Bump step-security/harden-runner from 2.21.0 to 2.21.1

Bumps [step-security/harden-runner](https://github.com/step-security/harden-runner) from 2.21.0 to 2.21.1.
- [Release notes](https://github.com/step-security/harden-runner/releases)
- [Commits](https://github.com/step-security/harden-runner/compare/05e31511f85b41b11d1cf0ef85d0992719546e2c...e14015d583714f6e62063499dc959a02595150a1)

---
updated-dependencies:
- dependency-name: step-security/harden-runner
  dependency-version: 2.21.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

.github/workflows/check_amalgamation.yml

@@ -11,7 +11,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
         with:
           egress-policy: audit
 
@@ -34,7 +34,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
         with:
           egress-policy: audit
 

.github/workflows/cifuzz.yml

@@ -9,7 +9,7 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
     - name: Harden Runner
-      uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
       with:
         egress-policy: audit
 

.github/workflows/codeql-analysis.yml

@@ -27,7 +27,7 @@ jobs:
 
     steps:
     - name: Harden Runner
-      uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
       with:
         egress-policy: audit
 

.github/workflows/comment_check_amalgamation.yml

@@ -19,7 +19,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
         with:
           egress-policy: audit
 

.github/workflows/dependency-review.yml

@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
         with:
           egress-policy: audit
 

.github/workflows/flawfinder.yml

@@ -27,7 +27,7 @@ jobs:
       security-events: write
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
         with:
           egress-policy: audit
 

.github/workflows/labeler.yml

@@ -17,7 +17,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
         with:
           egress-policy: audit
 

.github/workflows/publish_documentation.yml

@@ -26,7 +26,7 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
         with:
           egress-policy: audit
 

.github/workflows/scorecards.yml

@@ -36,7 +36,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
         with:
           egress-policy: audit
 

.github/workflows/semgrep.yml

@@ -32,7 +32,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
         with:
           egress-policy: audit
 

.github/workflows/stale.yml

@@ -16,7 +16,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
         with:
           egress-policy: audit
 

.github/workflows/ubuntu.yml

@@ -35,7 +35,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
         with:
           egress-policy: audit
 
@@ -60,7 +60,7 @@ jobs:
         target: [ci_test_amalgamation, ci_test_single_header, ci_cppcheck, ci_cpplint, ci_reproducible_tests, ci_non_git_tests, ci_offline_testdata, ci_reuse_compliance, ci_test_valgrind]
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
         with:
           egress-policy: audit
 
@@ -118,7 +118,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
         with:
           egress-policy: audit
 
@@ -369,7 +369,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
         with:
           egress-policy: audit
 
@@ -392,7 +392,7 @@ jobs:
         target: [ci_test_examples, ci_test_build_documentation]
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
         with:
           egress-policy: audit
 

include/nlohmann/detail/output/serializer.hpp

@@ -71,7 +71,7 @@ class serializer
         , thousands_sep(loc->thousands_sep == nullptr ? '\0' : std::char_traits<char>::to_char_type(* (loc->thousands_sep)))
         , decimal_point(loc->decimal_point == nullptr ? '\0' : std::char_traits<char>::to_char_type(* (loc->decimal_point)))
         , indent_char(ichar)
-        , indent_string()
+        , indent_string(512, indent_char)
         , error_handler(error_handler_)
     {}
 
@@ -126,10 +126,6 @@ class serializer
 
                     // variable to hold indentation for recursive calls
                     const auto new_indent = current_indent + indent_step;
-                    if (JSON_HEDLEY_UNLIKELY(indent_string.empty()))
-                    {
-                        indent_string.resize(512, indent_char);
-                    }
                     if (JSON_HEDLEY_UNLIKELY(indent_string.size() < new_indent))
                     {
                         indent_string.resize(indent_string.size() * 2, ' ');
@@ -203,10 +199,6 @@ class serializer
 
                     // variable to hold indentation for recursive calls
                     const auto new_indent = current_indent + indent_step;
-                    if (JSON_HEDLEY_UNLIKELY(indent_string.empty()))
-                    {
-                        indent_string.resize(512, indent_char);
-                    }
                     if (JSON_HEDLEY_UNLIKELY(indent_string.size() < new_indent))
                     {
                         indent_string.resize(indent_string.size() * 2, ' ');
@@ -268,10 +260,6 @@ class serializer
 
