🎓 fix warning

Signed-off-by: Niels Lohmann <mail@nlohmann.me>

.github/dependabot.yml

@@ -4,8 +4,6 @@ updates:
     directory: /
     schedule:
       interval: daily
-    cooldown:
-      default-days: 7
     groups:
       codeql-action:
         patterns:
@@ -15,33 +13,23 @@ updates:
     directory: /docs/mkdocs
     schedule:
       interval: daily
-    cooldown:
-      default-days: 7
 
   - package-ecosystem: pip
     directory: /tools/astyle
     schedule:
       interval: daily
-    cooldown:
-      default-days: 7
 
   - package-ecosystem: pip
     directory: /tools/generate_natvis
     schedule:
       interval: daily
-    cooldown:
-      default-days: 7
 
   - package-ecosystem: pip
     directory: /tools/serve_header
     schedule:
       interval: daily
-    cooldown:
-      default-days: 7
 
   - package-ecosystem: pip
     directory: /cmake/requirements
     schedule:
       interval: daily
-    cooldown:
-      default-days: 7

.github/workflows/semgrep.yml

@@ -49,7 +49,7 @@ jobs:
       # SEMGREP_APP_TOKEN is still passed through so registry auth works if a
       # token is ever added.
       - name: Install Semgrep
-        run: python3 -m pip install --user semgrep==1.168.0
+        run: python3 -m pip install --user semgrep
 
       # `semgrep scan --sarif` always exits 0 even with findings; continue-on-error
       # is a safety net so the SARIF upload still runs if the scan itself errors.

.github/workflows/ubuntu.yml

@@ -234,20 +234,11 @@ jobs:
 
   ci_cuda_example:
     runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        # matrix to empirically pin down which nvcc/CUDA versions reproduce #3907
-        # (a c++20 parse error in iteration_proxy.hpp's enable_borrowed_range) before
-        # attempting a source-level fix; 11.8 predates CUDA's C++20 support entirely.
-        cuda: ['11.8.0', '12.0.1', '12.1.1', '12.2.2', '12.3.2', '12.4.1', '12.5.1', '12.6.3']
-    container: nvidia/cuda:${{ matrix.cuda }}-devel-ubuntu22.04
+    container: ghcr.io/nlohmann/json-ci:v2.4.0
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
-      - name: Get latest CMake and ninja
-        uses: lukka/get-cmake@f5b8fbb4d77cec1acc5a5f9f0df4beffaf5d98d9 # v4.3.4
       - name: Run CMake
         run: cmake -S . -B build -DJSON_CI=On
       - name: Build

cmake/ci.cmake

@@ -669,6 +669,7 @@ add_custom_target(ci_test_compiler_default
 add_custom_target(ci_cuda_example
     COMMAND ${CMAKE_COMMAND}
         -DCMAKE_BUILD_TYPE=Debug -GNinja
+        -DCMAKE_CUDA_HOST_COMPILER=g++-8
         -S${PROJECT_SOURCE_DIR}/tests/cuda_example -B${PROJECT_BINARY_DIR}/build_cuda_example
     COMMAND ${CMAKE_COMMAND} --build ${PROJECT_BINARY_DIR}/build_cuda_example
 )

docs/mkdocs/docs/features/conversions.md

@@ -66,6 +66,24 @@ which forces the explicit `get` form and can catch unintended conversions at com
     floating-point value as an integer truncates it, and narrowing conversions may overflow. See
     [number conversion](types/number_handling.md#number-conversion) for details and how to guard against it.
 
+!!! warning "std::optional direct construction from JSON null throws"
+
+    Constructing or assigning `std::optional<T>` directly from a JSON value does not correctly produce
+    `std::nullopt` for a JSON `null`:
+
+    ```cpp
+    json j_null;
+    std::optional<std::string> opt = j_null;  // ❌ throws type_error 302
+    ```
+
+    This is due to C++ language rules: `std::optional<T>` has its own converting constructor that is chosen over
+    `basic_json::operator T()` when both are viable. Use `get<std::optional<T>>()` or `get_to()` instead:
+
+    ```cpp
+    auto opt = j_null.get<std::optional<std::string>>();  // ✅ std::nullopt
+    j_null.get_to(opt);                                     // ✅ std::nullopt
+    ```
+
 ## Putting values in
 
 The reverse direction works the same way: assigning or constructing a `json` from a C++ value converts it to JSON.

tests/cuda_example/CMakeLists.txt

@@ -3,7 +3,7 @@ project(json_cuda LANGUAGES CUDA)
 
 add_executable(json_cuda json_cuda.cu)
 target_include_directories(json_cuda PRIVATE ../../include)
-target_compile_features(json_cuda PUBLIC cuda_std_20)
+target_compile_features(json_cuda PUBLIC cuda_std_11)
 set_target_properties(json_cuda PROPERTIES
     CUDA_EXTENSIONS OFF
     CUDA_STANDARD_REQUIRED ON

tests/src/unit-algorithms.cpp

@@ -232,9 +232,6 @@ TEST_CASE("algorithms")
             // only the first four elements are expected to be sorted, the rest are
             // unspecified by the standard
             const json expected({nullptr, false, true, 3});
-            // std::equal below only bounds-checks the first range; assert the
-            // second range is at least as long to rule out an over-read (CWE-126)
-            CHECK(std::distance(begin(expected), end(expected)) >= 4);
             CHECK(std::equal(j.begin(), j.begin() + 4, begin(expected)));
         }
     }

tests/src/unit-conversions.cpp

@@ -1761,16 +1761,27 @@ TEST_CASE("std::filesystem::path")
 }
 #endif
 
-#if !JSON_USE_IMPLICIT_CONVERSIONS
 TEST_CASE("std::optional")
 {
     SECTION("null")
     {
-        json j_null;
-        std::optional<std::string> opt_null;
+        const json j_null;
+        const std::optional<std::string> opt_null;
 
         CHECK(json(opt_null) == j_null);
         CHECK(j_null.get<std::optional<std::string>>() == std::nullopt);
+
+        // Constructing std::optional<T> directly from JSON null throws because
+        // std::optional's own converting constructor is chosen over basic_json's
+        // operator T(). This is a language-level limitation (std::optional<T> is
+        // constructible from T, and T is constructible from basic_json via the
+        // operator); there is no SFINAE path that distinguishes "call from inside
+        // std::optional's constructor" from "direct call". Use get<std::optional<T>>()
+        // or get_to() instead for correct null handling. See #4864 and #5246.
+        CHECK_THROWS_WITH_AS(std::optional<std::string>(j_null),
+                             "[json.exception.type_error.302] type must be string, but is null", json::type_error&);
+        CHECK_THROWS_WITH_AS(std::optional<int>(j_null),
+                             "[json.exception.type_error.302] type must be number, but is null", json::type_error&);
     }
 
     SECTION("string")
@@ -1819,7 +1830,6 @@ TEST_CASE("std::optional")
     }
 }
 #endif
-#endif
 
 #ifdef JSON_HAS_CPP_17
     #undef JSON_HAS_CPP_17