Account for JSON_DIAGNOSTIC_POSITIONS in the move-prefix-check error messages

out_of_range::create() includes a "(bytes X-Y)" position annotation when
JSON_DIAGNOSTIC_POSITIONS is enabled, which the ci_test_diagnostic_positions
CI job builds the whole suite with. The five new out_of_range.414
assertions only checked the annotation-free message. Confirmed
JSON_DIAGNOSTICS produces the same (annotation-free) message as the
default build for this particular throw site (its path-based annotation
is empty at the root, where &result always points here), so only two
message variants are needed, not three.

Signed-off-by: Niels Lohmann <mail@nlohmann.me>

.github/workflows/ubuntu.yml

@@ -100,7 +100,7 @@ jobs:
     container: ubuntu:focal
     strategy:
       matrix:
-        target: [ci_cmake_flags, ci_test_diagnostics, ci_test_diagnostic_positions, ci_test_noexceptions, ci_test_noimplicitconversions, ci_test_legacycomparison, ci_test_noglobaludls, ci_test_disableenumserialization, ci_test_skiplibraryversioncheck]
+        target: [ci_cmake_flags, ci_test_diagnostics, ci_test_diagnostic_positions, ci_test_noexceptions, ci_test_noimplicitconversions, ci_test_legacycomparison, ci_test_noglobaludls]
     steps:
       - name: Install build-essential
         run: apt-get update ; apt-get install -y build-essential unzip wget git libssl-dev

cmake/ci.cmake

@@ -242,40 +242,6 @@ add_custom_target(ci_test_noglobaludls
     COMMENT "Compile and test with global UDLs disabled"
 )
 
-###############################################################################
-# Disable enum serialization.
-###############################################################################
-
-add_custom_target(ci_test_disableenumserialization
-    COMMAND ${CMAKE_COMMAND}
-    -DCMAKE_BUILD_TYPE=Debug -GNinja
-    -DJSON_BuildTests=ON -DJSON_FastTests=ON -DJSON_DisableEnumSerialization=ON
-    -S${PROJECT_SOURCE_DIR} -B${PROJECT_BINARY_DIR}/build_disableenumserialization
-    COMMAND ${CMAKE_COMMAND} --build ${PROJECT_BINARY_DIR}/build_disableenumserialization
-    COMMAND cd ${PROJECT_BINARY_DIR}/build_disableenumserialization && ${CMAKE_CTEST_COMMAND} --parallel ${N} --output-on-failure
-    COMMENT "Compile and test with enum serialization disabled"
-)
-
-###############################################################################
-# Skip the multiple-inclusion library version check.
-###############################################################################
-
-# tests/src/skip_library_version_check.cpp deliberately simulates a scenario
-# (mixing two differently-versioned inclusions of the library in one
-# translation unit) that unavoidably triggers the compiler's own "macro
-# redefined" warning, so -- unlike the ci_test_* targets above -- it is
-# compiled directly here, with a modest warning set, instead of being folded
-# into the library's own -Weverything/-Werror unit test matrix.
-add_custom_target(ci_test_skiplibraryversioncheck
-    COMMAND ${CMAKE_COMMAND} -E make_directory ${PROJECT_BINARY_DIR}/skip_library_version_check
-    COMMAND ${CMAKE_CXX_COMPILER} -std=c++11 -Wall -Wextra
-        -I${PROJECT_SOURCE_DIR}/include
-        ${PROJECT_SOURCE_DIR}/tests/src/skip_library_version_check.cpp
-        -o ${PROJECT_BINARY_DIR}/skip_library_version_check/skip_library_version_check
-    COMMAND ${PROJECT_BINARY_DIR}/skip_library_version_check/skip_library_version_check
-    COMMENT "Compile and run a translation unit simulating a mismatched library version, with JSON_SKIP_LIBRARY_VERSION_CHECK defined"
-)
-
 ###############################################################################
 # Coverage.
 ###############################################################################

docs/mkdocs/docs/api/basic_json/patch.md

@@ -34,6 +34,10 @@ Strong guarantee: if an exception is thrown, there are no changes in the JSON va
   ("add", "remove", "move")
 - Throws [`out_of_range.411`](../../home/exceptions.md#jsonexceptionout_of_range411) if an "add" operation's target
   location has a parent that is neither an object nor an array.
+- Throws [`out_of_range.413`](../../home/exceptions.md#jsonexceptionout_of_range413) if a "remove" operation's target
+  location has a parent that is neither an object nor an array.
+- Throws [`out_of_range.414`](../../home/exceptions.md#jsonexceptionout_of_range414) if a "move" operation's "from"
+  location is a proper prefix of its "path" location.
 - Throws [`other_error.501`](../../home/exceptions.md#jsonexceptionother_error501) if "test" operation was
   unsuccessful.
 