                     // variable to hold indentation for recursive calls
                     const auto new_indent = current_indent + indent_step;
-                    if (JSON_HEDLEY_UNLIKELY(indent_string.empty()))
-                    {
-                        indent_string.resize(512, indent_char);
-                    }
                     if (JSON_HEDLEY_UNLIKELY(indent_string.size() < new_indent))
                     {
                         indent_string.resize(indent_string.size() * 2, ' ');
@@ -1022,7 +1010,7 @@ class serializer
 
     /// the indentation character
     const char indent_char;
-    /// the indentation string (lazily allocated on first use by a pretty-print branch)
+    /// the indentation string
     string_t indent_string;
 
     /// error_handler how to react on decoding errors

single_include/nlohmann/json.hpp

@@ -20150,7 +20150,7 @@ class serializer
         , thousands_sep(loc->thousands_sep == nullptr ? '\0' : std::char_traits<char>::to_char_type(* (loc->thousands_sep)))
         , decimal_point(loc->decimal_point == nullptr ? '\0' : std::char_traits<char>::to_char_type(* (loc->decimal_point)))
         , indent_char(ichar)
-        , indent_string()
+        , indent_string(512, indent_char)
         , error_handler(error_handler_)
     {}
 
@@ -20205,10 +20205,6 @@ class serializer
 
                     // variable to hold indentation for recursive calls
                     const auto new_indent = current_indent + indent_step;
-                    if (JSON_HEDLEY_UNLIKELY(indent_string.empty()))
-                    {
-                        indent_string.resize(512, indent_char);
-                    }
                     if (JSON_HEDLEY_UNLIKELY(indent_string.size() < new_indent))
                     {
                         indent_string.resize(indent_string.size() * 2, ' ');
@@ -20282,10 +20278,6 @@ class serializer
 
                     // variable to hold indentation for recursive calls
                     const auto new_indent = current_indent + indent_step;
-                    if (JSON_HEDLEY_UNLIKELY(indent_string.empty()))
-                    {
-                        indent_string.resize(512, indent_char);
-                    }
                     if (JSON_HEDLEY_UNLIKELY(indent_string.size() < new_indent))
                     {
                         indent_string.resize(indent_string.size() * 2, ' ');
@@ -20347,10 +20339,6 @@ class serializer
 
                     // variable to hold indentation for recursive calls
                     const auto new_indent = current_indent + indent_step;
-                    if (JSON_HEDLEY_UNLIKELY(indent_string.empty()))
-                    {
-                        indent_string.resize(512, indent_char);
-                    }
                     if (JSON_HEDLEY_UNLIKELY(indent_string.size() < new_indent))
                     {
                         indent_string.resize(indent_string.size() * 2, ' ');
@@ -21101,7 +21089,7 @@ class serializer
 
     /// the indentation character
     const char indent_char;
-    /// the indentation string (lazily allocated on first use by a pretty-print branch)
+    /// the indentation string
     string_t indent_string;
 
