
 424. [Wu Shuwen](https://github.com/dajiaohuang) removed an unused include.
+425. [Alexander Lanin](https://github.com/AlexanderLanin) improved the error message of `get_to()` for `const` arguments.
+426. [satelliteprogrammer](https://github.com/satelliteprogrammer) added `merge_diff()` to create JSON Merge Patches (RFC 7396).
+427. [Jeremy Nimmer](https://github.com/jwnimmer-tri) removed `alwayslink` from the Bazel build.
+428. [Dadi Reddy Sai Praneeth Reddy](https://github.com/dsp0redy) made `to_msgpack()` throw when a size exceeds the MessagePack limit.
+429. [ayush-singh-0601](https://github.com/ayush-singh-0601) reduced the runtime of the test suite.
+430. [Kartikey Negi](https://github.com/ReturnKartikey) fixed the CBOR tag handling of tagged values that are not byte strings.
+431. [Michiel van Slobbe](https://github.com/mvanslobbe) sped up the parser by checking for the expected separator first.
+432. [Mohd Quamar Tyagi](https://github.com/Tyagiquamar) allowed SAX parsing of tagged CBOR.
+433. [fhgffy](https://github.com/fhgffy) rejected NUL bytes in UBJSON and BJData high-precision numbers and fixed a `-Wswitch-enum` warning.
+434. [Suyog Verma](https://github.com/commit-msuyog) used MSVC intrinsics for the 128-bit multiplication in the floating-point serialization.
+435. [Bas van Dijk](https://github.com/basdedas) fixed a TU-local exposure of `UTF8_ACCEPT` and `UTF8_REJECT` in C++20 modules.
+436. [Christoph Grüninger](https://github.com/gruenich) fixed a leak and a crash when an allocation throws during parsing.
+437. [Amelia Barnaby](https://github.com/ameliabarnabyhub) made serializing discarded values to binary formats throw instead of writing corrupt output.
+438. [Vesko Karaganev](https://github.com/veselink1) made the destructor use the provided allocator.
+439. [Michael Sam](https://github.com/michaelsam94) kept allocation failures from escaping the `noexcept` destructor.
+440. [Mihnea Magheru](https://github.com/sakuntalle) added a natvis visualizer for `detail::json_default_base`.
+441. [Joseph Demarest](https://github.com/JosephDemarest) rejected nested indefinite-length CBOR strings.
+442. [Afonso Januário](https://github.com/afonsojanu) made `std::hash<basic_json>` consistent with `operator==` for numbers.
+443. [Kartik Gupta](https://github.com/KartikeyG-world) limited the natvis namespace variants to two ABI tags.
+444. [manop55555](https://github.com/manop55555) reported a buffer over-read in `dump()` with large indentation values.

 Thanks a lot for helping out! Please [let me know](mailto:mail@nlohmann.me) if I forgot someone.

@@ -1883,7 +1909,6 @@ The library itself consists of a single header file licensed under the MIT licen
 - [**cpplint**](https://github.com/cpplint/cpplint) for style checks
 - [**doctest**](https://github.com/doctest/doctest) for the unit tests
 - [**Flawfinder**](https://dwheeler.com/flawfinder/) for static analysis
- [**GitHub Changelog Generator**](https://github.com/github-changelog-generator/github-changelog-generator) to generate the [ChangeLog](https://github.com/nlohmann/json/blob/develop/ChangeLog.md)
 - [**Google Benchmark**](https://github.com/google/benchmark) to implement the benchmarks
 - [**Hedley**](https://nemequ.github.io/hedley/) to avoid re-inventing several compiler-agnostic feature macros
 - [**include-what-you-use**](https://include-what-you-use.org) to check the included headers
@@ -1950,7 +1975,7 @@ For more information, see [JSON With Commas and Comments (JWCC)](https://nigelta

 By default, the library does not preserve the **insertion order of object elements**. This is standards-compliant, as the [JSON standard](https://tools.ietf.org/html/rfc8259.html) defines objects as "an unordered collection of zero or more name/value pairs".

-If you do want to preserve the insertion order, you can try the type [`nlohmann::ordered_json`](https://github.com/nlohmann/json/issues/2179). Alternatively, you can use a more sophisticated ordered map like [`tsl::ordered_map`](https://github.com/Tessil/ordered-map) ([integration](https://github.com/nlohmann/json/issues/546#issuecomment-304447518)) or [`nlohmann::fifo_map`](https://github.com/nlohmann/fifo_map) ([integration](https://github.com/nlohmann/json/issues/485#issuecomment-333652309)).
+If you do want to preserve the insertion order, you can try the type [`nlohmann::ordered_json`](https://json.nlohmann.me/api/ordered_json/). Alternatively, you can use a more sophisticated ordered map like [`tsl::ordered_map`](https://github.com/Tessil/ordered-map) ([integration](https://github.com/nlohmann/json/issues/546#issuecomment-304447518)) or [`nlohmann::fifo_map`](https://github.com/nlohmann/fifo_map) ([integration](https://github.com/nlohmann/json/issues/485#issuecomment-333652309)).

 See the [**documentation on object order**](https://json.nlohmann.me/features/object_order/) for more information.

@@ -2,7 +2,7 @@
 # hashes must list every dependency, so this file was generated with
 #   uv pip compile requirements.in --generate-hashes --python-version 3.14 \
 #       --python-platform x86_64-manylinux_2_39 --no-header --no-annotate
-# from a requirements.in containing only "semgrep==1.168.0". Dependabot keeps it current.
+# from a requirements.in containing only "semgrep==1.184.0". Dependabot keeps it current.
 annotated-types==0.8.0 \
    --hash=sha256:13b2beaad985e05e2d6407ee4c4f35590b11f8d693a258a561055cac8f64cab7 \
    --hash=sha256:f072f4d804ea359e4eaf198b1af7a8b0943881a87f31bb764f8bf219bb9419e0
@@ -295,9 +295,9 @@ charset-normalizer==3.5.2 \
    --hash=sha256:fcff63213e8e6e47770541a4607175404f47cbb3ebea7b6058cc82d524a0e424 \
    --hash=sha256:fd1fbe0f116b6e55da77aca2c6ddcddcfac2186cbf78bdebf40fc156efca389d \
    --hash=sha256:fe9753dfee015c570d73df76f899f18444d41388bffcde097deba51c4fadbb9f
-click==8.1.8 \
-    --hash=sha256:63c132bbbed01578a06712a2d1f497bb62d9c1c0d329b7903a866228027263b2 \
-    --hash=sha256:ed53c9d8990d83c2a27deae68e4ee337473f6330c040a31d4225c9574d16096a
+click==8.4.2 \
+    --hash=sha256:9a6cea6e60b17ebe0a44c5cc636d94f09bd66142c1cd7d8b4cd731c4917a15f6 \
+    --hash=sha256:e6f9f66136c816745b9d65817da91d61d957fb16e02e4dcd0552553c5a197b76
 click-option-group==0.5.9 \
    --hash=sha256:ad2599248bd373e2e19bec5407967c3eec1d0d4fc4a5e77b08a0481e75991080 \
    --hash=sha256:f94ed2bc4cf69052e0f29592bd1e771a1789bd7bfc482dd0bc482134aff95823
@@ -391,9 +391,9 @@ httpx-sse==0.4.3 \
 idna==3.20 \
    --hash=sha256:a7db850025b95ded1eae8a46181a1a6c56c92c96f0e2b005d9ff8dc0210cab44 \
    --hash=sha256:ab7ae7122974553370f0bdb919e1a960b2cd1bc1ef0276416d896db81c14582c
-importlib-metadata==8.7.1 \
-    --hash=sha256:49fef1ae6440c182052f407c8d34a68f72efc36db9ca90dc0113398f2fdde8bb \
-    --hash=sha256:5a1f80bf1daa489495071efbb095d75a634cf28a8bc299581244063b53176151
+importlib-metadata==10.1.0 \
+    --hash=sha256:82b04047fa09792c1a8cfeddfe08bec79e4b13c29c8469b0d3949860f61017e8 \
+    --hash=sha256:cf45ce66a929c64e994185a809c04840d0501db17e663810d993d0f4829265c7
 jsonschema==4.25.1 \
    --hash=sha256:3fba0169e345c7175110351d456342c364814cfcf3b964ba4587f22915230a63 \
    --hash=sha256:e4a9655ce0da0c0b67a085847e00a3a51449e1157f4f75e9fb5aa545e122eb85
@@ -403,9 +403,9 @@ jsonschema-specifications==2025.9.1 \
 markdown-it-py==4.2.0 \
    --hash=sha256:04a21681d6fbb623de53f6f364d352309d4094dd4194040a10fd51833e418d49 \
    --hash=sha256:9f7ebbcd14fe59494226453aed97c1070d83f8d24b6fc3a3bcf9a38092641c4a
-mcp==1.23.3 \
-    --hash=sha256:32768af4b46a1b4f7df34e2bfdf5c6011e7b63d7f1b0e321d0fdef4cd6082031 \
-    --hash=sha256:b3b0da2cc949950ce1259c7bfc1b081905a51916fcd7c8182125b85e70825201
+mcp==1.29.0 \
+    --hash=sha256:52d01f334de1868cc3bb2d6604931126a67631f99a6c5d3b82ba47290315ec36 \
+    --hash=sha256:f5a075bb611f23d6f4d080c6a1699fa62772eebc562ba9e66b306ddde1c755f7
 mdurl==0.1.2 \
    --hash=sha256:84008a41e51615a49fc9966191ff91509e3c40b939176e643fd50a5c2196b8f8 \
    --hash=sha256:bb413d29f5eea38f31dd4754dd7377d4465116fb207585f97bf925588687c1ba
@@ -609,9 +609,9 @@ pydantic-settings==2.16.2 \
 pygments==2.21.0 \
    --hash=sha256:2363c69b61c4a97c838da3b130dcd6468f4848992b21a82f2a63ec34377137d9 \
    --hash=sha256:610ca751c9bc2492b38eb9a38a7fbc93edbbb2d7182edaf34e66ae493dee5c8c
-pyjwt==2.13.0 \
-    --hash=sha256:41571c89ca91598c79e8ef18a2d07367d4810fbbd6f637794879baf1b7703423 \
-    --hash=sha256:66adcc2aff09b3f1bbd95fc1e1577df8ac8723c978552fd43304c8a290ac5728
+pyjwt==2.15.1 \
+    --hash=sha256:42d59d631f7768a1028a64c7ff581a9bf7519804daf91fc5b6c56e30eec5e193 \
+    --hash=sha256:4f259e80cdfb6b3fc18a7de51fd1ef9ec79652f25019bae68975ca2468a34df8
 python-dotenv==1.2.4 \
    --hash=sha256:42269a8a5b3fd54ffa6f3d84b18abed50064717576b4ecf03dc4a55d8aa04fdc \
    --hash=sha256:f0d53e69935a851c0dcc78f3ab7aaccd8cabef0b92382b576b824212902873c0
@@ -824,21 +824,23 @@ ruamel-yaml-clib==0.2.15 \
 semantic-version==2.10.0 \
    --hash=sha256:bdabb6d336998cbb378d4b9db3a4b56a1e3235701dc05ea2690d9a997ed5041c \
    --hash=sha256:de78a3b8e0feda74cabc54aab2da702113e33ac9d9eb9d2389bcf1f58b7d9177
-semgrep==1.168.0 \
-    --hash=sha256:09dfacb0530ed4a17bd2deb7914e9a25fc3581d5d84d5365cdac77bbebed8081 \
-    --hash=sha256:1a5d6b5b47347b22bcb1d6f15a5e51a21e734244884624c3494e09bc1de955cd \
-    --hash=sha256:86e99b095b80492b6cfe5087bf4a3b0175a1132c9c9dcd25a96c3745cc58d85a \
-    --hash=sha256:a072b1734b5c54e39cbbe957b10cf0b83a114b9b9fc762b4ea51afe2f114cd11 \
-    --hash=sha256:c4a664f4dda097fbdf657d64f79217e94c4d87502c16c991fac569f07aaecb8e \
-    --hash=sha256:d288699c4c056cc3d7cf82830e00f9c07fac33227c3a5290a2113bd1be63da46 \
-    --hash=sha256:e6b85d84e815ff86f56dcb6b4a6370b98f1bc0e402144daafa9b41aa00ea9a90 \
-    --hash=sha256:fa22f0a41ee3857ecec1b3883b2920b1d41d07ef1bdd7e216da3c519210ae5fb
+semgrep==1.184.0 \
+    --hash=sha256:0ce3064175a44236dd9fd35603627e3f56139ac61e13ca967bae2b76b2cec9bf \
+    --hash=sha256:0fc8a58e9a62de59ce644dde792dfc36764245d0139ab85632f66a8e0846a8c5 \
+    --hash=sha256:3c86b2961b4663d1338fb965de038c7869571661971b78e18e9346ab57e1e20a \
+    --hash=sha256:42a59e95433fd05a0908f8083e25656c90994c65549e483e0de8a1a0004a7adf \
+    --hash=sha256:cf82d77eb911f921902f3e9d098fb97604c5419c0a87cf7de7ab2944b05e2ceb \
+    --hash=sha256:d847abb8fb6fdde77d9e30a6bc869dbfcb68eff4142dcd77897c52635a7600d9 \
+    --hash=sha256:f794d7c6d33126b6881f80d069583ef35b52bd796d882a5fa249ce1124aba3f3
 sse-starlette==3.7.0 \
    --hash=sha256:326416da2ab52e9a41b3f409d3ff897eda45aa68c9f3b7b17d0913aab8d219c3 \
    --hash=sha256:f1d3136caa12d129284fca3d2ded79bc9af943320b6472712955fea52a6d3eea
 starlette==1.10.0 \
    --hash=sha256:478c0ab3b4ced6e82719849c118fa406f0278a3499c1a898cd15cd31bdc38ce4 \
    --hash=sha256:b8399098d4c1e3522734f7235dc79b1fc967f96cf139c81e0fa30479e0685f9b
+structlog==26.1.0 \
+    --hash=sha256:e081a26d6c373e6d201eca24eede26d8ffab07f88f477822e679183428d3d91e \
+    --hash=sha256:f63a716cbd1b1291cf7661de7794b455acfa4c43c5bcf1630e6ad5ddc1adb3b7
 tomli==2.4.1 \
    --hash=sha256:01f520d4f53ef97964a240a035ec2a869fe1a37dde002b57ebc4417a27ccd853 \
    --hash=sha256:0d85819802132122da43cb86656f8d1f8c6587d54ae7dcaf30e90533028b49fe \
@@ -89,8 +89,10 @@ Strong guarantee: if an exception is thrown, there are no changes in the JSON va
 - Throws [out_of_range.406](../../home/exceptions.md#jsonexceptionout_of_range406) if a high-precision number, or a
  float64 when `number_float_t` is `float`, does not fit into `number_float_t`
 - Throws [out_of_range.408](../../home/exceptions.md#jsonexceptionout_of_range408) if the count of an optimized
-  container exceeds the capacity of the container (or of `std::size_t`), or if an optimized array of `Z`, `T`, or `F` has
-  more than 1,048,576 elements
+  container exceeds the capacity of the container (or of `std::size_t`; an array of type `N` is empty, so only the
+  latter applies to it), if an optimized array of `Z`, `T`, or `F` has more than 1,048,576 elements, or if the
+  optimized arrays of `Z`, `T`, and `F` in the input together have more than 1,048,576 elements plus 4 for every byte
+  read so far

 ## Complexity

@@ -132,6 +134,9 @@ Linear in the size of the input.
 - Extended container support (1) to include types with lvalue-only ADL `begin`/`end` (matching `std::begin`/`std::end` semantics) in version 3.13.0.
 - Extended overload (2) to accept heterogeneous iterator+sentinel pairs (C++20 ranges support) in version 3.13.0.
 - Added `error_handler` parameter in version 3.13.0.
+- Report `start_array(0)` to a SAX handler for an optimized array of type `N` (`[$N#n`), whatever its count, in version
+  3.13.0.
+- Limited the total number of elements of optimized arrays of `Z`, `T`, and `F` in one input in version 3.13.0.

 !!! warning "Deprecation"

@@ -117,5 +117,8 @@ Linear in the size of the JSON value `j`.
 - Added `error_handler` parameter in version 3.13.0. Its default, `keep`, writes the bytes of a string or object key
  that is not valid UTF-8 unchanged, as before; `strict` (the default if
  [`JSON_STRICT_BINARY_UTF8`](../macros/json_strict_binary_utf8.md) is enabled) throws `type_error.316`.
+- Writes arrays of `Z`, `T`, or `F` without the `$` type annotation (`[#n Z Z ...`) once their elements in one call
+  add up to more than 1,048,576, in version 3.13.0, so that `from_ubjson` can read the output back. Such output is
+  larger: 270,000 rows of 100 `null` values take 26.8 MB instead of 1.35 MB.
 - Throws `type_error.321` for a discarded value since version 3.13.0; previously, a discarded value nested in an
  array or object was silently skipped, producing invalid UBJSON.
@@ -122,9 +122,18 @@ The library uses the following mapping from JSON values types to UBJSON types ac
    already is the value. Its declared count is therefore the only thing that decides how much memory the receiving side
    allocates, and a handful of bytes can describe billions of elements. `from_ubjson` rejects such an array with
    [`out_of_range.408`](../../home/exceptions.md#jsonexceptionout_of_range408) when the count exceeds 1,048,576
-    (`1 << 20`), and `to_ubjson` writes longer arrays of these types in the counted but untyped form: the `$` type marker is
-    dropped, the `#` count is kept, and every element is written with its own marker (`[#l 1048577 Z Z ...`), so any value
-    it produces can be read back. Objects and untyped counted arrays are not subject to this limit.
+    (`1 << 20`), or when the counts of all such arrays in the input add up to more than 1,048,576 plus 4 for every byte
+    read so far. `to_ubjson` therefore writes an array of these types in the counted but untyped form when it is longer
+    than that, or when it would bring the total of the typed arrays written so far above 1,048,576: the `$` type marker
+    is dropped, the `#` count is kept, and every element is written with its own marker (`[#l 1048577 Z Z ...`), so
+    everything it produces can be read back. Only input from another encoder, or written by version 3.12.0 and earlier of
+    this library, can exceed the limit: for example, 1,100 rows of 1,000 `null` values or 210,000 rows of 25, each with
+    a `$Z` annotation. Version 3.12.0 writes such a row in 5 bytes (6 above 255 elements), so rows of 20 or fewer such
+    values are never rejected. Objects and untyped counted arrays are not subject to this limit.
+
+    An optimized array of type `N` (no-op) is empty whatever its count is, because a no-op is not a value. Its count is
+    not passed on: `sax_parse` reports `start_array(0)` (versions before 3.13.0 reported the declared count), and the DOM
+    parser reserves nothing for it.