@@ -75,3 +79,7 @@ is thrown. In any case, the original value is not changed: the patch is applied
 - Added in version 2.0.0.
 - Added [`out_of_range.411`](../../home/exceptions.md#jsonexceptionout_of_range411) and stopped relying on an internal assertion when an "add" operation's
   target location has a non-object/non-array parent in version 3.13.0.
+- Added [`out_of_range.413`](../../home/exceptions.md#jsonexceptionout_of_range413) and stopped silently ignoring a "remove" operation whose target
+  location has a non-object/non-array parent in version 3.13.0.
+- Added [`out_of_range.414`](../../home/exceptions.md#jsonexceptionout_of_range414) and rejected a "move" operation whose "from" location is a proper
+  prefix of its "path" location instead of silently producing a corrupted result in version 3.13.0.

docs/mkdocs/docs/api/basic_json/patch_inplace.md

@@ -30,6 +30,10 @@ No guarantees, value may be corrupted by an unsuccessful patch operation.
   ("add", "remove", "move")
 - Throws [`out_of_range.411`](../../home/exceptions.md#jsonexceptionout_of_range411) if an "add" operation's target
   location has a parent that is neither an object nor an array.
+- Throws [`out_of_range.413`](../../home/exceptions.md#jsonexceptionout_of_range413) if a "remove" operation's target
+  location has a parent that is neither an object nor an array.
+- Throws [`out_of_range.414`](../../home/exceptions.md#jsonexceptionout_of_range414) if a "move" operation's "from"
+  location is a proper prefix of its "path" location.
 - Throws [`other_error.501`](../../home/exceptions.md#jsonexceptionother_error501) if "test" operation was
   unsuccessful.
 
@@ -72,3 +76,7 @@ function throws an exception.
 - Added in version 3.11.0.
 - Added [`out_of_range.411`](../../home/exceptions.md#jsonexceptionout_of_range411) and stopped relying on an internal assertion when an "add" operation's
   target location has a non-object/non-array parent in version 3.13.0.
+- Added [`out_of_range.413`](../../home/exceptions.md#jsonexceptionout_of_range413) and stopped silently ignoring a "remove" operation whose target
+  location has a non-object/non-array parent in version 3.13.0.
+- Added [`out_of_range.414`](../../home/exceptions.md#jsonexceptionout_of_range414) and rejected a "move" operation whose "from" location is a proper
+  prefix of its "path" location instead of silently producing a corrupted result in version 3.13.0.

docs/mkdocs/docs/home/exceptions.md

@@ -933,6 +933,34 @@ BSON stores the length of documents, arrays, strings, and binary values in a sig
     [`to_bson`](../api/basic_json/to_bson.md) produced documents with negative length prefixes that
     [`from_bson`](../api/basic_json/from_bson.md) rejected.
 
+### json.exception.out_of_range.413
+
+A JSON Patch `remove` operation cannot be applied because the target location's parent is neither an object nor an array. Per [RFC 6902](https://datatracker.ietf.org/doc/html/rfc6902), a `remove` target must reference a member of an existing object or an element of an existing array; a primitive value (string, number, boolean, etc.) or `null` has no members or elements to remove.
+
+!!! failure "Example message"
+
+    ```
+    cannot remove value: the JSON Patch 'remove' target's parent is of type number, but must be an object or array
+    ```
+
+!!! note
+
+    This exception was added in version 3.13.0. Before that, this situation was silently ignored (the `remove` operation had no effect).
+
+### json.exception.out_of_range.414
+
+A JSON Patch `move` operation's `"from"` location is a proper prefix of its `"path"` location. Per [RFC 6902](https://datatracker.ietf.org/doc/html/rfc6902) (section 4.4), a location cannot be moved into one of its own children.
+
+!!! failure "Example message"
+
+    ```
+    cannot move value: 'from' path '/0' is a proper prefix of 'path' '/0/0'
+    ```
+
+!!! note
+
+    This exception was added in version 3.13.0. Before that, this situation could succeed with a corrupted result: for an array target, removing the "from" element before the "add" step shifted subsequent indices, so "path" silently re-resolved to a different element than intended.
+
 ## Further exceptions
 