     /// error_handler how to react on decoding errors

tests/src/unit-serialization.cpp

@@ -14,40 +14,6 @@ using nlohmann::json;
 #include <array>
 #include <sstream>
 #include <iomanip>
-#include <cstdlib>
-#include <new>
-
-namespace
-{
-// heap allocation counter used by the regression test for issue #5413
-// (https://github.com/nlohmann/json/issues/5413); disabled (and thus a
-// no-op besides the counting) unless explicitly toggled on
-bool count_heap_allocations = false; // NOLINT(cppcoreguidelines-avoid-non-const-global-variables)
-std::size_t heap_allocations = 0; // NOLINT(cppcoreguidelines-avoid-non-const-global-variables)
-} // namespace
-
-void* operator new (std::size_t size) // NOLINT(cppcoreguidelines-owning-memory,misc-new-delete-overloads)
-{
-    if (count_heap_allocations)
-    {
-        ++heap_allocations;
-    }
-    if (void* ptr = std::malloc(size)) // NOLINT(cppcoreguidelines-no-malloc,cppcoreguidelines-owning-memory)
-    {
-        return ptr;
-    }
-    throw std::bad_alloc(); // NOLINT(hicpp-exception-baseclass)
-}
-
-void operator delete (void* ptr) noexcept // NOLINT(cppcoreguidelines-owning-memory,misc-new-delete-overloads)
-{
-    std::free(ptr); // NOLINT(cppcoreguidelines-no-malloc,cppcoreguidelines-owning-memory)
-}
-
-void operator delete (void* ptr, std::size_t /*size*/) noexcept // NOLINT(cppcoreguidelines-owning-memory,misc-new-delete-overloads)
-{
-    std::free(ptr); // NOLINT(cppcoreguidelines-no-malloc,cppcoreguidelines-owning-memory)
-}
 
 TEST_CASE("serialization")
 {
@@ -416,76 +382,3 @@ TEST_CASE("dump for basic_json with long double number_float_t")
         check_same(100.0L,  100.0);
     }
 }
-
-TEST_CASE("regression test for issue #5413 - lazily allocated indent_string")
-{
-    // the serializer used to unconditionally allocate a 512-byte
-    // indent_string in its constructor, even though it is only ever read
-    // inside the pretty_print branches of dump(). This wasted a heap
-    // allocation (and its matching deallocation) on every single compact
-    // (i.e. non-pretty, the default) dump() call. indent_string is now
-    // allocated lazily, the first time a pretty-print branch actually
-    // needs it -- so a compact dump() must perform strictly fewer heap
-    // allocations than a pretty dump() of the same value.
-    const json j = {{"level", "info"}, {"msg", "hello world"}, {"id", 12345}};
-
-    // warm up anything unrelated to indentation (e.g., one-time locale
-    // lookups) that might otherwise allocate on first use regardless of
-    // pretty-printing, so it does not skew the counts measured below
-    const auto warmup = j.dump();
-    const auto warmup_pretty = j.dump(4);
-    CHECK(!warmup.empty());
-    CHECK(!warmup_pretty.empty());
-
-    SECTION("compact dump() has a stable, minimal allocation count")
-    {
-        count_heap_allocations = true;
-
-        heap_allocations = 0;
-        const auto compact1 = j.dump();
-        const auto allocs_compact1 = heap_allocations;
-
-        heap_allocations = 0;
-        const auto compact2 = j.dump(-1);
-        const auto allocs_compact2 = heap_allocations;
-
-        count_heap_allocations = false;
-
-        CHECK(compact1 == compact2);
-        // dump() and dump(-1) both take the compact code path and must
-        // never touch indent_string, so they allocate identically often
-        CHECK(allocs_compact1 == allocs_compact2);
-    }
-
-    SECTION("first pretty dump() allocates more than a compact dump()")
-    {
-        // use a tiny value whose compact ({"a":1}, 7 bytes) and pretty
-        // ({"a": 1} with 1-space indent, 11 bytes) serializations both stay
-        // well inside every common std::string small-string-optimization
-        // buffer (>= 15 bytes on libstdc++/MSVC STL, >= 22 on libc++), so
-        // building the result string itself causes no heap allocation
-        // either way -- isolating indent_string as the only thing that can
-        // possibly account for a difference in allocation count
-        const json tiny = {{"a", 1}};
-
-        count_heap_allocations = true;
-
-        heap_allocations = 0;
-        const auto compact = tiny.dump();
-        const auto allocs_compact = heap_allocations;
-
-        heap_allocations = 0;
-        const auto pretty = tiny.dump(1);
-        const auto allocs_pretty = heap_allocations;
-
-        count_heap_allocations = false;
-
-        CHECK(compact == "{\"a\":1}");
-        CHECK(pretty == "{\n \"a\": 1\n}");
-        // a fresh serializer is created per dump() call; the pretty branch
-        // lazily allocates indent_string on its first use, so it must
-        // allocate at least once more than the compact branch, which never
-        // touches indent_string at all
-        CHECK(allocs_pretty > allocs_compact);
-    }
-}