 !!! info "Binary values"

@@ -180,10 +189,11 @@ The library maps UBJSON types to JSON value types as follows:

    Every well-formed UBJSON value can be converted to a JSON value, with these exceptions: a high-precision number
    outside the range of `number_float_t` ([`out_of_range.406`](../../home/exceptions.md#jsonexceptionout_of_range406)),
-    an optimized array of `Z`, `T`, or `F` with more than 1,048,576 elements, and a count that exceeds the capacity of the
-    container ([`out_of_range.408`](../../home/exceptions.md#jsonexceptionout_of_range408)). High-precision numbers that
-    do not fit an integer type are stored as floating-point numbers and may lose precision. Ill-formed input is rejected
-    with a parse error.
+    optimized arrays of `Z`, `T`, or `F` with more elements than the limit allows (1,048,576 plus 4 per byte read),
+    and a count that exceeds the capacity of the container
+    ([`out_of_range.408`](../../home/exceptions.md#jsonexceptionout_of_range408)). High-precision numbers that do not
+    fit an integer type are stored as floating-point numbers and may lose precision. Ill-formed input is rejected with a
+    parse error.

 !!! info "Duplicate object keys"

@@ -72,10 +72,22 @@ For the binary formats, an announced size is never trusted outright:
  (reported as a parse error) instead of triggering an oversized allocation.
 - When an array announces its number of elements and the array container supports `reserve()` (as `#!cpp std::vector`,
  the default, does), the library reserves storage for at most 16384 of them upfront, regardless of how large the
-  announced count is; further elements still grow the container normally as they are read.
+  announced count is; further elements still grow the container normally as they are read. A truncated input whose
+  count is larger than its remaining bytes therefore reserves at most that much before the parse error is reported.
+  Every array element takes at least one byte of input, except in the [UBJSON](../binary_formats/ubjson.md) arrays of
+  type `Z`, `T` or `F` described below.
 - An announced array or object size that exceeds what the target container could ever hold (its `max_size()`) is
  rejected immediately as [`out_of_range.408`](../../home/exceptions.md#jsonexceptionout_of_range408), without
  attempting to allocate anything.
+- A UBJSON array of the no-op type (`[$N#<n>`) is empty whatever count it declares: a SAX handler is told
+  `start_array(0)` and the DOM parser reserves nothing.
+- A UBJSON array of type `Z`, `T` or `F` has no payload, so its announced count is not bounded by the input. One array
+  may announce at most 1,048,576 elements, and all such arrays of one input together may contain at most 1,048,576
+  elements plus 4 for every byte read so far (checked when each array's header has been read); beyond that the input is
+  rejected as [`out_of_range.408`](../../home/exceptions.md#jsonexceptionout_of_range408). For a DOM that bounds the memory these
+  arrays can need to about 80 bytes per byte of input plus about 33 MB for the first 1,048,576 elements; a SAX handler
+  receives at most that many events. Every other optimized array element, and every UBJSON object member (it has a
+  key), takes at least one byte of input.

 ## Strings

@@ -1050,11 +1050,17 @@ The size of an array or object in a [binary format](../features/binary_formats/i
 the size following `#` for [UBJSON](../features/binary_formats/ubjson.md)/[BJData](../features/binary_formats/bjdata.md),
 or the encoded length for [CBOR](../features/binary_formats/cbor.md).

-The exception is also thrown for a [UBJSON](../features/binary_formats/ubjson.md) array of a type that is encoded by its
-marker alone (`Z`, `T` or `F`) whose declared count exceeds 1,048,576 (`1 << 20`). Such an array has no payload, so its
-count alone decides how much memory is allocated, and a handful of bytes would otherwise describe billions of values.
-[`to_ubjson`](../api/basic_json/to_ubjson.md) writes longer arrays of these types without the `$` type annotation (the `#`
-count and one marker per element are kept), so any value it produces can still be read back.
+The exception is also thrown for [UBJSON](../features/binary_formats/ubjson.md) arrays of a type that is encoded by
+its marker alone (`Z`, `T` or `F`). Such an array has no payload, so its count alone decides how much memory is
+allocated, and a handful of bytes would otherwise describe billions of values. It is thrown if the declared count of one
+array exceeds 1,048,576 (`1 << 20`), and if the counts of all such arrays read so far in one input add up to more than
+1,048,576 plus 4 for every byte of the input read when the header of the last array has been read.
+[`to_ubjson`](../api/basic_json/to_ubjson.md) writes an array of these types without the `$` type annotation (the `#`
+count and one marker per element are kept) when it is longer, or when it would bring the total of the typed arrays
+written so far above 1,048,576, so everything it produces can be read back. Only input written by another encoder, or
+by version 3.12.0 and earlier of this library, can exceed the limit: for example, 1,100 rows of 1,000 `null` values or
+210,000 rows of 25, each with a `$Z` annotation. Version 3.12.0 writes such a row in 5 bytes (6 above 255 elements),
+so rows of 20 or fewer such values are never rejected.

 !!! failure "Example messages"

@@ -1070,6 +1076,9 @@ count and one marker per element are kept), so any value it produces can still b
    ```
    [json.exception.out_of_range.408] syntax error while parsing UBJSON size: excessive array size
    ```
+    ```
+    [json.exception.out_of_range.408] syntax error while parsing UBJSON size: excessive number of elements without payload
+    ```

 ### json.exception.out_of_range.409

@@ -73,13 +73,46 @@ the input.

 This is a sanity bound rather than a security boundary, and it is far above
 any container met in practice. @ref binary_writer falls back to the
-unoptimized encoding for longer containers, so that a value serialized by
-this library can always be read back.
+unoptimized encoding for longer containers, and for containers that together
+with the ones before them would exceed @ref valueless_elements_base, so that a
+value serialized by this library can always be read back.

@sa https://github.com/nlohmann/json/issues/2793
 */
 JSON_INLINE_VARIABLE constexpr std::size_t max_valueless_container_size = 1 << 20;

+/*!
+@brief number of elements of valueless UBJSON containers accepted on top of
+       @ref valueless_elements_per_byte
+
+The limit @ref max_valueless_container_size applies to each container on its
+own, so on its own it lets 9 bytes announce 1048576 values, and every further
+9 bytes another 1048576. The elements of all containers of a valueless type
+in one input are therefore added up, and the sum must stay below this base
+plus @ref valueless_elements_per_byte for every byte read so far. The base is
+the per-container limit, so a container that was accepted on its own before
+the sum was introduced is still accepted at the start of an input.
+*/
+JSON_INLINE_VARIABLE constexpr std::size_t valueless_elements_base = max_valueless_container_size;
+
+/*!
+@brief number of elements of valueless UBJSON containers accepted per byte of
+       input, in addition to @ref valueless_elements_base
+
+An element of a value that has a payload costs at least one byte of input.
+Valueless elements are accepted at a rate of 4 per byte. A value takes 16
+bytes of memory in a DOM, so these arrays add about 80 bytes of memory per
+byte of input (measured: 77; one `Z` per byte needs about 32), beyond what the
+same bytes cost anyway, plus the base. This bounds the arrays of valueless
+type, not the memory of a whole document. Containers written by
+@ref binary_writer never need more than the base, because it writes an array
+in the unoptimized form once the typed arrays written so far and this one add
+up to more than that. The rate matters for input written by other encoders and
+by versions before 3.13.0 only; in the data this was measured on, no input has
+more than 0.17 elements per byte.
+*/
+JSON_INLINE_VARIABLE constexpr std::size_t valueless_elements_per_byte = 4;
+
 ///////////////////
 // binary reader //
 ///////////////////
@@ -3700,6 +3733,37 @@ class binary_reader
        return emit_unsigned(number);
    }

+    /*!
+    @brief add the elements of a container of a valueless type to the total of
+           the input and check the total against the input read so far
+
+    A container of type 'Z', 'T' or 'F' has no payload, so its elements are the
+    only ones for which the input does not bound the count. The check is made
+    once per container, not per element.
+
+    @param[in] count  number of elements the container declares; at most
+                      @ref max_valueless_container_size
+    @return false if the total is more than @ref valueless_elements_base plus
+            @ref valueless_elements_per_byte for every byte read so far; the
+            total is not changed then
+    */
+    bool charge_valueless_elements(const std::size_t count) noexcept
+    {
+        // the limit saturates instead of overflowing when size_t is 32 bits
+        // wide and a very large input has been read; valueless_elements
+        // never exceeds the limit, so the difference cannot underflow
+        constexpr std::size_t max_size = (std::numeric_limits<std::size_t>::max)();
+        const std::size_t limit = chars_read <= (max_size - valueless_elements_base) / valueless_elements_per_byte
+                                  ? valueless_elements_base + (valueless_elements_per_byte * chars_read)
+                                  : max_size;
+        if (JSON_HEDLEY_UNLIKELY(count > limit - valueless_elements))
+        {
+            return false;
+        }
+        valueless_elements += count;
+        return true;
+    }
+
    /*!
    @return whether array creation completed
    */
@@ -3785,24 +3849,27 @@ class binary_reader
            // declared count alone decides how much is allocated; the check is
            // made before the start event so that no container is opened that
            // is then abandoned. See @ref max_valueless_container_size.
-            if (JSON_HEDLEY_UNLIKELY((size_and_type.second == 'Z' || size_and_type.second == 'T' || size_and_type.second == 'F')
-                                     && size_and_type.first > max_valueless_container_size))
+            if (JSON_HEDLEY_UNLIKELY(size_and_type.second == 'Z' || size_and_type.second == 'T' || size_and_type.second == 'F'))
            {
-                return out_of_range_error(exception_id::container_too_large, "excessive array size", "size");
+                if (JSON_HEDLEY_UNLIKELY(size_and_type.first > max_valueless_container_size))
+                {
+                    return out_of_range_error(exception_id::container_too_large, "excessive array size", "size");
+                }
+                if (JSON_HEDLEY_UNLIKELY(!charge_valueless_elements(size_and_type.first)))
+                {
+                    return out_of_range_error(exception_id::container_too_large, "excessive number of elements without payload", "size");
+                }
            }

-            if (JSON_HEDLEY_UNLIKELY(!enter_array(size_and_type.first, size_and_type.second)))
+            // a no-op is not a value, so an array of them is empty whatever
+            // count it declares: the SAX parser is told so, instead of being
+            // made to reserve storage for a count that no input backs
+            const std::size_t announced = size_and_type.second == 'N' ? 0 : size_and_type.first;
+            if (JSON_HEDLEY_UNLIKELY(!enter_array(announced, size_and_type.second)))
            {
                return false;
            }

-            if (size_and_type.second == 'N')
-            {
-                // a no-op is not a value, so a container of them holds none;
-                // the declared size has already been passed to the SAX parser
-                container_stack.back().remaining = 0;
-            }
-
            return size_and_type.second == 0
                   || parse_ubjson_typed_run(container_stack.back().remaining, size_and_type.second, std::integral_constant<bool, bulk_scan> {});
        }
@@ -5114,6 +5181,10 @@ class binary_reader
    /// the number of characters read
    std::size_t chars_read = 0;

+    /// UBJSON: the sum of the element counts of the containers of a valueless
+    /// type read so far; see @ref charge_valueless_elements
+    std::size_t valueless_elements = 0;
+
    /// whether we can assume little endianness
    const bool is_little_endian = little_endianness();

@@ -1348,6 +1348,64 @@ struct iterator_input_adapter_factory<IteratorType, SentinelType, enable_if_t<is
    }
 };

+/*!
+@brief whether @a IteratorType is an iterator of std::string or of a
+       std::vector of 1-byte elements
+
+Their elements are contiguous, but before C++20 that cannot be detected from
+the iterator type (std::contiguous_iterator), so an iterator pair of them would
+be read one character at a time through the iterators. They are read as the
+pointer range they are instead, as the containers themselves are (see the
+container overload of input_adapter()). The types are matched exactly, so no
+other iterator can be mistaken for one. (std::basic_string is only matched for
+char: other character types need std::char_traits specializations that the
+standard library need not have.)
+*/
+template<typename CharType>
+struct is_byte_char_type
+{
+    // a member, not an integral_constant argument, which astyle misformats
+    static constexpr bool value = sizeof(CharType) == 1 && std::is_integral<CharType>::value && !std::is_same<CharType, bool>::value;
+};
+
+template<typename IteratorType, typename CharType, bool IsByte = is_byte_char_type<CharType>::value>
+struct is_std_contiguous_byte_iterator_impl : std::false_type {};
+
+// (the containers are only named for byte types)
+template<typename IteratorType, typename CharType>
+struct is_std_contiguous_byte_iterator_impl<IteratorType, CharType, true>
+{
+    static constexpr bool value = !std::is_pointer<IteratorType>::value
+                                  && (std::is_same<IteratorType, typename std::vector<CharType>::iterator>::value
+                                      || std::is_same<IteratorType, typename std::vector<CharType>::const_iterator>::value
+                                      || std::is_same<IteratorType, std::string::iterator>::value
+                                      || std::is_same<IteratorType, std::string::const_iterator>::value);
+};
+
+template<typename IteratorType>
+struct is_std_contiguous_byte_iterator
+    : is_std_contiguous_byte_iterator_impl<IteratorType, typename std::remove_cv<typename std::iterator_traits<IteratorType>::value_type>::type> {};
+
+template<typename IteratorType>
+struct iterator_input_adapter_factory<IteratorType, IteratorType, enable_if_t<is_std_contiguous_byte_iterator<IteratorType>::value>>
+{
+    using iterator_type = IteratorType;
+    using sentinel_type = IteratorType;
+    using char_type = typename std::remove_cv<typename std::iterator_traits<iterator_type>::value_type>::type;
+    using adapter_type = iterator_input_adapter<const char_type*>;
+
+    static adapter_type create(IteratorType first, IteratorType last)
+    {
+        if (first == last)
+        {
+            // (an empty range must not be dereferenced)
+            return adapter_type(nullptr, nullptr);
+        }
+        const char_type* const begin = std::addressof(*first);
+        return adapter_type(begin, begin + (last - first));
+    }
+};
+
 // General purpose iterator-based input (iterator+sentinel pair; SentinelType
 // defaults to IteratorType for the common same-type case, but may differ for
 // C++20 ranges-style iterator+sentinel pairs). Only enable for types that can
@@ -92,8 +92,12 @@ namespace detail
 character, or not ASCII, 16 bytes per step