 This exception is thrown in case of errors that cannot be classified with the

include/nlohmann/json.hpp

@@ -4939,6 +4939,36 @@ class basic_json // NOLINT(cppcoreguidelines-special-member-functions,hicpp-spec
                 // note erase performs range check
                 parent.erase(json_pointer::template array_index<basic_json_t>(last_path));
             }
+            else
+            {
+                // the parent of a "remove" target must be an object or array
+                // (see #5396)
+                JSON_THROW(out_of_range::create(413, detail::concat("cannot remove value: the JSON Patch 'remove' target's parent is of type ", parent.type_name(), ", but must be an object or array"), &parent));
+            }
+        };
+
+        // RFC 6902 (section 4.4) forbids "from" from being a proper prefix
+        // of "path" for a "move" operation: a location cannot be moved into
+        // one of its own children. Compares reference tokens (already
+        // unescaped by json_pointer's parser) rather than the raw pointer
+        // strings, since a token may itself contain an escaped '/' or '~'
+        // that would defeat a naive string-prefix comparison. "from" equal
+        // to "path" is *not* a proper prefix and must return false.
+        const auto is_proper_prefix = [](const json_pointer & from, const json_pointer & to)
+        {
+            const auto from_size = from.reference_tokens.size();
+            if (from_size >= to.reference_tokens.size())
+            {
+                return false;
+            }
+            for (std::size_t i = 0; i < from_size; ++i)
+            {
+                if (!(from.reference_tokens[i] == to.reference_tokens[i]))
+                {
+                    return false;
+                }
+            }
+            return true;
         };
 
         // type check: top level value must be an array
@@ -5016,6 +5046,11 @@ class basic_json // NOLINT(cppcoreguidelines-special-member-functions,hicpp-spec
                     const auto from_path = get_value("move", "from", true).template get<string_t>();
                     json_pointer from_ptr(from_path);
 
+                    if (JSON_HEDLEY_UNLIKELY(is_proper_prefix(from_ptr, ptr)))
+                    {
+                        JSON_THROW(out_of_range::create(414, detail::concat("cannot move value: 'from' path '", from_path, "' is a proper prefix of 'path' '", path, "'"), &result));
+                    }
+
                     // the "from" location must exist - use at()
                     basic_json const v = result.at(from_ptr);
 

single_include/nlohmann/json.hpp

@@ -26367,6 +26367,36 @@ class basic_json // NOLINT(cppcoreguidelines-special-member-functions,hicpp-spec
                 // note erase performs range check
                 parent.erase(json_pointer::template array_index<basic_json_t>(last_path));
             }
+            else
+            {
+                // the parent of a "remove" target must be an object or array
+                // (see #5396)
+                JSON_THROW(out_of_range::create(413, detail::concat("cannot remove value: the JSON Patch 'remove' target's parent is of type ", parent.type_name(), ", but must be an object or array"), &parent));
+            }
+        };
+
+        // RFC 6902 (section 4.4) forbids "from" from being a proper prefix
+        // of "path" for a "move" operation: a location cannot be moved into
+        // one of its own children. Compares reference tokens (already
+        // unescaped by json_pointer's parser) rather than the raw pointer
+        // strings, since a token may itself contain an escaped '/' or '~'
+        // that would defeat a naive string-prefix comparison. "from" equal
+        // to "path" is *not* a proper prefix and must return false.
+        const auto is_proper_prefix = [](const json_pointer & from, const json_pointer & to)
+        {
+            const auto from_size = from.reference_tokens.size();
+            if (from_size >= to.reference_tokens.size())
+            {
+                return false;
+            }
+            for (std::size_t i = 0; i < from_size; ++i)
+            {
+                if (!(from.reference_tokens[i] == to.reference_tokens[i]))
+                {
+                    return false;
+                }
+            }
+            return true;
         };
 
         // type check: top level value must be an array
@@ -26444,6 +26474,11 @@ class basic_json // NOLINT(cppcoreguidelines-special-member-functions,hicpp-spec
                     const auto from_path = get_value("move", "from", true).template get<string_t>();
                     json_pointer from_ptr(from_path);
 