 Stops at such a byte, or where fewer than 16 bytes are left (the caller tells
-the two apart). A signed compare with 0x20 finds control characters and
-non-ASCII bytes at once.
+the two apart). One signed compare finds the quote, the control characters and
+the non-ASCII bytes at once: flipping bit 1 maps 0x00-0x1F onto itself and the
+quote (0x22) onto 0x20, keeps 0x80-0xFF negative, and maps every other byte to
+33 or more, so these are exactly the bytes with (int8_t)(c ^ 2) < 33 (see
+D. Lemire, "Detect control characters, quotes and backslashes efficiently
+using SWAR", 2025). The backslash needs its own compare.
 */
 JSON_HEDLEY_ALWAYS_INLINE const unsigned char* vector_plain_run(const unsigned char* p, const unsigned char* e) noexcept
 {
@@ -101,8 +105,8 @@ JSON_HEDLEY_ALWAYS_INLINE const unsigned char* vector_plain_run(const unsigned c
    {
 #if JSON_SCAN_NEON
        const uint8x16_t in = vld1q_u8(p);
-        const uint8x16_t special = vorrq_u8(vorrq_u8(vceqq_u8(in, vdupq_n_u8('"')), vceqq_u8(in, vdupq_n_u8('\\'))),
-                                            vcltq_s8(vreinterpretq_s8_u8(in), vdupq_n_s8(0x20)));
+        const uint8x16_t special = vorrq_u8(vceqq_u8(in, vdupq_n_u8('\\')),
+                                            vcltq_s8(vreinterpretq_s8_u8(veorq_u8(in, vdupq_n_u8(2))), vdupq_n_s8(33)));
        // one nibble per byte (the usual NEON replacement of x86's movemask, see
        // D. Kutenin, "Porting x86 vector bitmask optimizations to Arm NEON", 2022)
        const std::uint64_t bits = vget_lane_u64(vreinterpret_u64_u8(vshrn_n_u16(vreinterpretq_u16_u8(special), 4)), 0);
@@ -112,8 +116,8 @@ JSON_HEDLEY_ALWAYS_INLINE const unsigned char* vector_plain_run(const unsigned c
        }
 #else
        const __m128i in = _mm_loadu_si128(static_cast<const __m128i*>(static_cast<const void*>(p))); // NOLINT(bugprone-casting-through-void)
-        const __m128i special = _mm_or_si128(_mm_or_si128(_mm_cmpeq_epi8(in, _mm_set1_epi8('"')), _mm_cmpeq_epi8(in, _mm_set1_epi8('\\'))),
-                                             _mm_cmplt_epi8(in, _mm_set1_epi8(0x20)));
+        const __m128i special = _mm_or_si128(_mm_cmpeq_epi8(in, _mm_set1_epi8('\\')),
+                                             _mm_cmplt_epi8(_mm_xor_si128(in, _mm_set1_epi8(2)), _mm_set1_epi8(33)));
        const auto bits = static_cast<std::uint64_t>(static_cast<unsigned>(_mm_movemask_epi8(special)));
        if (bits != 0)
        {
@@ -250,7 +254,8 @@ JSON_SCAN_SSSE3_TARGET JSON_HEDLEY_NEVER_INLINE inline bool vector_utf8_run(cons
    while (e - block >= 16)
    {
        const uint8x16_t in = vld1q_u8(block);
-        const uint8x16_t special = vorrq_u8(vorrq_u8(vceqq_u8(in, vdupq_n_u8('"')), vceqq_u8(in, vdupq_n_u8('\\'))), vcltq_u8(in, vdupq_n_u8(0x20)));
+        // the quote and the control characters: (c ^ 2) < 33 (see vector_plain_run())
+        const uint8x16_t special = vorrq_u8(vceqq_u8(in, vdupq_n_u8('\\')), vcltq_u8(veorq_u8(in, vdupq_n_u8(2)), vdupq_n_u8(33)));
        const uint8x16_t prev1 = vextq_u8(prev, in, 15);
        const uint8x16_t sc = vandq_u8(vandq_u8(vqtbl1q_u8(t1h, vshrq_n_u8(prev1, 4)), vqtbl1q_u8(t1l, vandq_u8(prev1, vdupq_n_u8(0x0F)))), vqtbl1q_u8(t2h, vshrq_n_u8(in, 4)));
        const uint8x16_t must23 = vorrq_u8(vqsubq_u8(vextq_u8(prev, in, 14), vdupq_n_u8(0xE0 - 0x80)), vqsubq_u8(vextq_u8(prev, in, 13), vdupq_n_u8(0xF0 - 0x80)));
@@ -290,8 +295,10 @@ JSON_SCAN_SSSE3_TARGET JSON_HEDLEY_NEVER_INLINE inline bool vector_utf8_run(cons
    while (e - block >= 16)
    {
        const __m128i in = _mm_loadu_si128(static_cast<const __m128i*>(static_cast<const void*>(block))); // NOLINT(bugprone-casting-through-void)
-        const __m128i special = _mm_or_si128(_mm_or_si128(_mm_cmpeq_epi8(in, _mm_set1_epi8('"')), _mm_cmpeq_epi8(in, _mm_set1_epi8('\\'))),
-                                             _mm_cmpeq_epi8(_mm_subs_epu8(in, _mm_set1_epi8(0x1F)), zero)); // in < 0x20
+        // the quote and the control characters: (c ^ 2) < 33, that is,
+        // (c ^ 2) - 32 saturates to 0 (see vector_plain_run())
+        const __m128i special = _mm_or_si128(_mm_cmpeq_epi8(in, _mm_set1_epi8('\\')),
+                                             _mm_cmpeq_epi8(_mm_subs_epu8(_mm_xor_si128(in, _mm_set1_epi8(2)), _mm_set1_epi8(32)), zero));
        const __m128i prev1 = _mm_alignr_epi8(in, prev, 15);
        const __m128i sc = _mm_and_si128(_mm_and_si128(_mm_shuffle_epi8(t1h, _mm_and_si128(_mm_srli_epi16(prev1, 4), nibble)),
                                         _mm_shuffle_epi8(t1l, _mm_and_si128(prev1, nibble))),
@@ -58,11 +58,10 @@ inline std::uint64_t swar_string_special(std::uint64_t v) noexcept
    constexpr std::uint64_t high = 0x8080808080808080ull;
    const std::uint64_t q = v ^ 0x2222222222222222ull; // '"'  (0x22)
    const std::uint64_t b = v ^ 0x5C5C5C5C5C5C5C5Cull; // '\\' (0x5C)
-    const std::uint64_t has_quote     = (q - ones) & ~q & high;
-    const std::uint64_t has_backslash = (b - ones) & ~b & high;
-    const std::uint64_t has_control   = (v - 0x2020202020202020ull) & ~v & high; // < 0x20
-    const std::uint64_t has_non_ascii = v & high;                                // >= 0x80
-    return has_quote | has_backslash | has_control | has_non_ascii;
+    // The usual test for a zero byte is (x - ones) & ~x & high. The `& ~x`
+    // only removes bytes from 0x80, and `v & high` flags those anyway, so it
+    // can be dropped. Clang finds this reduction itself; GCC does not.
+    return ((q - ones) | (b - ones) | (v - 0x2020202020202020ull) | v) & high;
 }

 // return the index of the first is_string_special() byte in [data, data+n), or
@@ -143,11 +142,8 @@ inline std::size_t find_ascii_copyable_run(const unsigned char* data, std::size_
        const std::uint64_t q = v ^ 0x2222222222222222ull; // '"'  (0x22)
        const std::uint64_t b = v ^ 0x5C5C5C5C5C5C5C5Cull; // '\\' (0x5C)
        const std::uint64_t d = v ^ 0x7F7F7F7F7F7F7F7Full; // DEL  (0x7F)
-        const std::uint64_t stop = ((q - ones) & ~q & high)   // == '"'
-                                   | ((b - ones) & ~b & high)  // == '\\'
-                                   | ((d - ones) & ~d & high)  // == 0x7F
-                                   | ((v - 0x2020202020202020ull) & ~v & high) // < 0x20
-                                   | (v & high);               // >= 0x80
+        // (see swar_string_special(): the bytes from 0x80 are stops anyway)
+        const std::uint64_t stop = ((q - ones) | (b - ones) | (d - ones) | (v - 0x2020202020202020ull) | v) & high;
        if (stop != 0)
        {
            // the lowest flagged byte is the first one to stop at (see
@@ -1204,20 +1204,27 @@ class binary_writer

            // an optimized array of a valueless type carries no payload, so a
            // reader has nothing but the declared count to bound the allocation
-            // by and refuses an excessive one. Write the unoptimized form for
-            // those, at one byte per element, so the result can be read back.
-            // Objects are not affected: every element is preceded by its key.
-            const bool valueless_type = (first_prefix == 'Z' || first_prefix == 'T' || first_prefix == 'F');
-            const bool excessive_valueless = IsArray
-                                             && valueless_type
-                                             && size > detail::max_valueless_container_size;
-
-            if (same_prefix && !excessive_valueless
-                    && !(use_bjdata && is_bjdata_excluded_type_marker(first_prefix)))
+            // by. It refuses one array of more than max_valueless_container_size
+            // elements, and all such arrays of one input together when they add
+            // up to more than valueless_elements_base plus a number per byte
+            // read. Write the unoptimized form, at one byte per element, for
+            // an array that would exceed the base with the arrays written so
+            // far, so that the result can be read back: the limit of a reader
+            // is never below the base. Objects are not affected: every element
+            // is preceded by its key.
+            if (same_prefix && !(use_bjdata && is_bjdata_excluded_type_marker(first_prefix)))
            {
-                prefix_required = false;
-                oa.write_character(to_char_type('$'));
-                oa.write_character(first_prefix);
+                const bool valueless_type = IsArray && (first_prefix == 'Z' || first_prefix == 'T' || first_prefix == 'F');
+                if (!valueless_type || size <= detail::valueless_elements_base - valueless_elements_written)
+                {
+                    prefix_required = false;
+                    oa.write_character(to_char_type('$'));
+                    oa.write_character(first_prefix);
+                    if (valueless_type)
+                    {
+                        valueless_elements_written += size;
+                    }
+                }
            }
        }

@@ -5441,6 +5448,10 @@ class binary_writer
    /// how to treat a string value or object key that is not valid UTF-8
    /// (CBOR, MessagePack, UBJSON, BJData, and BSON; not BON8)
    const error_handler_t error_handler = binary_writer_default_error_handler();
+
+    /// UBJSON: the number of elements written so far in optimized arrays of a
+    /// valueless type, which a reader adds up and bounds
+    std::size_t valueless_elements_written = 0;
 };

 }  // namespace detail
@@ -724,10 +724,8 @@ class serializer
        constexpr std::uint64_t ones = 0x0101010101010101ull;
        const std::uint64_t q = v ^ 0x2222222222222222ull; // '"'
        const std::uint64_t b = v ^ 0x5C5C5C5C5C5C5C5Cull; // '\\'
-        return (((q - ones) & ~q) | ((b - ones) & ~b)         // == '"', == '\\'
-                | ((v - 0x2020202020202020ull) & ~v)          // < 0x20
-                | v | (v + ones))                             // >= 0x7F
-               & 0x8080808080808080ull;
+        // (see swar_string_special(): the bytes from 0x80 are flagged anyway)
+        return ((q - ones) | (b - ones) | (v - 0x2020202020202020ull) | v | (v + ones)) & 0x8080808080808080ull;
    }

    template<typename WordType>
@@ -836,8 +834,10 @@ class serializer
        const uint8x8_t lo = vld1_u8(reinterpret_cast<const std::uint8_t*>(p));
        const uint8x8_t hi = vld1_u8(reinterpret_cast<const std::uint8_t*>(p + n - 8));
        const uint8x16_t in = vcombine_u8(lo, hi);
-        const uint8x16_t special = vorrq_u8(vorrq_u8(vceqq_u8(in, vdupq_n_u8('"')), vceqq_u8(in, vdupq_n_u8('\\'))),
-                                            vorrq_u8(vcltq_s8(vreinterpretq_s8_u8(in), vdupq_n_s8(0x20)), vceqq_u8(in, vdupq_n_u8(0x7F))));
+        // (int8_t)(c ^ 2) < 33: the quote, the control characters and the
+        // non-ASCII bytes (see vector_plain_run())
+        const uint8x16_t special = vorrq_u8(vorrq_u8(vceqq_u8(in, vdupq_n_u8('\\')), vceqq_u8(in, vdupq_n_u8(0x7F))),
+                                            vcltq_s8(vreinterpretq_s8_u8(veorq_u8(in, vdupq_n_u8(2))), vdupq_n_s8(33)));
        if (vmaxvq_u8(special) != 0)
        {
            return false;
@@ -848,8 +848,8 @@ class serializer
        const __m128i lo = _mm_loadl_epi64(static_cast<const __m128i*>(static_cast<const void*>(p))); // NOLINT(bugprone-casting-through-void)
        const __m128i hi = _mm_loadl_epi64(static_cast<const __m128i*>(static_cast<const void*>(p + n - 8))); // NOLINT(bugprone-casting-through-void)
        const __m128i in = _mm_unpacklo_epi64(lo, hi);
-        const __m128i special = _mm_or_si128(_mm_or_si128(_mm_cmpeq_epi8(in, _mm_set1_epi8('"')), _mm_cmpeq_epi8(in, _mm_set1_epi8('\\'))),
-                                             _mm_or_si128(_mm_cmplt_epi8(in, _mm_set1_epi8(0x20)), _mm_cmpeq_epi8(in, _mm_set1_epi8(0x7F))));
+        const __m128i special = _mm_or_si128(_mm_or_si128(_mm_cmpeq_epi8(in, _mm_set1_epi8('\\')), _mm_cmpeq_epi8(in, _mm_set1_epi8(0x7F))),
+                                             _mm_cmplt_epi8(_mm_xor_si128(in, _mm_set1_epi8(2)), _mm_set1_epi8(33)));
        if (_mm_movemask_epi8(special) != 0)
        {
            return false;
@@ -868,10 +868,13 @@ class serializer
 #if JSON_SCAN_NEON
        const uint8x16_t a = vld1q_u8(reinterpret_cast<const std::uint8_t*>(p));
        const uint8x16_t b = vld1q_u8(reinterpret_cast<const std::uint8_t*>(p + n - 16));
-        const uint8x16_t special = vorrq_u8(vorrq_u8(vorrq_u8(vceqq_u8(a, vdupq_n_u8('"')), vceqq_u8(a, vdupq_n_u8('\\'))),
-                                            vorrq_u8(vceqq_u8(b, vdupq_n_u8('"')), vceqq_u8(b, vdupq_n_u8('\\')))),
-                                            vorrq_u8(vorrq_u8(vcltq_s8(vreinterpretq_s8_u8(a), vdupq_n_s8(0x20)), vcltq_s8(vreinterpretq_s8_u8(b), vdupq_n_s8(0x20))),
-                                                vorrq_u8(vceqq_u8(a, vdupq_n_u8(0x7F)), vceqq_u8(b, vdupq_n_u8(0x7F)))));
+        // (int8_t)(c ^ 2) < 33: the quote, the control characters and the
+        // non-ASCII bytes (see vector_plain_run())
+        const uint8x16_t flip = vdupq_n_u8(2);
+        const int8x16_t limit = vdupq_n_s8(33);
+        const uint8x16_t special = vorrq_u8(vorrq_u8(vorrq_u8(vceqq_u8(a, vdupq_n_u8('\\')), vceqq_u8(b, vdupq_n_u8('\\'))),
+                                            vorrq_u8(vceqq_u8(a, vdupq_n_u8(0x7F)), vceqq_u8(b, vdupq_n_u8(0x7F)))),
+                                            vorrq_u8(vcltq_s8(vreinterpretq_s8_u8(veorq_u8(a, flip)), limit), vcltq_s8(vreinterpretq_s8_u8(veorq_u8(b, flip)), limit)));
        if (vmaxvq_u8(special) != 0)
        {
            return false;
@@ -881,14 +884,15 @@ class serializer
 #else
        const __m128i a = _mm_loadu_si128(static_cast<const __m128i*>(static_cast<const void*>(p))); // NOLINT(bugprone-casting-through-void)
        const __m128i b = _mm_loadu_si128(static_cast<const __m128i*>(static_cast<const void*>(p + n - 16))); // NOLINT(bugprone-casting-through-void)
-        const __m128i quote = _mm_set1_epi8('"');
+        // (int8_t)(c ^ 2) < 33: the quote, the control characters and the
+        // non-ASCII bytes (see vector_plain_run())
        const __m128i backslash = _mm_set1_epi8('\\');
-        const __m128i space = _mm_set1_epi8(0x20);
        const __m128i del = _mm_set1_epi8(0x7F);
-        const __m128i special = _mm_or_si128(_mm_or_si128(_mm_or_si128(_mm_cmpeq_epi8(a, quote), _mm_cmpeq_epi8(a, backslash)),
-                                             _mm_or_si128(_mm_cmpeq_epi8(b, quote), _mm_cmpeq_epi8(b, backslash))),
-                                             _mm_or_si128(_mm_or_si128(_mm_cmplt_epi8(a, space), _mm_cmplt_epi8(b, space)),
-                                                 _mm_or_si128(_mm_cmpeq_epi8(a, del), _mm_cmpeq_epi8(b, del))));
+        const __m128i flip = _mm_set1_epi8(2);
+        const __m128i limit = _mm_set1_epi8(33);
+        const __m128i special = _mm_or_si128(_mm_or_si128(_mm_or_si128(_mm_cmpeq_epi8(a, backslash), _mm_cmpeq_epi8(b, backslash)),
+                                             _mm_or_si128(_mm_cmpeq_epi8(a, del), _mm_cmpeq_epi8(b, del))),
+                                             _mm_or_si128(_mm_cmplt_epi8(_mm_xor_si128(a, flip), limit), _mm_cmplt_epi8(_mm_xor_si128(b, flip), limit)));
        if (_mm_movemask_epi8(special) != 0)
        {
            return false;
@@ -152,9 +152,12 @@ inline std::size_t plain_output_run(const unsigned char* s, std::size_t n) noexc
    for (; i + 16 <= n; i += 16)
    {
        const __m128i in = _mm_loadu_si128(static_cast<const __m128i*>(static_cast<const void*>(s + i))); // NOLINT(bugprone-casting-through-void)
-        // (a byte is below 0x20 if it is its own minimum with 0x1F)
-        const __m128i special = _mm_or_si128(_mm_or_si128(_mm_cmpeq_epi8(in, _mm_set1_epi8('"')), _mm_cmpeq_epi8(in, _mm_set1_epi8('\\'))),
-                                             _mm_cmpeq_epi8(_mm_min_epu8(in, _mm_set1_epi8(0x1F)), in));
+        // the quote and the control characters are the bytes with
+        // (c ^ 2) <= 32, that is, those that are their own minimum with 32
+        // (see vector_plain_run())
+        const __m128i flipped = _mm_xor_si128(in, _mm_set1_epi8(2));
+        const __m128i special = _mm_or_si128(_mm_cmpeq_epi8(in, _mm_set1_epi8('\\')),
+                                             _mm_cmpeq_epi8(_mm_min_epu8(flipped, _mm_set1_epi8(32)), flipped));
        const auto mask = static_cast<std::uint64_t>(static_cast<unsigned>(_mm_movemask_epi8(special)));
        if (mask != 0)
        {
@@ -217,20 +220,21 @@ inline bool is_ascii_without_delete(const char* s, std::size_t n) noexcept