+                    if (JSON_HEDLEY_UNLIKELY(is_proper_prefix(from_ptr, ptr)))
+                    {
+                        JSON_THROW(out_of_range::create(414, detail::concat("cannot move value: 'from' path '", from_path, "' is a proper prefix of 'path' '", path, "'"), &result));
+                    }
+
                     // the "from" location must exist - use at()
                     basic_json const v = result.at(from_ptr);
 

tests/src/skip_library_version_check.cpp

@@ -1,61 +0,0 @@
-//     __ _____ _____ _____
-//  __|  |   __|     |   | |  JSON for Modern C++ (supporting code)
-// |  |  |__   |  |  | | | |  version 3.12.0
-// |_____|_____|_____|_|___|  https://github.com/nlohmann/json
-//
-// SPDX-FileCopyrightText: 2013-2026 Niels Lohmann <https://nlohmann.me>
-// SPDX-License-Identifier: MIT
-
-// Standalone compile-and-run check for the JSON_SKIP_LIBRARY_VERSION_CHECK
-// configuration macro, which (per #5423) was never exercised anywhere in the
-// test matrix.
-//
-// include/nlohmann/detail/abi_macros.hpp normally emits a #warning if
-// NLOHMANN_JSON_VERSION_MAJOR/MINOR/PATCH are already defined (as they would
-// be by an earlier inclusion of a different version of the library) with
-// values that mismatch the version about to be defined -- unless
-// JSON_SKIP_LIBRARY_VERSION_CHECK is defined, in which case the check (and
-// that #warning) is skipped.
-//
-// This file deliberately is not named tests/src/unit-*.cpp: it is compiled
-// directly (with a modest, non-strict warning set) by the dedicated
-// ci_test_skiplibraryversioncheck target in cmake/ci.cmake, rather than being
-// folded into the library's own -Weverything/-Werror unit test matrix. That
-// is because the scenario simulated here -- mixing two different, already
-// differently-versioned inclusions of the library in one translation unit --
-// unavoidably also triggers the *compiler's own* "macro redefined" warning,
-// independent of (and unaffected by) JSON_SKIP_LIBRARY_VERSION_CHECK, which
-// only ever silences the library's own #warning. Building this file under
-// -Weverything -Werror would therefore fail for a reason unrelated to the
-// macro under test.
-#define NLOHMANN_JSON_VERSION_MAJOR 0
-#define NLOHMANN_JSON_VERSION_MINOR 0
-#define NLOHMANN_JSON_VERSION_PATCH 0
-
-#define JSON_SKIP_LIBRARY_VERSION_CHECK 1
-
-#include <nlohmann/json.hpp>
-
-int main()
-{
-    // reaching this point at all already proves that the mismatched,
-    // pre-defined version macros above did not stop compilation -- which is
-    // exactly what JSON_SKIP_LIBRARY_VERSION_CHECK is for. The library must
-    // also still be fully usable.
-    const nlohmann::json j = {{"a", 1}, {"b", {1, 2, 3}}};
-    if (j.dump() != "{\"a\":1,\"b\":[1,2,3]}")
-    {
-        return 1;
-    }
-
-    // include/nlohmann/detail/abi_macros.hpp unconditionally (re)defines the
-    // version macros to the library's real, current version right after the
-    // (here, skipped) mismatch check, regardless of the deliberately wrong
-    // stand-in values defined above.
-    if (NLOHMANN_JSON_VERSION_MAJOR == 0 && NLOHMANN_JSON_VERSION_MINOR == 0 && NLOHMANN_JSON_VERSION_PATCH == 0)
-    {
-        return 1;
-    }
-
-    return 0;
-}

tests/src/unit-byte_container_with_subtype.cpp

@@ -42,39 +42,6 @@ TEST_CASE("byte_container_with_subtype")
         CHECK(container.subtype() == static_cast<subtype_type>(-1));
     }
 
-    SECTION("move semantics")
-    {
-        // the rvalue-reference constructor (without a subtype) must actually move
-        // the passed-in container rather than copy it; comparing the buffer address
-        // before and after is a stronger check than just observing the source is
-        // empty afterward, since a copy-then-clear could also leave it empty
-        {
-            std::vector<std::uint8_t> bytes = {{0xCA, 0xFE, 0xBA, 0xBE}};
-            const auto* const data_ptr = bytes.data();
-
-            nlohmann::byte_container_with_subtype<std::vector<std::uint8_t>> container(std::move(bytes));
-
-            CHECK(container.size() == 4);
-            CHECK(container.data() == data_ptr);
-            CHECK(!container.has_subtype());
-            CHECK(bytes.empty()); // NOLINT(bugprone-use-after-move,clang-analyzer-cplusplus.Move,hicpp-invalid-access-moved)
-        }
-
-        // same check for the rvalue-reference constructor that also takes a subtype
-        {
-            std::vector<std::uint8_t> bytes = {{0xCA, 0xFE, 0xBA, 0xBE}};
-            const auto* const data_ptr = bytes.data();
-
-            nlohmann::byte_container_with_subtype<std::vector<std::uint8_t>> container(std::move(bytes), 42);
-
-            CHECK(container.size() == 4);
-            CHECK(container.data() == data_ptr);
-            CHECK(container.has_subtype());
-            CHECK(container.subtype() == 42);
-            CHECK(bytes.empty()); // NOLINT(bugprone-use-after-move,clang-analyzer-cplusplus.Move,hicpp-invalid-access-moved)
-        }
-    }
-
     SECTION("comparisons")
     {
         std::vector<std::uint8_t> const bytes = {{0xCA, 0xFE, 0xBA, 0xBE}};