 #if NLOHMANN_VIEW_VECTOR
 /// the bytes of the 16 at p that ensure_ascii cannot copy (a quote, a
-/// backslash, a control character, DEL, or not ASCII; a signed compare with
-/// 0x20 finds control characters and non-ASCII bytes at once), one bit per
-/// byte (x86) or one nibble per byte (NEON)
+/// backslash, a control character, DEL, or not ASCII; the signed compare
+/// (int8_t)(c ^ 2) < 33 finds the quote, the control characters and the
+/// non-ASCII bytes at once, see vector_plain_run()), one bit per byte (x86) or
+/// one nibble per byte (NEON)
 NLOHMANN_VIEW_ALWAYS_INLINE std::uint64_t ascii_stop_mask(const unsigned char* p) noexcept
 {
 #if NLOHMANN_VIEW_NEON
    const uint8x16_t in = vld1q_u8(p);
-    const uint8x16_t special = vorrq_u8(vorrq_u8(vceqq_u8(in, vdupq_n_u8('"')), vceqq_u8(in, vdupq_n_u8('\\'))),
-                                        vorrq_u8(vceqq_u8(in, vdupq_n_u8(0x7F)), vcltq_s8(vreinterpretq_s8_u8(in), vdupq_n_s8(0x20))));
+    const uint8x16_t special = vorrq_u8(vorrq_u8(vceqq_u8(in, vdupq_n_u8('\\')), vceqq_u8(in, vdupq_n_u8(0x7F))),
+                                        vcltq_s8(vreinterpretq_s8_u8(veorq_u8(in, vdupq_n_u8(2))), vdupq_n_s8(33)));
    return vget_lane_u64(vreinterpret_u64_u8(vshrn_n_u16(vreinterpretq_u16_u8(special), 4)), 0);
 #else
    const __m128i in = _mm_loadu_si128(static_cast<const __m128i*>(static_cast<const void*>(p))); // NOLINT(bugprone-casting-through-void)
-    const __m128i special = _mm_or_si128(_mm_or_si128(_mm_cmpeq_epi8(in, _mm_set1_epi8('"')), _mm_cmpeq_epi8(in, _mm_set1_epi8('\\'))),
-                                         _mm_or_si128(_mm_cmpeq_epi8(in, _mm_set1_epi8(0x7F)), _mm_cmplt_epi8(in, _mm_set1_epi8(0x20))));
+    const __m128i special = _mm_or_si128(_mm_or_si128(_mm_cmpeq_epi8(in, _mm_set1_epi8('\\')), _mm_cmpeq_epi8(in, _mm_set1_epi8(0x7F))),
+                                         _mm_cmplt_epi8(_mm_xor_si128(in, _mm_set1_epi8(2)), _mm_set1_epi8(33)));
    return static_cast<std::uint64_t>(static_cast<unsigned>(_mm_movemask_epi8(special)));
 #endif
 }
@@ -393,7 +397,7 @@ struct depth_counter<false>

 /*!
@brief where the double x nearest to a token w * 10^q lies, for 10^15 <= w <
-10^17 and -17 <= q <= -1 (Eisel-Lemire, then a fixed-point position)
+10^17 and -16 <= q <= -1 (Eisel-Lemire, then a fixed-point position)

 dump() writes the shortest decimal in the rounding interval of x (the closest
 one if there are several, see zmij::to_shortest()). Its digits are those of a
@@ -1258,13 +1262,15 @@ class view_serializer
        }
        for (; p != stop && batch.count != float_batch::capacity(); ++p)
        {
-            // a token of the source: 16 or 17 digits, at least 8 after the
-            // point, no exponent, 32 bytes to read
+            // a token of the source: 16 or 17 digits, 8 to 16 after the
+            // point, no exponent, 32 bytes to read (17 after the point, with
+            // no digit before it, only in a damaged image loaded with
+            // image_check::bounds: beyond the range of locate_token())
            const unsigned frac_digits = p->extra >> 8u;
            const unsigned int_digits = p->extra & 0xFFu;
            const unsigned count = int_digits + frac_digits;
            if (p->kind == node_kind::number_float && (p->flags & node_flags::storage) == 0
-                    && count - 16u <= 1u && frac_digits >= 8 && src_end - (src + p->off) >= 33)
+                    && count - 16u <= 1u && frac_digits - 8u <= 8u && src_end - (src + p->off) >= 33)
            {
                const auto* const token = reinterpret_cast<const unsigned char*>(src + p->off); // NOLINT(cppcoreguidelines-pro-type-reinterpret-cast)
                const unsigned sign = token[0] == '-' ? 1 : 0;
@@ -91,8 +91,10 @@ namespace view
 character, or not ASCII, 16 bytes per step

 Stops at such a byte, or where fewer than 16 bytes are left (the caller tells
-the two apart). A signed compare with 0x20 finds control characters and
-non-ASCII bytes at once.
+the two apart). One signed compare finds the quote, the control characters and
+the non-ASCII bytes at once: these are exactly the bytes with
+(int8_t)(c ^ 2) < 33 (see detail::vector_plain_run()). The backslash needs its
+own compare.
 */
 NLOHMANN_VIEW_ALWAYS_INLINE const unsigned char* vector_plain_run(const unsigned char* p, const unsigned char* e) noexcept
 {
@@ -100,8 +102,8 @@ NLOHMANN_VIEW_ALWAYS_INLINE const unsigned char* vector_plain_run(const unsigned
    {
 #if NLOHMANN_VIEW_NEON
        const uint8x16_t in = vld1q_u8(p);
-        const uint8x16_t special = vorrq_u8(vorrq_u8(vceqq_u8(in, vdupq_n_u8('"')), vceqq_u8(in, vdupq_n_u8('\\'))),
-                                            vcltq_s8(vreinterpretq_s8_u8(in), vdupq_n_s8(0x20)));
+        const uint8x16_t special = vorrq_u8(vceqq_u8(in, vdupq_n_u8('\\')),
+                                            vcltq_s8(vreinterpretq_s8_u8(veorq_u8(in, vdupq_n_u8(2))), vdupq_n_s8(33)));
        // one nibble per byte (the usual NEON replacement of x86's movemask, see
        // D. Kutenin, "Porting x86 vector bitmask optimizations to Arm NEON", 2022)
        const std::uint64_t bits = vget_lane_u64(vreinterpret_u64_u8(vshrn_n_u16(vreinterpretq_u16_u8(special), 4)), 0);
@@ -111,8 +113,8 @@ NLOHMANN_VIEW_ALWAYS_INLINE const unsigned char* vector_plain_run(const unsigned
        }
 #else
        const __m128i in = _mm_loadu_si128(static_cast<const __m128i*>(static_cast<const void*>(p))); // NOLINT(bugprone-casting-through-void)
-        const __m128i special = _mm_or_si128(_mm_or_si128(_mm_cmpeq_epi8(in, _mm_set1_epi8('"')), _mm_cmpeq_epi8(in, _mm_set1_epi8('\\'))),
-                                             _mm_cmplt_epi8(in, _mm_set1_epi8(0x20)));
+        const __m128i special = _mm_or_si128(_mm_cmpeq_epi8(in, _mm_set1_epi8('\\')),
+                                             _mm_cmplt_epi8(_mm_xor_si128(in, _mm_set1_epi8(2)), _mm_set1_epi8(33)));
        const auto bits = static_cast<std::uint64_t>(static_cast<unsigned>(_mm_movemask_epi8(special)));
        if (bits != 0)
        {
@@ -138,15 +140,17 @@ NLOHMANN_VIEW_ALWAYS_INLINE unsigned copy_plain_run16(const unsigned char* p, ch
 #if NLOHMANN_VIEW_NEON
    const uint8x16_t in = vld1q_u8(p);
    vst1q_u8(reinterpret_cast<std::uint8_t*>(w), in); // NOLINT(cppcoreguidelines-pro-type-reinterpret-cast)
-    const uint8x16_t special = vorrq_u8(vorrq_u8(vceqq_u8(in, vdupq_n_u8('"')), vceqq_u8(in, vdupq_n_u8('\\'))),
-                                        vcltq_s8(vreinterpretq_s8_u8(in), vdupq_n_s8(0x20)));
+    // (int8_t)(c ^ 2) < 33: the quote, the control characters and the
+    // non-ASCII bytes (see vector_plain_run())
+    const uint8x16_t special = vorrq_u8(vceqq_u8(in, vdupq_n_u8('\\')),
+                                        vcltq_s8(vreinterpretq_s8_u8(veorq_u8(in, vdupq_n_u8(2))), vdupq_n_s8(33)));
    const std::uint64_t bits = vget_lane_u64(vreinterpret_u64_u8(vshrn_n_u16(vreinterpretq_u16_u8(special), 4)), 0);
    return bits != 0 ? static_cast<unsigned>(count_trailing_zeros(bits) >> 2u) : 16u;
 #else
    const __m128i in = _mm_loadu_si128(static_cast<const __m128i*>(static_cast<const void*>(p))); // NOLINT(bugprone-casting-through-void)
    _mm_storeu_si128(static_cast<__m128i*>(static_cast<void*>(w)), in); // NOLINT(bugprone-casting-through-void)
-    const __m128i special = _mm_or_si128(_mm_or_si128(_mm_cmpeq_epi8(in, _mm_set1_epi8('"')), _mm_cmpeq_epi8(in, _mm_set1_epi8('\\'))),
-                                         _mm_cmplt_epi8(in, _mm_set1_epi8(0x20)));
+    const __m128i special = _mm_or_si128(_mm_cmpeq_epi8(in, _mm_set1_epi8('\\')),
+                                         _mm_cmplt_epi8(_mm_xor_si128(in, _mm_set1_epi8(2)), _mm_set1_epi8(33)));
    const auto bits = static_cast<std::uint64_t>(static_cast<unsigned>(_mm_movemask_epi8(special)));
    return bits != 0 ? static_cast<unsigned>(count_trailing_zeros(bits)) : 16u;
 #endif
@@ -306,7 +310,8 @@ NLOHMANN_VIEW_SSSE3_TARGET NLOHMANN_VIEW_NOINLINE NLOHMANN_VIEW_NOCLONE inline c
    while (e - block >= 16)
    {
        const uint8x16_t in = vld1q_u8(block);
-        const uint8x16_t special = vorrq_u8(vorrq_u8(vceqq_u8(in, vdupq_n_u8('"')), vceqq_u8(in, vdupq_n_u8('\\'))), vcltq_u8(in, vdupq_n_u8(0x20)));
+        // the quote and the control characters: (c ^ 2) < 33 (see vector_plain_run())
+        const uint8x16_t special = vorrq_u8(vceqq_u8(in, vdupq_n_u8('\\')), vcltq_u8(veorq_u8(in, vdupq_n_u8(2)), vdupq_n_u8(33)));
        const uint8x16_t prev1 = vextq_u8(prev, in, 15);
        const uint8x16_t sc = vandq_u8(vandq_u8(vqtbl1q_u8(t1h, vshrq_n_u8(prev1, 4)), vqtbl1q_u8(t1l, vandq_u8(prev1, vdupq_n_u8(0x0F)))), vqtbl1q_u8(t2h, vshrq_n_u8(in, 4)));
        const uint8x16_t must23 = vorrq_u8(vqsubq_u8(vextq_u8(prev, in, 14), vdupq_n_u8(0xE0 - 0x80)), vqsubq_u8(vextq_u8(prev, in, 13), vdupq_n_u8(0xF0 - 0x80)));
@@ -345,8 +350,10 @@ NLOHMANN_VIEW_SSSE3_TARGET NLOHMANN_VIEW_NOINLINE NLOHMANN_VIEW_NOCLONE inline c
    while (e - block >= 16)
    {
        const __m128i in = _mm_loadu_si128(static_cast<const __m128i*>(static_cast<const void*>(block))); // NOLINT(bugprone-casting-through-void)
-        const __m128i special = _mm_or_si128(_mm_or_si128(_mm_cmpeq_epi8(in, _mm_set1_epi8('"')), _mm_cmpeq_epi8(in, _mm_set1_epi8('\\'))),
-                                             _mm_cmpeq_epi8(_mm_subs_epu8(in, _mm_set1_epi8(0x1F)), zero)); // in < 0x20
+        // the quote and the control characters: (c ^ 2) < 33, that is,
+        // (c ^ 2) - 32 saturates to 0 (see vector_plain_run())
+        const __m128i special = _mm_or_si128(_mm_cmpeq_epi8(in, _mm_set1_epi8('\\')),
+                                             _mm_cmpeq_epi8(_mm_subs_epu8(_mm_xor_si128(in, _mm_set1_epi8(2)), _mm_set1_epi8(32)), zero));
        const __m128i prev1 = _mm_alignr_epi8(in, prev, 15);
        const __m128i sc = _mm_and_si128(_mm_and_si128(_mm_shuffle_epi8(t1h, _mm_and_si128(_mm_srli_epi16(prev1, 4), nibble)),
                                         _mm_shuffle_epi8(t1l, _mm_and_si128(prev1, nibble))),
@@ -10457,6 +10457,64 @@ struct iterator_input_adapter_factory<IteratorType, SentinelType, enable_if_t<is
    }
 };

+/*!
+@brief whether @a IteratorType is an iterator of std::string or of a
+       std::vector of 1-byte elements
+
+Their elements are contiguous, but before C++20 that cannot be detected from
+the iterator type (std::contiguous_iterator), so an iterator pair of them would
+be read one character at a time through the iterators. They are read as the
+pointer range they are instead, as the containers themselves are (see the
+container overload of input_adapter()). The types are matched exactly, so no
+other iterator can be mistaken for one. (std::basic_string is only matched for
+char: other character types need std::char_traits specializations that the
+standard library need not have.)
+*/
+template<typename CharType>
+struct is_byte_char_type
+{
+    // a member, not an integral_constant argument, which astyle misformats
+    static constexpr bool value = sizeof(CharType) == 1 && std::is_integral<CharType>::value && !std::is_same<CharType, bool>::value;
+};
+
+template<typename IteratorType, typename CharType, bool IsByte = is_byte_char_type<CharType>::value>
+struct is_std_contiguous_byte_iterator_impl : std::false_type {};
+
+// (the containers are only named for byte types)
+template<typename IteratorType, typename CharType>
+struct is_std_contiguous_byte_iterator_impl<IteratorType, CharType, true>
+{
+    static constexpr bool value = !std::is_pointer<IteratorType>::value
+                                  && (std::is_same<IteratorType, typename std::vector<CharType>::iterator>::value
+                                      || std::is_same<IteratorType, typename std::vector<CharType>::const_iterator>::value
+                                      || std::is_same<IteratorType, std::string::iterator>::value
+                                      || std::is_same<IteratorType, std::string::const_iterator>::value);
+};
+
+template<typename IteratorType>
+struct is_std_contiguous_byte_iterator
+    : is_std_contiguous_byte_iterator_impl<IteratorType, typename std::remove_cv<typename std::iterator_traits<IteratorType>::value_type>::type> {};
+
+template<typename IteratorType>
+struct iterator_input_adapter_factory<IteratorType, IteratorType, enable_if_t<is_std_contiguous_byte_iterator<IteratorType>::value>>
+{
+    using iterator_type = IteratorType;
+    using sentinel_type = IteratorType;
+    using char_type = typename std::remove_cv<typename std::iterator_traits<iterator_type>::value_type>::type;
+    using adapter_type = iterator_input_adapter<const char_type*>;
+
+    static adapter_type create(IteratorType first, IteratorType last)
+    {
+        if (first == last)
+        {
+            // (an empty range must not be dereferenced)
+            return adapter_type(nullptr, nullptr);
+        }
+        const char_type* const begin = std::addressof(*first);
+        return adapter_type(begin, begin + (last - first));
+    }
+};
+
 // General purpose iterator-based input (iterator+sentinel pair; SentinelType
 // defaults to IteratorType for the common same-type case, but may differ for
 // C++20 ranges-style iterator+sentinel pairs). Only enable for types that can
@@ -12361,8 +12419,12 @@ namespace detail
 character, or not ASCII, 16 bytes per step

 Stops at such a byte, or where fewer than 16 bytes are left (the caller tells
-the two apart). A signed compare with 0x20 finds control characters and
-non-ASCII bytes at once.
+the two apart). One signed compare finds the quote, the control characters and
+the non-ASCII bytes at once: flipping bit 1 maps 0x00-0x1F onto itself and the
+quote (0x22) onto 0x20, keeps 0x80-0xFF negative, and maps every other byte to
+33 or more, so these are exactly the bytes with (int8_t)(c ^ 2) < 33 (see
+D. Lemire, "Detect control characters, quotes and backslashes efficiently
+using SWAR", 2025). The backslash needs its own compare.
 */
 JSON_HEDLEY_ALWAYS_INLINE const unsigned char* vector_plain_run(const unsigned char* p, const unsigned char* e) noexcept
 {
@@ -12370,8 +12432,8 @@ JSON_HEDLEY_ALWAYS_INLINE const unsigned char* vector_plain_run(const unsigned c
    {
 #if JSON_SCAN_NEON
        const uint8x16_t in = vld1q_u8(p);
-        const uint8x16_t special = vorrq_u8(vorrq_u8(vceqq_u8(in, vdupq_n_u8('"')), vceqq_u8(in, vdupq_n_u8('\\'))),
-                                            vcltq_s8(vreinterpretq_s8_u8(in), vdupq_n_s8(0x20)));
+        const uint8x16_t special = vorrq_u8(vceqq_u8(in, vdupq_n_u8('\\')),
+                                            vcltq_s8(vreinterpretq_s8_u8(veorq_u8(in, vdupq_n_u8(2))), vdupq_n_s8(33)));
        // one nibble per byte (the usual NEON replacement of x86's movemask, see
        // D. Kutenin, "Porting x86 vector bitmask optimizations to Arm NEON", 2022)
        const std::uint64_t bits = vget_lane_u64(vreinterpret_u64_u8(vshrn_n_u16(vreinterpretq_u16_u8(special), 4)), 0);
@@ -12381,8 +12443,8 @@ JSON_HEDLEY_ALWAYS_INLINE const unsigned char* vector_plain_run(const unsigned c
        }
 #else
        const __m128i in = _mm_loadu_si128(static_cast<const __m128i*>(static_cast<const void*>(p))); // NOLINT(bugprone-casting-through-void)
-        const __m128i special = _mm_or_si128(_mm_or_si128(_mm_cmpeq_epi8(in, _mm_set1_epi8('"')), _mm_cmpeq_epi8(in, _mm_set1_epi8('\\'))),
-                                             _mm_cmplt_epi8(in, _mm_set1_epi8(0x20)));
+        const __m128i special = _mm_or_si128(_mm_cmpeq_epi8(in, _mm_set1_epi8('\\')),
+                                             _mm_cmplt_epi8(_mm_xor_si128(in, _mm_set1_epi8(2)), _mm_set1_epi8(33)));
        const auto bits = static_cast<std::uint64_t>(static_cast<unsigned>(_mm_movemask_epi8(special)));
        if (bits != 0)
        {
@@ -12519,7 +12581,8 @@ JSON_SCAN_SSSE3_TARGET JSON_HEDLEY_NEVER_INLINE inline bool vector_utf8_run(cons
    while (e - block >= 16)
    {
        const uint8x16_t in = vld1q_u8(block);
-        const uint8x16_t special = vorrq_u8(vorrq_u8(vceqq_u8(in, vdupq_n_u8('"')), vceqq_u8(in, vdupq_n_u8('\\'))), vcltq_u8(in, vdupq_n_u8(0x20)));
+        // the quote and the control characters: (c ^ 2) < 33 (see vector_plain_run())
+        const uint8x16_t special = vorrq_u8(vceqq_u8(in, vdupq_n_u8('\\')), vcltq_u8(veorq_u8(in, vdupq_n_u8(2)), vdupq_n_u8(33)));
        const uint8x16_t prev1 = vextq_u8(prev, in, 15);
        const uint8x16_t sc = vandq_u8(vandq_u8(vqtbl1q_u8(t1h, vshrq_n_u8(prev1, 4)), vqtbl1q_u8(t1l, vandq_u8(prev1, vdupq_n_u8(0x0F)))), vqtbl1q_u8(t2h, vshrq_n_u8(in, 4)));
        const uint8x16_t must23 = vorrq_u8(vqsubq_u8(vextq_u8(prev, in, 14), vdupq_n_u8(0xE0 - 0x80)), vqsubq_u8(vextq_u8(prev, in, 13), vdupq_n_u8(0xF0 - 0x80)));
@@ -12559,8 +12622,10 @@ JSON_SCAN_SSSE3_TARGET JSON_HEDLEY_NEVER_INLINE inline bool vector_utf8_run(cons
    while (e - block >= 16)
    {
        const __m128i in = _mm_loadu_si128(static_cast<const __m128i*>(static_cast<const void*>(block))); // NOLINT(bugprone-casting-through-void)
-        const __m128i special = _mm_or_si128(_mm_or_si128(_mm_cmpeq_epi8(in, _mm_set1_epi8('"')), _mm_cmpeq_epi8(in, _mm_set1_epi8('\\'))),
-                                             _mm_cmpeq_epi8(_mm_subs_epu8(in, _mm_set1_epi8(0x1F)), zero)); // in < 0x20
+        // the quote and the control characters: (c ^ 2) < 33, that is,
+        // (c ^ 2) - 32 saturates to 0 (see vector_plain_run())
+        const __m128i special = _mm_or_si128(_mm_cmpeq_epi8(in, _mm_set1_epi8('\\')),
+                                             _mm_cmpeq_epi8(_mm_subs_epu8(_mm_xor_si128(in, _mm_set1_epi8(2)), _mm_set1_epi8(32)), zero));
        const __m128i prev1 = _mm_alignr_epi8(in, prev, 15);
        const __m128i sc = _mm_and_si128(_mm_and_si128(_mm_shuffle_epi8(t1h, _mm_and_si128(_mm_srli_epi16(prev1, 4), nibble)),
                                         _mm_shuffle_epi8(t1l, _mm_and_si128(prev1, nibble))),
@@ -12712,11 +12777,10 @@ inline std::uint64_t swar_string_special(std::uint64_t v) noexcept
    constexpr std::uint64_t high = 0x8080808080808080ull;
    const std::uint64_t q = v ^ 0x2222222222222222ull; // '"'  (0x22)
    const std::uint64_t b = v ^ 0x5C5C5C5C5C5C5C5Cull; // '\\' (0x5C)
-    const std::uint64_t has_quote     = (q - ones) & ~q & high;
-    const std::uint64_t has_backslash = (b - ones) & ~b & high;
-    const std::uint64_t has_control   = (v - 0x2020202020202020ull) & ~v & high; // < 0x20
-    const std::uint64_t has_non_ascii = v & high;                                // >= 0x80
-    return has_quote | has_backslash | has_control | has_non_ascii;
+    // The usual test for a zero byte is (x - ones) & ~x & high. The `& ~x`
+    // only removes bytes from 0x80, and `v & high` flags those anyway, so it
+    // can be dropped. Clang finds this reduction itself; GCC does not.
+    return ((q - ones) | (b - ones) | (v - 0x2020202020202020ull) | v) & high;
 }

 // return the index of the first is_string_special() byte in [data, data+n), or
@@ -12797,11 +12861,8 @@ inline std::size_t find_ascii_copyable_run(const unsigned char* data, std::size_
        const std::uint64_t q = v ^ 0x2222222222222222ull; // '"'  (0x22)
        const std::uint64_t b = v ^ 0x5C5C5C5C5C5C5C5Cull; // '\\' (0x5C)
        const std::uint64_t d = v ^ 0x7F7F7F7F7F7F7F7Full; // DEL  (0x7F)
-        const std::uint64_t stop = ((q - ones) & ~q & high)   // == '"'
-                                   | ((b - ones) & ~b & high)  // == '\\'
-                                   | ((d - ones) & ~d & high)  // == 0x7F
-                                   | ((v - 0x2020202020202020ull) & ~v & high) // < 0x20
-                                   | (v & high);               // >= 0x80
+        // (see swar_string_special(): the bytes from 0x80 are stops anyway)
+        const std::uint64_t stop = ((q - ones) | (b - ones) | (d - ones) | (v - 0x2020202020202020ull) | v) & high;
        if (stop != 0)
        {
            // the lowest flagged byte is the first one to stop at (see
@@ -18291,13 +18352,46 @@ the input.

 This is a sanity bound rather than a security boundary, and it is far above
 any container met in practice. @ref binary_writer falls back to the
-unoptimized encoding for longer containers, so that a value serialized by
-this library can always be read back.
+unoptimized encoding for longer containers, and for containers that together
+with the ones before them would exceed @ref valueless_elements_base, so that a
+value serialized by this library can always be read back.

@sa https://github.com/nlohmann/json/issues/2793
 */
 JSON_INLINE_VARIABLE constexpr std::size_t max_valueless_container_size = 1 << 20;

+/*!
+@brief number of elements of valueless UBJSON containers accepted on top of
+       @ref valueless_elements_per_byte
+
+The limit @ref max_valueless_container_size applies to each container on its
+own, so on its own it lets 9 bytes announce 1048576 values, and every further
+9 bytes another 1048576. The elements of all containers of a valueless type
+in one input are therefore added up, and the sum must stay below this base
+plus @ref valueless_elements_per_byte for every byte read so far. The base is
+the per-container limit, so a container that was accepted on its own before
+the sum was introduced is still accepted at the start of an input.
+*/
+JSON_INLINE_VARIABLE constexpr std::size_t valueless_elements_base = max_valueless_container_size;
+
+/*!
+@brief number of elements of valueless UBJSON containers accepted per byte of
+       input, in addition to @ref valueless_elements_base
+
+An element of a value that has a payload costs at least one byte of input.
+Valueless elements are accepted at a rate of 4 per byte. A value takes 16
+bytes of memory in a DOM, so these arrays add about 80 bytes of memory per
+byte of input (measured: 77; one `Z` per byte needs about 32), beyond what the
+same bytes cost anyway, plus the base. This bounds the arrays of valueless
+type, not the memory of a whole document. Containers written by
+@ref binary_writer never need more than the base, because it writes an array
+in the unoptimized form once the typed arrays written so far and this one add
+up to more than that. The rate matters for input written by other encoders and
+by versions before 3.13.0 only; in the data this was measured on, no input has
+more than 0.17 elements per byte.
+*/
+JSON_INLINE_VARIABLE constexpr std::size_t valueless_elements_per_byte = 4;
+
 ///////////////////
 // binary reader //
 ///////////////////
@@ -21918,6 +22012,37 @@ class binary_reader
        return emit_unsigned(number);
    }

+    /*!
+    @brief add the elements of a container of a valueless type to the total of
+           the input and check the total against the input read so far
+
+    A container of type 'Z', 'T' or 'F' has no payload, so its elements are the
+    only ones for which the input does not bound the count. The check is made
+    once per container, not per element.
+
+    @param[in] count  number of elements the container declares; at most
+                      @ref max_valueless_container_size
+    @return false if the total is more than @ref valueless_elements_base plus
+            @ref valueless_elements_per_byte for every byte read so far; the
+            total is not changed then
+    */
+    bool charge_valueless_elements(const std::size_t count) noexcept
+    {
+        // the limit saturates instead of overflowing when size_t is 32 bits
+        // wide and a very large input has been read; valueless_elements
+        // never exceeds the limit, so the difference cannot underflow
+        constexpr std::size_t max_size = (std::numeric_limits<std::size_t>::max)();
+        const std::size_t limit = chars_read <= (max_size - valueless_elements_base) / valueless_elements_per_byte
+                                  ? valueless_elements_base + (valueless_elements_per_byte * chars_read)
+                                  : max_size;
+        if (JSON_HEDLEY_UNLIKELY(count > limit - valueless_elements))
+        {
+            return false;
+        }
+        valueless_elements += count;
+        return true;
+    }
+
    /*!
    @return whether array creation completed
    */
@@ -22003,24 +22128,27 @@ class binary_reader
            // declared count alone decides how much is allocated; the check is
            // made before the start event so that no container is opened that
            // is then abandoned. See @ref max_valueless_container_size.
-            if (JSON_HEDLEY_UNLIKELY((size_and_type.second == 'Z' || size_and_type.second == 'T' || size_and_type.second == 'F')
-                                     && size_and_type.first > max_valueless_container_size))
+            if (JSON_HEDLEY_UNLIKELY(size_and_type.second == 'Z' || size_and_type.second == 'T' || size_and_type.second == 'F'))
            {
-                return out_of_range_error(exception_id::container_too_large, "excessive array size", "size");
+                if (JSON_HEDLEY_UNLIKELY(size_and_type.first > max_valueless_container_size))
+                {
+                    return out_of_range_error(exception_id::container_too_large, "excessive array size", "size");
+                }
+                if (JSON_HEDLEY_UNLIKELY(!charge_valueless_elements(size_and_type.first)))
+                {
+                    return out_of_range_error(exception_id::container_too_large, "excessive number of elements without payload", "size");
+                }
            }

-            if (JSON_HEDLEY_UNLIKELY(!enter_array(size_and_type.first, size_and_type.second)))
+            // a no-op is not a value, so an array of them is empty whatever
+            // count it declares: the SAX parser is told so, instead of being
+            // made to reserve storage for a count that no input backs
+            const std::size_t announced = size_and_type.second == 'N' ? 0 : size_and_type.first;
+            if (JSON_HEDLEY_UNLIKELY(!enter_array(announced, size_and_type.second)))
            {
                return false;
            }

-            if (size_and_type.second == 'N')
-            {
-                // a no-op is not a value, so a container of them holds none;
-                // the declared size has already been passed to the SAX parser
-                container_stack.back().remaining = 0;
-            }
-
            return size_and_type.second == 0
                   || parse_ubjson_typed_run(container_stack.back().remaining, size_and_type.second, std::integral_constant<bool, bulk_scan> {});
        }
@@ -23332,6 +23460,10 @@ class binary_reader
    /// the number of characters read
    std::size_t chars_read = 0;

+    /// UBJSON: the sum of the element counts of the containers of a valueless
+    /// type read so far; see @ref charge_valueless_elements
+    std::size_t valueless_elements = 0;
+
    /// whether we can assume little endianness
    const bool is_little_endian = little_endianness();

@@ -30485,20 +30617,27 @@ class binary_writer

            // an optimized array of a valueless type carries no payload, so a
            // reader has nothing but the declared count to bound the allocation
-            // by and refuses an excessive one. Write the unoptimized form for
-            // those, at one byte per element, so the result can be read back.
-            // Objects are not affected: every element is preceded by its key.
-            const bool valueless_type = (first_prefix == 'Z' || first_prefix == 'T' || first_prefix == 'F');
-            const bool excessive_valueless = IsArray
-                                             && valueless_type
-                                             && size > detail::max_valueless_container_size;
-
-            if (same_prefix && !excessive_valueless
-                    && !(use_bjdata && is_bjdata_excluded_type_marker(first_prefix)))
+            // by. It refuses one array of more than max_valueless_container_size
+            // elements, and all such arrays of one input together when they add
+            // up to more than valueless_elements_base plus a number per byte
+            // read. Write the unoptimized form, at one byte per element, for
+            // an array that would exceed the base with the arrays written so
+            // far, so that the result can be read back: the limit of a reader
+            // is never below the base. Objects are not affected: every element
+            // is preceded by its key.
+            if (same_prefix && !(use_bjdata && is_bjdata_excluded_type_marker(first_prefix)))
            {
-                prefix_required = false;
-                oa.write_character(to_char_type('$'));
-                oa.write_character(first_prefix);
+                const bool valueless_type = IsArray && (first_prefix == 'Z' || first_prefix == 'T' || first_prefix == 'F');
+                if (!valueless_type || size <= detail::valueless_elements_base - valueless_elements_written)
+                {
+                    prefix_required = false;
+                    oa.write_character(to_char_type('$'));
+                    oa.write_character(first_prefix);
+                    if (valueless_type)
+                    {
+                        valueless_elements_written += size;
+                    }
+                }
            }
        }

@@ -34722,6 +34861,10 @@ class binary_writer
    /// how to treat a string value or object key that is not valid UTF-8
    /// (CBOR, MessagePack, UBJSON, BJData, and BSON; not BON8)
    const error_handler_t error_handler = binary_writer_default_error_handler();
+
+    /// UBJSON: the number of elements written so far in optimized arrays of a
+    /// valueless type, which a reader adds up and bounds
+    std::size_t valueless_elements_written = 0;
 };

 }  // namespace detail
@@ -37238,10 +37381,8 @@ class serializer
        constexpr std::uint64_t ones = 0x0101010101010101ull;
        const std::uint64_t q = v ^ 0x2222222222222222ull; // '"'
        const std::uint64_t b = v ^ 0x5C5C5C5C5C5C5C5Cull; // '\\'
-        return (((q - ones) & ~q) | ((b - ones) & ~b)         // == '"', == '\\'
-                | ((v - 0x2020202020202020ull) & ~v)          // < 0x20
-                | v | (v + ones))                             // >= 0x7F
-               & 0x8080808080808080ull;
+        // (see swar_string_special(): the bytes from 0x80 are flagged anyway)
+        return ((q - ones) | (b - ones) | (v - 0x2020202020202020ull) | v | (v + ones)) & 0x8080808080808080ull;
    }

    template<typename WordType>
@@ -37350,8 +37491,10 @@ class serializer
        const uint8x8_t lo = vld1_u8(reinterpret_cast<const std::uint8_t*>(p));
        const uint8x8_t hi = vld1_u8(reinterpret_cast<const std::uint8_t*>(p + n - 8));
        const uint8x16_t in = vcombine_u8(lo, hi);
-        const uint8x16_t special = vorrq_u8(vorrq_u8(vceqq_u8(in, vdupq_n_u8('"')), vceqq_u8(in, vdupq_n_u8('\\'))),
-                                            vorrq_u8(vcltq_s8(vreinterpretq_s8_u8(in), vdupq_n_s8(0x20)), vceqq_u8(in, vdupq_n_u8(0x7F))));
+        // (int8_t)(c ^ 2) < 33: the quote, the control characters and the
+        // non-ASCII bytes (see vector_plain_run())
+        const uint8x16_t special = vorrq_u8(vorrq_u8(vceqq_u8(in, vdupq_n_u8('\\')), vceqq_u8(in, vdupq_n_u8(0x7F))),
+                                            vcltq_s8(vreinterpretq_s8_u8(veorq_u8(in, vdupq_n_u8(2))), vdupq_n_s8(33)));
        if (vmaxvq_u8(special) != 0)
        {
            return false;
@@ -37362,8 +37505,8 @@ class serializer
        const __m128i lo = _mm_loadl_epi64(static_cast<const __m128i*>(static_cast<const void*>(p))); // NOLINT(bugprone-casting-through-void)
        const __m128i hi = _mm_loadl_epi64(static_cast<const __m128i*>(static_cast<const void*>(p + n - 8))); // NOLINT(bugprone-casting-through-void)
        const __m128i in = _mm_unpacklo_epi64(lo, hi);
-        const __m128i special = _mm_or_si128(_mm_or_si128(_mm_cmpeq_epi8(in, _mm_set1_epi8('"')), _mm_cmpeq_epi8(in, _mm_set1_epi8('\\'))),
-                                             _mm_or_si128(_mm_cmplt_epi8(in, _mm_set1_epi8(0x20)), _mm_cmpeq_epi8(in, _mm_set1_epi8(0x7F))));
+        const __m128i special = _mm_or_si128(_mm_or_si128(_mm_cmpeq_epi8(in, _mm_set1_epi8('\\')), _mm_cmpeq_epi8(in, _mm_set1_epi8(0x7F))),
+                                             _mm_cmplt_epi8(_mm_xor_si128(in, _mm_set1_epi8(2)), _mm_set1_epi8(33)));
        if (_mm_movemask_epi8(special) != 0)
        {
            return false;
@@ -37382,10 +37525,13 @@ class serializer
 #if JSON_SCAN_NEON
        const uint8x16_t a = vld1q_u8(reinterpret_cast<const std::uint8_t*>(p));
        const uint8x16_t b = vld1q_u8(reinterpret_cast<const std::uint8_t*>(p + n - 16));
-        const uint8x16_t special = vorrq_u8(vorrq_u8(vorrq_u8(vceqq_u8(a, vdupq_n_u8('"')), vceqq_u8(a, vdupq_n_u8('\\'))),
-                                            vorrq_u8(vceqq_u8(b, vdupq_n_u8('"')), vceqq_u8(b, vdupq_n_u8('\\')))),
-                                            vorrq_u8(vorrq_u8(vcltq_s8(vreinterpretq_s8_u8(a), vdupq_n_s8(0x20)), vcltq_s8(vreinterpretq_s8_u8(b), vdupq_n_s8(0x20))),
-                                                vorrq_u8(vceqq_u8(a, vdupq_n_u8(0x7F)), vceqq_u8(b, vdupq_n_u8(0x7F)))));
+        // (int8_t)(c ^ 2) < 33: the quote, the control characters and the
+        // non-ASCII bytes (see vector_plain_run())
+        const uint8x16_t flip = vdupq_n_u8(2);
+        const int8x16_t limit = vdupq_n_s8(33);
+        const uint8x16_t special = vorrq_u8(vorrq_u8(vorrq_u8(vceqq_u8(a, vdupq_n_u8('\\')), vceqq_u8(b, vdupq_n_u8('\\'))),
+                                            vorrq_u8(vceqq_u8(a, vdupq_n_u8(0x7F)), vceqq_u8(b, vdupq_n_u8(0x7F)))),
+                                            vorrq_u8(vcltq_s8(vreinterpretq_s8_u8(veorq_u8(a, flip)), limit), vcltq_s8(vreinterpretq_s8_u8(veorq_u8(b, flip)), limit)));
        if (vmaxvq_u8(special) != 0)
        {
            return false;
@@ -37395,14 +37541,15 @@ class serializer
 #else
        const __m128i a = _mm_loadu_si128(static_cast<const __m128i*>(static_cast<const void*>(p))); // NOLINT(bugprone-casting-through-void)
        const __m128i b = _mm_loadu_si128(static_cast<const __m128i*>(static_cast<const void*>(p + n - 16))); // NOLINT(bugprone-casting-through-void)
-        const __m128i quote = _mm_set1_epi8('"');
+        // (int8_t)(c ^ 2) < 33: the quote, the control characters and the
+        // non-ASCII bytes (see vector_plain_run())
        const __m128i backslash = _mm_set1_epi8('\\');
-        const __m128i space = _mm_set1_epi8(0x20);
        const __m128i del = _mm_set1_epi8(0x7F);
-        const __m128i special = _mm_or_si128(_mm_or_si128(_mm_or_si128(_mm_cmpeq_epi8(a, quote), _mm_cmpeq_epi8(a, backslash)),
-                                             _mm_or_si128(_mm_cmpeq_epi8(b, quote), _mm_cmpeq_epi8(b, backslash))),
-                                             _mm_or_si128(_mm_or_si128(_mm_cmplt_epi8(a, space), _mm_cmplt_epi8(b, space)),
-                                                 _mm_or_si128(_mm_cmpeq_epi8(a, del), _mm_cmpeq_epi8(b, del))));
+        const __m128i flip = _mm_set1_epi8(2);
+        const __m128i limit = _mm_set1_epi8(33);
+        const __m128i special = _mm_or_si128(_mm_or_si128(_mm_or_si128(_mm_cmpeq_epi8(a, backslash), _mm_cmpeq_epi8(b, backslash)),
+                                             _mm_or_si128(_mm_cmpeq_epi8(a, del), _mm_cmpeq_epi8(b, del))),
+                                             _mm_or_si128(_mm_cmplt_epi8(_mm_xor_si128(a, flip), limit), _mm_cmplt_epi8(_mm_xor_si128(b, flip), limit)));
        if (_mm_movemask_epi8(special) != 0)
        {
            return false;
@@ -759,8 +759,10 @@ namespace view
 character, or not ASCII, 16 bytes per step