tests/src/unit-conversions.cpp

@@ -1761,40 +1761,6 @@ TEST_CASE("std::filesystem::path")
 }
 #endif
 
-// the ADL to_json overload for std::u8string only exists under the same guard
-// as std::filesystem::path support (it is otherwise only reached indirectly,
-// via std::filesystem::path::u8string()) -- mirror both #if conditions from
-// include/nlohmann/detail/conversions/to_json.hpp exactly
-#if JSON_HAS_FILESYSTEM || JSON_HAS_EXPERIMENTAL_FILESYSTEM
-#if defined(__cpp_lib_char8_t)
-TEST_CASE("std::u8string")
-{
-    SECTION("ascii")
-    {
-        const std::u8string s = u8"Path";
-        json const j = s;
-
-        CHECK(j.template get<std::string>() == "Path");
-    }
-
-    SECTION("utf-8")
-    {
-        // use \u universal-character-names (rather than raw \x byte escapes
-        // or literal non-ASCII source bytes) to compose the multi-byte UTF-8
-        // encoding -- MSVC treats \x escapes used that way inside a u8
-        // literal as a nonstandard extension (warning C5321), which some of
-        // our CI configs promote to an error; \u is portable and produces
-        // the exact same encoded bytes without depending on the source
-        // file's encoding
-        const std::u8string s = u8"P\u011B\u0161ina";
-        json const j = s;
-
-        CHECK(j.template get<std::string>() == "P\xc4\x9b\xc5\xa1ina");
-    }
-}
-#endif
-#endif
-
 TEST_CASE("std::optional")
 {
     SECTION("null")