 Stops at such a byte, or where fewer than 16 bytes are left (the caller tells
-the two apart). A signed compare with 0x20 finds control characters and
-non-ASCII bytes at once.
+the two apart). One signed compare finds the quote, the control characters and
+the non-ASCII bytes at once: these are exactly the bytes with
+(int8_t)(c ^ 2) < 33 (see detail::vector_plain_run()). The backslash needs its
+own compare.
 */
 NLOHMANN_VIEW_ALWAYS_INLINE const unsigned char* vector_plain_run(const unsigned char* p, const unsigned char* e) noexcept
 {
@@ -768,8 +770,8 @@ NLOHMANN_VIEW_ALWAYS_INLINE const unsigned char* vector_plain_run(const unsigned
    {
 #if NLOHMANN_VIEW_NEON
        const uint8x16_t in = vld1q_u8(p);
-        const uint8x16_t special = vorrq_u8(vorrq_u8(vceqq_u8(in, vdupq_n_u8('"')), vceqq_u8(in, vdupq_n_u8('\\'))),
-                                            vcltq_s8(vreinterpretq_s8_u8(in), vdupq_n_s8(0x20)));
+        const uint8x16_t special = vorrq_u8(vceqq_u8(in, vdupq_n_u8('\\')),
+                                            vcltq_s8(vreinterpretq_s8_u8(veorq_u8(in, vdupq_n_u8(2))), vdupq_n_s8(33)));
        // one nibble per byte (the usual NEON replacement of x86's movemask, see
        // D. Kutenin, "Porting x86 vector bitmask optimizations to Arm NEON", 2022)
        const std::uint64_t bits = vget_lane_u64(vreinterpret_u64_u8(vshrn_n_u16(vreinterpretq_u16_u8(special), 4)), 0);
@@ -779,8 +781,8 @@ NLOHMANN_VIEW_ALWAYS_INLINE const unsigned char* vector_plain_run(const unsigned
        }
 #else
        const __m128i in = _mm_loadu_si128(static_cast<const __m128i*>(static_cast<const void*>(p))); // NOLINT(bugprone-casting-through-void)
-        const __m128i special = _mm_or_si128(_mm_or_si128(_mm_cmpeq_epi8(in, _mm_set1_epi8('"')), _mm_cmpeq_epi8(in, _mm_set1_epi8('\\'))),
-                                             _mm_cmplt_epi8(in, _mm_set1_epi8(0x20)));
+        const __m128i special = _mm_or_si128(_mm_cmpeq_epi8(in, _mm_set1_epi8('\\')),
+                                             _mm_cmplt_epi8(_mm_xor_si128(in, _mm_set1_epi8(2)), _mm_set1_epi8(33)));
        const auto bits = static_cast<std::uint64_t>(static_cast<unsigned>(_mm_movemask_epi8(special)));
        if (bits != 0)
        {
@@ -806,15 +808,17 @@ NLOHMANN_VIEW_ALWAYS_INLINE unsigned copy_plain_run16(const unsigned char* p, ch
 #if NLOHMANN_VIEW_NEON
    const uint8x16_t in = vld1q_u8(p);
    vst1q_u8(reinterpret_cast<std::uint8_t*>(w), in); // NOLINT(cppcoreguidelines-pro-type-reinterpret-cast)
-    const uint8x16_t special = vorrq_u8(vorrq_u8(vceqq_u8(in, vdupq_n_u8('"')), vceqq_u8(in, vdupq_n_u8('\\'))),
-                                        vcltq_s8(vreinterpretq_s8_u8(in), vdupq_n_s8(0x20)));
+    // (int8_t)(c ^ 2) < 33: the quote, the control characters and the
+    // non-ASCII bytes (see vector_plain_run())
+    const uint8x16_t special = vorrq_u8(vceqq_u8(in, vdupq_n_u8('\\')),
+                                        vcltq_s8(vreinterpretq_s8_u8(veorq_u8(in, vdupq_n_u8(2))), vdupq_n_s8(33)));
    const std::uint64_t bits = vget_lane_u64(vreinterpret_u64_u8(vshrn_n_u16(vreinterpretq_u16_u8(special), 4)), 0);
    return bits != 0 ? static_cast<unsigned>(count_trailing_zeros(bits) >> 2u) : 16u;
 #else
    const __m128i in = _mm_loadu_si128(static_cast<const __m128i*>(static_cast<const void*>(p))); // NOLINT(bugprone-casting-through-void)
    _mm_storeu_si128(static_cast<__m128i*>(static_cast<void*>(w)), in); // NOLINT(bugprone-casting-through-void)
-    const __m128i special = _mm_or_si128(_mm_or_si128(_mm_cmpeq_epi8(in, _mm_set1_epi8('"')), _mm_cmpeq_epi8(in, _mm_set1_epi8('\\'))),
-                                         _mm_cmplt_epi8(in, _mm_set1_epi8(0x20)));
+    const __m128i special = _mm_or_si128(_mm_cmpeq_epi8(in, _mm_set1_epi8('\\')),
+                                         _mm_cmplt_epi8(_mm_xor_si128(in, _mm_set1_epi8(2)), _mm_set1_epi8(33)));
    const auto bits = static_cast<std::uint64_t>(static_cast<unsigned>(_mm_movemask_epi8(special)));
    return bits != 0 ? static_cast<unsigned>(count_trailing_zeros(bits)) : 16u;
 #endif
@@ -974,7 +978,8 @@ NLOHMANN_VIEW_SSSE3_TARGET NLOHMANN_VIEW_NOINLINE NLOHMANN_VIEW_NOCLONE inline c
    while (e - block >= 16)
    {
        const uint8x16_t in = vld1q_u8(block);
-        const uint8x16_t special = vorrq_u8(vorrq_u8(vceqq_u8(in, vdupq_n_u8('"')), vceqq_u8(in, vdupq_n_u8('\\'))), vcltq_u8(in, vdupq_n_u8(0x20)));
+        // the quote and the control characters: (c ^ 2) < 33 (see vector_plain_run())
+        const uint8x16_t special = vorrq_u8(vceqq_u8(in, vdupq_n_u8('\\')), vcltq_u8(veorq_u8(in, vdupq_n_u8(2)), vdupq_n_u8(33)));
        const uint8x16_t prev1 = vextq_u8(prev, in, 15);
        const uint8x16_t sc = vandq_u8(vandq_u8(vqtbl1q_u8(t1h, vshrq_n_u8(prev1, 4)), vqtbl1q_u8(t1l, vandq_u8(prev1, vdupq_n_u8(0x0F)))), vqtbl1q_u8(t2h, vshrq_n_u8(in, 4)));
        const uint8x16_t must23 = vorrq_u8(vqsubq_u8(vextq_u8(prev, in, 14), vdupq_n_u8(0xE0 - 0x80)), vqsubq_u8(vextq_u8(prev, in, 13), vdupq_n_u8(0xF0 - 0x80)));
@@ -1013,8 +1018,10 @@ NLOHMANN_VIEW_SSSE3_TARGET NLOHMANN_VIEW_NOINLINE NLOHMANN_VIEW_NOCLONE inline c
    while (e - block >= 16)
    {
        const __m128i in = _mm_loadu_si128(static_cast<const __m128i*>(static_cast<const void*>(block))); // NOLINT(bugprone-casting-through-void)
-        const __m128i special = _mm_or_si128(_mm_or_si128(_mm_cmpeq_epi8(in, _mm_set1_epi8('"')), _mm_cmpeq_epi8(in, _mm_set1_epi8('\\'))),
-                                             _mm_cmpeq_epi8(_mm_subs_epu8(in, _mm_set1_epi8(0x1F)), zero)); // in < 0x20
+        // the quote and the control characters: (c ^ 2) < 33, that is,
+        // (c ^ 2) - 32 saturates to 0 (see vector_plain_run())
+        const __m128i special = _mm_or_si128(_mm_cmpeq_epi8(in, _mm_set1_epi8('\\')),
+                                             _mm_cmpeq_epi8(_mm_subs_epu8(_mm_xor_si128(in, _mm_set1_epi8(2)), _mm_set1_epi8(32)), zero));
        const __m128i prev1 = _mm_alignr_epi8(in, prev, 15);
        const __m128i sc = _mm_and_si128(_mm_and_si128(_mm_shuffle_epi8(t1h, _mm_and_si128(_mm_srli_epi16(prev1, 4), nibble)),
                                         _mm_shuffle_epi8(t1l, _mm_and_si128(prev1, nibble))),
@@ -8600,9 +8607,12 @@ inline std::size_t plain_output_run(const unsigned char* s, std::size_t n) noexc
    for (; i + 16 <= n; i += 16)
    {
        const __m128i in = _mm_loadu_si128(static_cast<const __m128i*>(static_cast<const void*>(s + i))); // NOLINT(bugprone-casting-through-void)
-        // (a byte is below 0x20 if it is its own minimum with 0x1F)
-        const __m128i special = _mm_or_si128(_mm_or_si128(_mm_cmpeq_epi8(in, _mm_set1_epi8('"')), _mm_cmpeq_epi8(in, _mm_set1_epi8('\\'))),
-                                             _mm_cmpeq_epi8(_mm_min_epu8(in, _mm_set1_epi8(0x1F)), in));
+        // the quote and the control characters are the bytes with
+        // (c ^ 2) <= 32, that is, those that are their own minimum with 32
+        // (see vector_plain_run())
+        const __m128i flipped = _mm_xor_si128(in, _mm_set1_epi8(2));
+        const __m128i special = _mm_or_si128(_mm_cmpeq_epi8(in, _mm_set1_epi8('\\')),
+                                             _mm_cmpeq_epi8(_mm_min_epu8(flipped, _mm_set1_epi8(32)), flipped));
        const auto mask = static_cast<std::uint64_t>(static_cast<unsigned>(_mm_movemask_epi8(special)));
        if (mask != 0)
        {
@@ -8665,20 +8675,21 @@ inline bool is_ascii_without_delete(const char* s, std::size_t n) noexcept

 #if NLOHMANN_VIEW_VECTOR
 /// the bytes of the 16 at p that ensure_ascii cannot copy (a quote, a
-/// backslash, a control character, DEL, or not ASCII; a signed compare with
-/// 0x20 finds control characters and non-ASCII bytes at once), one bit per
-/// byte (x86) or one nibble per byte (NEON)
+/// backslash, a control character, DEL, or not ASCII; the signed compare
+/// (int8_t)(c ^ 2) < 33 finds the quote, the control characters and the
+/// non-ASCII bytes at once, see vector_plain_run()), one bit per byte (x86) or
+/// one nibble per byte (NEON)
 NLOHMANN_VIEW_ALWAYS_INLINE std::uint64_t ascii_stop_mask(const unsigned char* p) noexcept
 {
 #if NLOHMANN_VIEW_NEON
    const uint8x16_t in = vld1q_u8(p);
-    const uint8x16_t special = vorrq_u8(vorrq_u8(vceqq_u8(in, vdupq_n_u8('"')), vceqq_u8(in, vdupq_n_u8('\\'))),
-                                        vorrq_u8(vceqq_u8(in, vdupq_n_u8(0x7F)), vcltq_s8(vreinterpretq_s8_u8(in), vdupq_n_s8(0x20))));
+    const uint8x16_t special = vorrq_u8(vorrq_u8(vceqq_u8(in, vdupq_n_u8('\\')), vceqq_u8(in, vdupq_n_u8(0x7F))),
+                                        vcltq_s8(vreinterpretq_s8_u8(veorq_u8(in, vdupq_n_u8(2))), vdupq_n_s8(33)));
    return vget_lane_u64(vreinterpret_u64_u8(vshrn_n_u16(vreinterpretq_u16_u8(special), 4)), 0);
 #else
    const __m128i in = _mm_loadu_si128(static_cast<const __m128i*>(static_cast<const void*>(p))); // NOLINT(bugprone-casting-through-void)
-    const __m128i special = _mm_or_si128(_mm_or_si128(_mm_cmpeq_epi8(in, _mm_set1_epi8('"')), _mm_cmpeq_epi8(in, _mm_set1_epi8('\\'))),
-                                         _mm_or_si128(_mm_cmpeq_epi8(in, _mm_set1_epi8(0x7F)), _mm_cmplt_epi8(in, _mm_set1_epi8(0x20))));
+    const __m128i special = _mm_or_si128(_mm_or_si128(_mm_cmpeq_epi8(in, _mm_set1_epi8('\\')), _mm_cmpeq_epi8(in, _mm_set1_epi8(0x7F))),
+                                         _mm_cmplt_epi8(_mm_xor_si128(in, _mm_set1_epi8(2)), _mm_set1_epi8(33)));
    return static_cast<std::uint64_t>(static_cast<unsigned>(_mm_movemask_epi8(special)));
 #endif
 }
@@ -8841,7 +8852,7 @@ struct depth_counter<false>

 /*!
@brief where the double x nearest to a token w * 10^q lies, for 10^15 <= w <
-10^17 and -17 <= q <= -1 (Eisel-Lemire, then a fixed-point position)
+10^17 and -16 <= q <= -1 (Eisel-Lemire, then a fixed-point position)

 dump() writes the shortest decimal in the rounding interval of x (the closest
 one if there are several, see zmij::to_shortest()). Its digits are those of a
@@ -9706,13 +9717,15 @@ class view_serializer
        }
        for (; p != stop && batch.count != float_batch::capacity(); ++p)
        {
-            // a token of the source: 16 or 17 digits, at least 8 after the
-            // point, no exponent, 32 bytes to read
+            // a token of the source: 16 or 17 digits, 8 to 16 after the
+            // point, no exponent, 32 bytes to read (17 after the point, with
+            // no digit before it, only in a damaged image loaded with
+            // image_check::bounds: beyond the range of locate_token())
            const unsigned frac_digits = p->extra >> 8u;
            const unsigned int_digits = p->extra & 0xFFu;
            const unsigned count = int_digits + frac_digits;
            if (p->kind == node_kind::number_float && (p->flags & node_flags::storage) == 0
-                    && count - 16u <= 1u && frac_digits >= 8 && src_end - (src + p->off) >= 33)
+                    && count - 16u <= 1u && frac_digits - 8u <= 8u && src_end - (src + p->off) >= 33)
            {
                const auto* const token = reinterpret_cast<const unsigned char*>(src + p->off); // NOLINT(cppcoreguidelines-pro-type-reinterpret-cast)
                const unsigned sign = token[0] == '-' ? 1 : 0;
@@ -1674,6 +1674,8 @@ TEST_CASE("BSON input that cannot be read is discarded by every overload")
    json _;
    CHECK_THROWS_AS(_ = json::from_bson(input.begin(), input.end()), json::parse_error&);
    CHECK(json::from_bson(input, true, false).is_discarded());
+    // false positive: Infer takes std::integral_constant<bool, false>::value for a pointer
+    // @infer-ignore NULLPTR_DEREFERENCE
    CHECK(json::from_bson(input.begin(), input.end(), true, false).is_discarded());
 #ifndef JSON_TEST_DEPRECATED_FUNCTIONS_DELETED
    CHECK(json::from_bson(input.data(), input.size(), true, false).is_discarded());
@@ -32,6 +32,7 @@ using nlohmann::json;

 #include <iostream>
 #include <iterator>
+#include <list>
 #include <sstream>
 #include <string>
 #include <valarray>
@@ -1409,3 +1410,77 @@ TEST_CASE("indentation runs of every length around the 8-byte skip")
    CHECK(parse_result(indented("[\n~1]", std::string(17, ' ')), true) == "[1]");
 }
 #endif
+
+#if !defined(JSON_NOEXCEPTION)
+namespace
+{
+/// the value of parsing [first, last), or the message of the exception
+template<typename Iterator>
+std::string outcome_of(Iterator first, Iterator last)
+{
+    try
+    {
+        return json::parse(first, last).dump();
+    }
+    catch (const json::exception& e)
+    {
+        return e.what();
+    }
+}
+
+/// the bytes of @a text as a vector of @a T (explicit casts: no implicit char conversion)
+template<typename T>
+std::vector<T> bytes_as(const std::string& text)
+{
+    std::vector<T> result;
+    result.reserve(text.size());
+    for (const char c : text)
+    {
+        result.push_back(static_cast<T>(c));
+    }
+    return result;
+}
+
+/// a std::string, std::vector<char>, <unsigned char> and <signed char> as
+/// iterator pairs: the same as the byte path (std::list iterators)
+void check_iterator_pairs(const std::string& text)
+{
+    CAPTURE(text)
+    const std::list<char> bytes(text.begin(), text.end());
+    const std::string expected = outcome_of(bytes.begin(), bytes.end());
+    const bool expected_accept = json::accept(bytes.begin(), bytes.end());
+
+    std::string s = text;
+    CHECK(outcome_of(s.begin(), s.end()) == expected);
+    CHECK(outcome_of(s.cbegin(), s.cend()) == expected);
+    CHECK(json::accept(s.cbegin(), s.cend()) == expected_accept);
+
+    const std::vector<char> vc(text.begin(), text.end());
+    CHECK(outcome_of(vc.begin(), vc.end()) == expected);
+    const std::vector<unsigned char> vu = bytes_as<unsigned char>(text);
+    CHECK(outcome_of(vu.begin(), vu.end()) == expected);
+    CHECK(json::accept(vu.begin(), vu.end()) == expected_accept);
+    const std::vector<signed char> vs = bytes_as<signed char>(text);
+    CHECK(outcome_of(vs.begin(), vs.end()) == expected);
+}
+}  // namespace
+
+TEST_CASE("deserialization from iterator pairs of std::string and std::vector")
+{
+    // these are read as the pointer range they are, also before C++20
+    for (const char* text :
+            {
+                "", " ", R"([1, 2.5, "a", true, null, {"k": ["v"]}])", "[1, 2", R"({"a" 1})", "\"\xC3\xA4\"", "\"\xC3\"", "[1]x", "1e400"
+            })
+    {
+        check_iterator_pairs(text);
+    }
+    check_iterator_pairs(std::string("[1]" "\0" "x", 5));
+
+    // an empty range is not dereferenced
+    std::string empty;
+    CHECK_FALSE(json::accept(empty.begin(), empty.end()));
+    json _;
+    CHECK_THROWS_AS(_ = json::parse(empty.begin(), empty.end()), json::parse_error&);
+}
+#endif
@@ -1165,6 +1165,44 @@ TEST_CASE("json_view images: check")
        }
    }

+    SECTION("float tokens with 17 digits after the point and none before it")
+    {
+        // No JSON number has this layout. dump() batches tokens of 16 or 17
+        // digits, but only those with 8 to 16 fraction digits are in its
+        // range: 17 read past the table of powers of five (caught by a
+        // bounds-checked std::array), and on x86-64 wrote 18 digits
+        // (the assertion of write_decimal()).
+        const std::vector<std::uint8_t> img = json_document::parse("[1.2345678901234567]" + std::string(40, ' ')).save();
+        node n = node_at(img, 1);
+        REQUIRE(n.len == 18);
+        n.extra = 17u << 8u;
+        std::vector<std::uint8_t> b = img;
+        set_node(b, 1, n);
+        std::memcpy(b.data() + text_at(img) + n.off, ".99999999999999999", 18);
+        const json_document d = json_document::load(b, image_check::bounds);
+        const std::string dumped = d.root().dump();
+        CAPTURE(dumped)
+        CHECK(json::parse(dumped)[0].is_number());
+        CHECK(dumped == d.root().materialize().dump());
+
+        // (the input of OSS-Fuzz issue 583898810: the token is "     " and
+        // 15 nines, then "1{")
+        const std::vector<std::uint8_t> fuzzed =
+        {
+            0x4E, 0x4A, 0x56, 0x49, 0x01, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+            0x22, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+            0x07, 0x10, 0x00, 0x11, 0x00, 0x00, 0x00, 0x00, 0x12, 0x00, 0x00, 0x00, 0x20, 0x20, 0x20, 0x20,
+            0x20, 0x39, 0x39, 0x39, 0x39, 0x39, 0x39, 0x39, 0x39, 0x39, 0x39, 0x39, 0x39, 0x39, 0x39, 0x39,
+            0x31, 0x7B, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
+            0x20, 0x20, 0x00, 0x00
+        };
+        CHECK(load_result(fuzzed, image_check::full) == check_failed);
+        const json_document f = json_document::load(fuzzed, image_check::bounds);
+        CHECK_NOTHROW(f.root().dump());
+    }
+
    SECTION("nodes that share a range")
    {
        // [big string, then n strings made to point to the big string]: every
@@ -19,8 +19,12 @@
 #include <nlohmann/json.hpp>
 using nlohmann::json;

+#include <cstdio>
 #include <iostream>
+#include <sstream>
+#include <utility>
 #include <fstream>
+#include <limits>
 #include <list>
 #include <set>
 #include "make_test_data_available.hpp"
@@ -2436,6 +2440,341 @@ TEST_CASE("UBJSON optimized arrays of a valueless type are bounded")
    }
 }

+namespace
+{
+/// SAX consumer that counts the values and keeps the id of a parse error
+struct ValuelessEventCounter : public nlohmann::json_sax<json>
+{
+    bool null() override
+    {
+        return ++values < stop_after;
+    }
+    bool boolean(bool /*val*/) override
+    {
+        return ++values < stop_after;
+    }
+    bool number_integer(json::number_integer_t /*val*/) override
+    {
+        ++values;
+        return true;
+    }
+    bool number_unsigned(json::number_unsigned_t /*val*/) override
+    {
+        ++values;
+        return true;
+    }
+    bool number_float(json::number_float_t /*val*/, const std::string& /*s*/) override
+    {
+        ++values;
+        return true;
+    }
+    bool string(std::string& /*val*/) override
+    {
+        ++values;
+        return true;
+    }
+    bool binary(json::binary_t& /*val*/) override
+    {
+        ++values;
+        return true;
+    }
+    bool start_object(std::size_t /*elements*/) override
+    {
+        return true;
+    }
+    bool key(std::string& /*val*/) override
+    {
+        return true;
+    }
+    bool end_object() override
+    {
+        return true;
+    }
+    bool start_array(std::size_t /*elements*/) override
+    {
+        return true;
+    }
+    bool end_array() override
+    {
+        return true;
+    }
+    bool parse_error(std::size_t /*position*/, const std::string& /*last_token*/, const json::exception& ex) override
+    {
+        error_id = ex.id;
+        return false;
+    }
+
+    /// the handler refuses the value that makes this many
+    std::size_t stop_after = (std::numeric_limits<std::size_t>::max)();
+    std::size_t values = 0;
+    int error_id = 0;
+};
+
+/// appends `[$<marker>#l<count>` (nine bytes) to @a v
+void append_valueless_array(std::vector<std::uint8_t>& v, const char marker, const std::uint32_t count)
+{
+    v.push_back('[');
+    v.push_back('$');
+    v.push_back(static_cast<std::uint8_t>(marker));
+    v.push_back('#');
+    v.push_back('l');
+    v.push_back(static_cast<std::uint8_t>(count >> 24));
+    v.push_back(static_cast<std::uint8_t>(count >> 16));
+    v.push_back(static_cast<std::uint8_t>(count >> 8));
+    v.push_back(static_cast<std::uint8_t>(count));
+}
+
+/// `[` followed by one `[$<marker>#l<count>` per entry of @a counts and `]`
+std::vector<std::uint8_t> valueless_arrays(const char marker, const std::vector<std::uint32_t>& counts)
+{
+    std::vector<std::uint8_t> v = {'['};
+    for (const auto count : counts)
+    {
+        append_valueless_array(v, marker, count);
+    }
+    v.push_back(']');
+    return v;
+}
+} // namespace
+
+TEST_CASE("UBJSON the valueless elements of a whole input are bounded")
+{
+    // The per-container limit alone let nine bytes (`[$Z#l` and a count of
+    // 1048576) announce a million values, and every further nine bytes another
+    // million. The elements of all containers of type 'Z', 'T' or 'F' in one
+    // input are now added up: they may not exceed 1048576 plus 4 for every
+    // byte read when the container's header has been read.
+    //
+    // The tests count events with a SAX handler where they can: building and
+    // comparing values of a million elements is what makes them slow under
+    // Valgrind, so there is one rejection and one round trip with a DOM.
+    json _;
+    const char* const budget_message = "[json.exception.out_of_range.408] syntax error while parsing UBJSON size: excessive number of elements without payload";
+
+    // two arrays that exceed the limit: the second one, with its header read
+    // at byte 19, may hold 4 * 19 = 76 values on top of the base of 1048576
+    const std::uint32_t over_first = 524288;
+    const std::uint32_t over_second = 1048576 + 76 - over_first + 1;
+
+    SECTION("the input of the original report is rejected")
+    {
+        // 362 bytes (40 arrays of 1048576 values) used to allocate 661 MB; the
+        // second array is the one that is refused
+        const auto input = valueless_arrays('Z', {over_first, over_second});
+        CHECK_THROWS_WITH_AS(_ = json::from_ubjson(input), budget_message, json::out_of_range&);
+    }
+
+    SECTION("every input adapter applies the budget")
+    {
+        const auto input = valueless_arrays('Z', {over_first, over_second});
+
+        // stream; not strict, which does not matter
+        std::stringstream stream;
+        stream.write(reinterpret_cast<const char*>(input.data()), static_cast<std::streamsize>(input.size()));
+        ValuelessEventCounter from_stream;
+        CHECK(!json::sax_parse(stream, &from_stream, json::input_format_t::ubjson, false));
+        CHECK(from_stream.error_id == 408);
+
+        // a container that is not contiguous; the counts of arrays of
+        // different types are added up
+        std::vector<std::uint8_t> mixed = {'['};
+        append_valueless_array(mixed, 'T', over_first);
+        append_valueless_array(mixed, 'F', over_second);
+        mixed.push_back(']');
+        const std::list<std::uint8_t> as_list(mixed.begin(), mixed.end());
+        ValuelessEventCounter from_list;
+        CHECK(!json::sax_parse(as_list.begin(), as_list.end(), &from_list, json::input_format_t::ubjson));
+        CHECK(from_list.error_id == 408);
+        CHECK(from_list.values == over_first);
+
+        // FILE*
+        FILE* const file = std::tmpfile(); // NOLINT(cppcoreguidelines-owning-memory)
+        REQUIRE(file != nullptr);
+        CHECK(std::fwrite(input.data(), 1, input.size(), file) == input.size());
+        std::rewind(file);
+        ValuelessEventCounter from_file;
+        CHECK(!json::sax_parse(file, &from_file, json::input_format_t::ubjson));
+        CHECK(from_file.error_id == 408);
+        std::fclose(file); // NOLINT(cert-err33-c,cppcoreguidelines-owning-memory)
+    }
+
+    SECTION("the limit is exact and the bytes read raise it")
+    {
+        // [ [$Z#l 524288] [$U#l 4096 + 4096 bytes] [$Z#l count] ]: chars_read
+        // is 1 + 9 + (9 + 4096) + 9 = 4124 when the last header has been read,
+        // so the last array may hold 4 * 4124 = 16496 values on top of the
+        // base of 1048576 less the 524288 of the first array
+        const std::uint32_t last_allowed = 1048576 + 16496 - 524288;
+        for (const std::uint32_t count :
+                {
+                    last_allowed, last_allowed + 1
+                })
+        {
+            CAPTURE(count)
+            std::vector<std::uint8_t> input = {'['};
+            append_valueless_array(input, 'Z', 524288);
+            input.insert(input.end(), {'[', '$', 'U', '#', 'l', 0x00, 0x00, 0x10, 0x00});
+            input.insert(input.end(), 4096, 0x01);
+            append_valueless_array(input, 'Z', count);
+            input.push_back(']');
+            ValuelessEventCounter sax;
+            const bool accepted = count == last_allowed;
+            CHECK(json::sax_parse(input, &sax, json::input_format_t::ubjson) == accepted);
+            CHECK(sax.error_id == (accepted ? 0 : 408));
+            CHECK(sax.values == 524288u + 4096u + (accepted ? count : 0u));
+        }
+
+        // an array of 1048576 values on its own is accepted as before
+        const std::vector<std::uint8_t> single = {'[', '$', 'Z', '#', 'l', 0x00, 0x10, 0x00, 0x00};
+        // (the handler ends the parse at the first value, so that the million
+        // values are not read)
+        ValuelessEventCounter sax;
+        sax.stop_after = 1;
+        CHECK(!json::sax_parse(single, &sax, json::input_format_t::ubjson));
+        CHECK(sax.error_id == 0);
+        CHECK(sax.values == 1);
+    }
+
+    SECTION("to_ubjson writes the typed form up to the base only")
+    {
+        // 1048 rows of 1000 values fit under the base of 1048576, the 1049th
+        // would not: its elements are written one by one. Written all typed,
+        // 1100 rows of 6 bytes would be refused by a reader (1075 rows are the
+        // most it accepts). The rows hold null, true or false, and the
+        // fallback does not depend on which
+        std::vector<std::uint8_t> encoded;
+        {
+            json table = json::array();
+            for (int row = 0; row < 1100; ++row)
+            {
+                const json cell = row % 3 == 0 ? json(nullptr) : json(row % 3 == 1);
+                table.push_back(json(1000, cell));
+            }
+            encoded = json::to_ubjson(table, true, true);
+        }
+        // outer array: `[$[#I` and the count (7 bytes), then 1048 typed rows of 6
+        // bytes (`$Z#I` and two bytes) and 52 rows of `#I`, two bytes, and 1000 `Z`
+        CHECK(encoded.size() == 7 + (1048 * 6) + (52 * (4 + 1000)));
+
+        // the output is read back
+        ValuelessEventCounter sax;
+        CHECK(json::sax_parse(encoded, &sax, json::input_format_t::ubjson));
+        CHECK(sax.error_id == 0);
+        CHECK(sax.values == 1100u * 1000u);
+    }
+
+    SECTION("BJData is not affected")
+    {
+        // BJData has no optimized arrays of these types, and the writer does
+        // not charge them
+        json table = json::array();
+        for (int row = 0; row < 3; ++row)
+        {
+            table.push_back(json(10, nullptr));
+        }
+        const auto encoded = json::to_bjdata(table, true, true);
+        CHECK(json::from_bjdata(encoded) == table);
+
+        const std::vector<std::uint8_t> input = {'[', '$', 'Z', '#', 'l', 0x00, 0x10, 0x00, 0x00};
+        CHECK_THROWS_AS(_ = json::from_bjdata(input), json::parse_error&);
+    }
+
+    SECTION("an object of a valueless type needs a key for every value")
+    {
+        // an object member costs a key, so the count is bounded by the input
+        // and is not charged to the budget
+        const std::vector<std::uint8_t> input = {'{', '$', 'Z', '#', 'l', 0x00, 0x10, 0x00, 0x00};
+        ValuelessEventCounter sax;
+        CHECK(!json::sax_parse(input, &sax, json::input_format_t::ubjson));
+        CHECK(sax.error_id == 110);
+        CHECK(sax.values == 0);
+    }
+}
+
+TEST_CASE("UBJSON an optimized array of no-ops is empty whatever its count")
+{
+    // A no-op ('N') is not a value, so `[$N#<n>` is an array without elements
+    // for every n. The count used to be passed on to the SAX parser, which
+    // told it to expect n elements, and the DOM parser reserved storage for
+    // them: 16384 values (256 KB) for a count of 2^31 in 9 bytes of input.
+    SECTION("the SAX parser is told that the array is empty")
+    {
+        for (const std::vector<std::uint8_t>& input :
+                {
+                    std::vector<std::uint8_t> {'[', '$', 'N', '#', 'i', 2},
+                    std::vector<std::uint8_t> {'[', '$', 'N', '#', 'I', 0x7F, 0xFF},
+                    std::vector<std::uint8_t> {'[', '$', 'N', '#', 'l', 0x7F, 0xFF, 0xFF, 0xFF},
+                    std::vector<std::uint8_t> {'[', '$', 'N', '#', 'i', 0}
+                })
+        {
+            SaxEventLogger logger;
+            CHECK(json::sax_parse(input, &logger, json::input_format_t::ubjson));
+            CHECK(logger.events == std::vector<std::string>({"start_array(0)", "end_array()"}));
+        }
+
+        // between other values, the next value is read as usual
+        const std::vector<std::uint8_t> nested = {'[', '[', '$', 'N', '#', 'l', 0x7F, 0xFF, 0xFF, 0xFF, 'T', '[', '$', 'N', '#', 'i', 3, ']'};
+        SaxEventLogger logger;
+        CHECK(json::sax_parse(nested, &logger, json::input_format_t::ubjson));
+        CHECK(logger.events == std::vector<std::string>({"start_array()", "start_array(0)", "end_array()", "boolean(true)", "start_array(0)", "end_array()", "end_array()"}));
+    }
+
+    SECTION("the DOM parser reserves nothing")
+    {
+        // 2000 arrays of 9 bytes that announce 2^31 elements each: with a
+        // reservation of 16384 values per array this took about 500 MB
+        std::vector<std::uint8_t> input = {'['};
+        for (int i = 0; i < 2000; ++i)
+        {
+            input.insert(input.end(), {'[', '$', 'N', '#', 'l', 0x7F, 0xFF, 0xFF, 0xFF});
+        }
+        input.push_back(']');
+
+        const json j = json::from_ubjson(input);
+        REQUIRE(j.size() == 2000);
+        std::size_t capacity = 0;
+        for (const auto& element : j)
+        {
+            CHECK(element.is_array());
+            CHECK(element.empty());
+            capacity += element.get_ref<const json::array_t&>().capacity();
+        }
+        CHECK(capacity == 0);
+
+        // the 7-byte form inside an optimized array of arrays
+        std::vector<std::uint8_t> typed = {'[', '$', '[', '#', 'I', 0x07, 0xD0};
+        for (int i = 0; i < 2000; ++i)
+        {
+            typed.insert(typed.end(), {'$', 'N', '#', 'I', 0x7F, 0xFF});
+        }
+        const json k = json::from_ubjson(typed);
+        REQUIRE(k.size() == 2000);
+        capacity = 0;
+        for (const auto& element : k)
+        {
+            CHECK(element.empty());
+            capacity += element.get_ref<const json::array_t&>().capacity();
+        }
+        CHECK(capacity == 0);
+    }
+
+    SECTION("a count that no container could hold is no longer an error")
+    {
+        // the array is empty, so nothing has to fit: 0x7FFFFFFF used to be
+        // reported as out_of_range.408 where it exceeds the maximum size of
+        // an array, and is accepted now
+        const std::vector<std::uint8_t> input = {'[', '$', 'N', '#', 'l', 0x7F, 0xFF, 0xFF, 0xFF};
+        CHECK(json::from_ubjson(input) == json::array());
+
+        // a count that does not fit into std::size_t still is
+#if SIZE_MAX == 0xffffffff
+        const std::vector<std::uint8_t> too_large = {'[', '$', 'N', '#', 'L', 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00};
+        json _;
+        CHECK_THROWS_AS(_ = json::from_ubjson(too_large), json::out_of_range&);
+#endif
+    }
+}
+
 TEST_CASE("issue #5405 - array reserve for definite-length UBJSON arrays")
 {
 #if !defined(JSON_NOEXCEPTION)
Author	SHA1	Message	Date
Niels Lohmann	5187b6ecc7	Report an empty array for UBJSON [$N#<n>] instead of n elements (#6079 ) * Report an empty array for UBJSON `[$N#<n>` instead of n elements A no-op (N) is not a value, so an optimized array of type N holds no element whatever count it declares. The reader skipped the elements but still passed the declared count to the SAX parser: a handler was told start_array(n) and no element followed, and the DOM parser reserved min(n, 16384) values (256 KB) for an array that stays empty. Nine bytes (`[$N#l 0x7FFFFFFF`) therefore committed 256 KB: 2000 of them in one input, 18 KB, committed 512 MB of heap (capacity 163,840,000 values for the 10000 arrays of the original probe: 2.6 GB for 70 KB of input). Untouched pages keep the resident size small, but the commit charge and a 32-bit address space are consumed. The reader now announces 0 elements for an optimized array of type N. The loop that skips the elements is unchanged (it never ran). A count that does not fit into std::size_t is still rejected by the count reader; a count that is too large for the array type of the DOM (before: out_of_range.408 "excessive array size" from the DOM handler) is accepted now, because the array is empty. Behaviour change: sax_parse reports start_array(0) for `[$N#n` (before: n); from_ubjson no longer throws out_of_range.408 for an N-typed array whose count exceeds the maximum size of the array type. Signed-off-by: Niels Lohmann <mail@nlohmann.me> * Clarify the reservation note for announced array counts Signed-off-by: Niels Lohmann <mail@nlohmann.me> --------- Signed-off-by: Niels Lohmann <mail@nlohmann.me>	2026-11-11 22:37:23 +01:00
Niels Lohmann	71ec3b4306	Bound the total number of valueless UBJSON elements per input An optimized UBJSON array of type Z, T or F has no payload, so its declared count is not bounded by the input. The limit of 1048576 applied to each array on its own, so 9 bytes (`[$Z#l` and a count) produced 1048576 values and every further 9 bytes another 1048576: 362 bytes allocated 661 MB in a DOM, and a SAX handler received 1M events per 9 bytes. The reader now adds the counts of all such arrays of one input and rejects the input with out_of_range.408 when the sum exceeds 1048576 plus 4 for every byte read so far. The base is the per-array limit, so an array that was accepted on its own before is still accepted at the start of an input. These arrays add about 80 bytes of memory per input byte (measured 77; one `Z` per byte needs 32), plus the base; the memory of a document as a whole is not bounded by this. The check runs once per valueless array, before its start event, with plain size_t arithmetic that cannot overflow for a 32-bit size_t. Containers with a payload type and objects (every member needs a key) are bounded by the input already and are unchanged. BJData rejects these types. to_ubjson counts the elements of the typed arrays it writes in one call and writes an array in the unoptimized form (`[#n Z Z ...`) once it would bring the total above 1048576, which a reader accepts at any input size. The check is made only for a typed array of a valueless type, so BJData and other arrays do not pay for it. Everything to_ubjson writes in version 3.13.0 can therefore be read back. Two consequences: - to_ubjson output changes for values with more than 1048576 elements in arrays of type Z, T or F: such an array is written at one byte per element, e.g. 270000 rows of 100 nulls take 26.8 MB instead of 1.35 MB. - Output of version 3.12.0 and earlier (typed arrays without such a total) is rejected by from_ubjson when the arrays hold more than 1048576 elements plus 4 per byte of input. 3.12.0 writes a row of up to 255 nulls in 5 bytes (6 above 255), so a table is rejected from 1075 rows of 1000 nulls or 209723 rows of 25 (accepted: 1000 rows of 1000, 209000 rows of 25); rows of 20 or fewer are never rejected. Measured on the test data: no file of json_test_data (converted with to_ubjson in all three modes, 846 round trips) holds an array of this kind with more than 0.17 values per byte. All of them are read back. Reproducer (K arrays of 1048576 nulls), Apple clang -O2: K=40 (362 bytes): before 41943040 values, 664 MB; after rejected, 33 MB K=2 (20 bytes): before 2097152 values, 53 MB; after rejected, 33 MB The new tests count events with a SAX handler where they can: building and comparing million-element values made the first version take 176 s under Valgrind, the current one about 22 s. Behaviour change: an input that holds more than 1048576 elements in arrays of type Z, T or F at more than 4 per byte is now rejected. Signed-off-by: Niels Lohmann <mail@nlohmann.me>	2026-11-11 10:46:24 +01:00
Niels LohmannandClaude Sonnet 5.5	8d591bf720	Read iterator pairs of std::string and std::vector as pointer ranges (#6029 ) * Read iterator pairs of std::string and std::vector as pointer ranges Before C++20, a pair of iterators of a contiguous container cannot be told from any other random-access iterator, so json::parse(s.begin(), s.end()) on a std::string or std::vector<char> was read one character at a time, without the bulk scans of strings, numbers and indentation that the container itself gets (the container overload of input_adapter() already maps it to a pointer range). The iterators of std::string and of a std::vector of 1-byte integral elements are now matched exactly and mapped to the pointer range they cover; an empty range is not dereferenced. The character type stays the same, so the results and error positions do not change. parse(first, last) of a std::string gets 1.7-2.0x as fast in C++17 on an Apple M1 Max, accept(first, last) 2.7-3.1x, and from_cbor(first, last) of a std::vector 8-23% faster. Signed-off-by: Niels Lohmann <mail@nlohmann.me> * Fix CI: clang-tidy, unused result, Infer false positive in tests - unit-deserialization.cpp: raw string literals, and assign the result of parse() in CHECK_THROWS_AS (-Wunused-result) - unit-bson.cpp: mark Infer's NULLPTR_DEREFERENCE on from_bson() with an iterator pair as a false positive Signed-off-by: Niels Lohmann <mail@nlohmann.me> * Fix implicit char conversion in iterator-pair test The test built std::vector<unsigned char> and <signed char> from a char range, which -fsanitize=integer reports as an implicit conversion. Signed-off-by: Niels Lohmann <mail@nlohmann.me> * Tests: sweep_allocator::construct() accepts pointers to const Recent libc++ (emsdk latest) probes construct(const T, const T&) in an unevaluated context while checking for trivial copies; the static_cast to void in the noexcept specification then fails to compile. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01N5NasEsrzHhSNouxSoEwqz Signed-off-by: Niels Lohmann <mail@nlohmann.me> * Tests: guard sweep_allocator::construct() against const types instead of const_cast The const_cast added in the previous commit is rejected by cppcoreguidelines-pro-type-const-cast (clang-tidy). Make construct() not viable for const U instead, which is what libc++ probes for. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01N5NasEsrzHhSNouxSoEwqz Signed-off-by: Niels Lohmann <mail@nlohmann.me> * Fix CI: astyle and clang-tidy for sweep_allocator::construct() astyle 3.4.13 reformats the enable_if<!...> default template argument (Check amalgamation). Delete the const overload instead, which makes the libc++ probe for const objects fail in the SFINAE context just the same and needs no <type_traits>. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01N5NasEsrzHhSNouxSoEwqz Signed-off-by: Niels Lohmann <mail@nlohmann.me> * Iterator ranges: astyle-safe trait members; reserve in the test helper The byte check and the container match are static constexpr members instead of integral_constant arguments and a default template argument with comparisons, which astyle spaced out. Signed-off-by: Niels Lohmann <mail@nlohmann.me> --------- Signed-off-by: Niels Lohmann <mail@nlohmann.me> Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-11-10 22:30:31 +01:00
Niels LohmannandClaude Sonnet 5.5	2a4aec3e69	SWAR and vector scans: test for special bytes in fewer operations (#6033 ) * SWAR: test for special bytes in the reduced form The usual test for a zero byte, (x - ones) & ~x & high, needs `& ~x` only to keep bytes from 0x80 out. The tests for quotes, backslashes and control characters in string_scan.hpp and the serializer also flag every byte from 0x80 with `v & high`, so the `& ~x` terms can be dropped. Clang finds this reduction itself; GCC does not and emits 24 instead of 16 instructions. The masks are the same for 1.3 billion random words and for every pair of adjacent byte values. With GCC 15 on x86-64: accept() -2 to -4 %, sax_parse() -2 %, dump() -3 %. Clang is unchanged. Signed-off-by: Niels Lohmann <mail@nlohmann.me> * Vector scans: one compare for the quote and the control characters The SSE2/NEON tests for the bytes a string run stops at compared with the quote, with the backslash and with 0x20 separately. Flipping bit 1 maps 0x00-0x1F onto itself and the quote onto 0x20, and every other ASCII byte to 33 or more, so (c ^ 2) < 33 finds the quote and the control characters with one compare: signed where the bytes from 0x80 stop the run too, unsigned (or with a saturating subtraction / minimum on SSE2) where they do not. This saves one vector operation per 16 bytes in all twelve vector tests: the lexer's vector_plain_run() and vector_utf8_run(), dump()'s copy_plain_halves() and copy_plain_vectors(), and json_view's scanner and serializer. The DEL tests of the ensure_ascii paths stay. Signed-off-by: Niels Lohmann <mail@nlohmann.me> * Tests: sweep_allocator::construct() accepts pointers to const Recent libc++ (emsdk latest) probes construct(const T, const T&) in an unevaluated context while checking for trivial copies; the static_cast to void in the noexcept specification then fails to compile. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01N5NasEsrzHhSNouxSoEwqz (cherry picked from commit 794bf70823c12a2a1cb2a8a95f34dfb6357746a8) Signed-off-by: Niels Lohmann <mail@nlohmann.me> * Tests: guard sweep_allocator::construct() against const types instead of const_cast The const_cast added in the previous commit is rejected by cppcoreguidelines-pro-type-const-cast (clang-tidy). Make construct() not viable for const U instead, which is what libc++ probes for. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01N5NasEsrzHhSNouxSoEwqz (cherry picked from commit de099fa607001b710862fd1bbecef3609c54cbc4) Signed-off-by: Niels Lohmann <mail@nlohmann.me> * Fix CI: astyle and clang-tidy for sweep_allocator::construct() astyle 3.4.13 reformats the enable_if<!...> default template argument (Check amalgamation). Delete the const overload instead, which makes the libc++ probe for const objects fail in the SFINAE context just the same and needs no <type_traits>. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01N5NasEsrzHhSNouxSoEwqz Signed-off-by: Niels Lohmann <mail@nlohmann.me> --------- Signed-off-by: Niels Lohmann <mail@nlohmann.me> Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-11-10 22:30:28 +01:00
Niels Lohmann	8c0b48088c	ci: ignore Dependabot bumps of packages pinned by semgrep (#6062 ) semgrep requires exact or compatible-release versions of mcp, boltons and the opentelemetry packages. Bumping them alone makes the Semgrep job fail at pip install (see #6054, #6055, #6057, #6058, #6060, #6061), so leave them to move with the semgrep bump. Signed-off-by: Niels Lohmann <mail@nlohmann.me>	2026-11-10 21:45:05 +01:00
dependabot[bot]	0dbeb39811	build(deps): bump importlib-metadata in /cmake/requirements (#6059 ) Bumps [importlib-metadata](https://github.com/python/importlib_metadata) from 8.7.1 to 10.1.0. - [Release notes](https://github.com/python/importlib_metadata/releases) - [Changelog](https://github.com/python/importlib_metadata/blob/main/NEWS.rst) - [Commits](https://github.com/python/importlib_metadata/compare/v8.7.1...v10.1.0) --- updated-dependencies: - dependency-name: importlib-metadata dependency-version: 10.1.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-11-10 21:44:55 +01:00
dependabot[bot]	d430252840	build(deps): bump the codeql-action group with 3 updates (#6056 ) Bumps the codeql-action group with 3 updates: [github/codeql-action/init](https://github.com/github/codeql-action), [github/codeql-action/analyze](https://github.com/github/codeql-action) and [github/codeql-action/upload-sarif](https://github.com/github/codeql-action). Updates `github/codeql-action/init` from 4.39.1 to 4.39.2 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/9b3254085494b55a0f7c4c2b3d2d52cc712ce370...1fc58d04a4d4374f921bdac573c3811c240f9c26) Updates `github/codeql-action/analyze` from 4.39.1 to 4.39.2 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/9b3254085494b55a0f7c4c2b3d2d52cc712ce370...1fc58d04a4d4374f921bdac573c3811c240f9c26) Updates `github/codeql-action/upload-sarif` from 4.39.1 to 4.39.2 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/9b3254085494b55a0f7c4c2b3d2d52cc712ce370...1fc58d04a4d4374f921bdac573c3811c240f9c26) --- updated-dependencies: - dependency-name: github/codeql-action/init dependency-version: 4.39.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: codeql-action - dependency-name: github/codeql-action/analyze dependency-version: 4.39.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: codeql-action - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.39.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: codeql-action ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-11-10 21:44:46 +01:00
Niels Lohmann	9ed8f85b21	build(deps): bump semgrep from 1.168.0 to 1.184.0 in /cmake/requirements (#6052 ) Regenerate the hash-pinned requirements file. This raises the transitive pins pyjwt 2.13.0 -> 2.15.1 and mcp 1.23.3 -> 1.29.0 (also click 8.1.8 -> 8.4.2, new structlog 26.1.0), closing 18 of the 23 open Dependabot alerts. The remaining alerts cannot be fixed until Semgrep relaxes its pins: mcp needs 1.30.0 (Semgrep pins mcp==1.29.0) and opentelemetry-api needs 1.45.1 (Semgrep pins ~=1.37.0). Signed-off-by: Niels Lohmann <mail@nlohmann.me>	2026-11-10 15:25:03 +01:00
Niels Lohmann	88ab2d56f5	docs: update the README for the release (#6051 ) * docs: update the README for the release - Show the animated SVG feature slideshow (light and dark variant) instead of json.gif. - Thank 20 further contributors and extend two existing entries. - Fix the bad_serializer example (invalid template header, second function named to_json instead of from_json, missing template keyword). - Add "Zero-copy views" to the table of contents, link ordered_json to its API page, and point the speed design goal to the performance page. Signed-off-by: Niels Lohmann <mail@nlohmann.me> * chore: remove the stale ChangeLog.md and docs/json.gif ChangeLog.md was last generated in January 2025 and still ends at "unreleased (2024-12-22)"; 3.12.0 shipped without an entry. The release notes live on the GitHub releases page and in docs/mkdocs/docs/home/releases/. Remove the file, the Makefile target that called github_changelog_generator, and the README credit for that tool. docs/json.gif is an old copy of the feature slideshow that nothing references; the home page uses the SVGs built by docs/mkdocs/scripts/slideshow/. Signed-off-by: Niels Lohmann <mail@nlohmann.me> * chore: remove the unreferenced docs/mkdocs/docs/images/json.gif The README header and the home page use the SVG slideshow built by docs/mkdocs/scripts/slideshow/. Signed-off-by: Niels Lohmann <mail@nlohmann.me> --------- Signed-off-by: Niels Lohmann <mail@nlohmann.me>	2026-11-10 15:24:47 +01:00
Niels Lohmann	5901d861ff	json_view: keep tokens without an integer digit out of the float batch (#6049 ) dump() batches float tokens of 16 or 17 digits with at least 8 fraction digits. A damaged image loaded with image_check::bounds can record a token with no digit before the point and 17 after it, which no JSON number has. Its q = -17 is outside the range of locate_token(), which then read fives[17] past its 17 entries; on x86-64 the resulting digits had 18 digits and failed the assertion of write_decimal() (OSS-Fuzz issue 583898810, json_view_image_fuzzer). The batch now takes 8 to 16 fraction digits, which every valid token of 16 or 17 digits has, so it batches the same tokens of valid documents. Signed-off-by: Niels Lohmann <mail@nlohmann.me>	2026-11-10 15:24:33 +01:00