tests/src/unit-json_patch.cpp

@@ -672,102 +672,6 @@ TEST_CASE("JSON patch")
         }
     }
 
-    SECTION("patch_inplace")
-    {
-        SECTION("happy path: patch_inplace mirrors patch() on success")
-        {
-            // mirrors "A.5. Replacing a Value" above, but applies the patch with
-            // patch_inplace() to a mutable copy instead of using patch()'s
-            // returned copy
-            json doc = R"(
-                    {
-                        "baz": "qux",
-                        "foo": "bar"
-                    }
-                )"_json;
-
-            json const patch = R"(
-                    [
-                        { "op": "replace", "path": "/baz", "value": "boo" }
-                    ]
-                )"_json;
-
-            json const expected = R"(
-                    {
-                        "baz": "boo",
-                        "foo": "bar"
-                    }
-                )"_json;
-
-            doc.patch_inplace(patch);
-            CHECK(doc == expected);
-        }
-
-        // this test relies on the "test" operation actually throwing so the
-        // partial-application state can be observed right after the throw
-        // point; under JSON_NOEXCEPTION, JSON_THROW() calls std::abort()
-        // instead (there is no C++ exception to throw), and doctest's
-        // CHECK_THROWS_AS() is compiled out to a no-op that never even
-        // invokes the given expression (see doctest's "--no-throw" test
-        // filter, which ci_test_noexceptions passes) -- so patch()/
-        // patch_inplace() would never be called at all and the follow-up
-        // state assertions below would fail against the untouched original
-#if !defined(JSON_NOEXCEPTION)
-        SECTION("distinguishing contract vs patch(): partial application on failure")
-        {
-            // Unlike patch(), which is all-or-nothing because it applies the
-            // patch to an internal copy that is simply discarded when an
-            // exception is thrown (leaving the original untouched no matter
-            // what), patch_inplace() mutates the document it is called on
-            // directly and immediately, operation by operation. So if a JSON
-            // Patch fails partway through, whatever operations already
-            // succeeded remain applied -- the document is left in a partially
-            // patched state. This is empirically verified current behavior,
-            // not just documented intent, and is pinned here as such.
-            json const original = R"(
-                    {
-                        "baz": "qux",
-                        "foo": "bar"
-                    }
-                )"_json;
-
-            // the first operation ("replace") succeeds; the second ("test")
-            // fails because the value at "/baz" no longer (and never did)
-            // equal "not boo"
-            json const patch = R"(
-                    [
-                        { "op": "replace", "path": "/baz", "value": "boo" },
-                        { "op": "test", "path": "/baz", "value": "not boo" }
-                    ]
-                )"_json;
-
-            // patch() never modifies the object it is called on -- it always
-            // operates on (and returns) a separate copy, so the original is
-            // left completely untouched, regardless of success or failure.
-            // copy_for_patch is intentionally a real copy, not a reference
-            // to `original`: the whole point of this check is to catch a
-            // hypothetical future regression where patch() *does* mutate its
-            // receiver. Using a reference here would make the assertion
-            // below compare `original` to itself -- trivially true even if
-            // such a bug existed -- which is exactly what a static analyzer
-            // can't see when it suggests "this copy is never modified, use
-            // a reference instead".
-            json copy_for_patch = original; // NOLINT(performance-unnecessary-copy-initialization)
-            CHECK_THROWS_AS(copy_for_patch.patch(patch), json::other_error&);
-            CHECK(copy_for_patch == original);
-
-            // patch_inplace(), in contrast, already applied the successful
-            // "replace" operation to the document before the "test" operation
-            // threw -- that change is not rolled back
-            json doc = original;
-            CHECK_THROWS_AS(doc.patch_inplace(patch), json::other_error&);
-            CHECK(doc != original);
-            CHECK(doc.at("baz") == "boo");
-            CHECK(doc.at("foo") == "bar");
-        }
-#endif // !defined(JSON_NOEXCEPTION)
-    }
-
     SECTION("errors")
     {
         SECTION("unknown operation")
@@ -1485,6 +1389,192 @@ TEST_CASE("JSON patch - add to a primitive parent (regression #4292)")
     }
 }
 
+TEST_CASE("JSON patch - remove with primitive or null parent (regression #5396)")
+{
+    // Regression test for https://github.com/nlohmann/json/issues/5396
+    //
+    // RFC 6902 (§4.2) requires the target location of a "remove" operation
+    // to exist. When the target's parent resolves to a primitive value or
+    // null, the operation must fail. Previously operation_remove silently
+    // did nothing in this case (neither the "is_object" nor the "is_array"
+    // branch matched, and there was no final "else"), so the patch appeared
+    // to succeed without changing the document. It now throws
+    // out_of_range.413.
+
+    SECTION("parent is a primitive (number)")
+    {
+        json const doc = {{"a", 1}};
+        json const patch = {{{"op", "remove"}, {"path", "/a/b"}}};
+#if JSON_DIAGNOSTICS
+        CHECK_THROWS_WITH_AS(doc.patch(patch), "[json.exception.out_of_range.413] (/a) cannot remove value: the JSON Patch 'remove' target's parent is of type number, but must be an object or array", json::out_of_range&);
+#else
+        CHECK_THROWS_WITH_AS(doc.patch(patch), "[json.exception.out_of_range.413] cannot remove value: the JSON Patch 'remove' target's parent is of type number, but must be an object or array", json::out_of_range&);
+#endif
+    }
+
+    SECTION("parent is a primitive (string)")
+    {
+        json const doc = {{"foo", {{"bar", "a string"}}}};
+        json const patch = {{{"op", "remove"}, {"path", "/foo/bar/baz"}}};
+#if JSON_DIAGNOSTICS
+        CHECK_THROWS_WITH_AS(doc.patch(patch), "[json.exception.out_of_range.413] (/foo/bar) cannot remove value: the JSON Patch 'remove' target's parent is of type string, but must be an object or array", json::out_of_range&);
+#else
+        CHECK_THROWS_WITH_AS(doc.patch(patch), "[json.exception.out_of_range.413] cannot remove value: the JSON Patch 'remove' target's parent is of type string, but must be an object or array", json::out_of_range&);
+#endif
+    }
+
+    SECTION("top-level document is null")
+    {
+        json const doc = nullptr;
+        json const patch = {{{"op", "remove"}, {"path", "/a"}}};
+        CHECK_THROWS_WITH_AS(doc.patch(patch), "[json.exception.out_of_range.413] cannot remove value: the JSON Patch 'remove' target's parent is of type null, but must be an object or array", json::out_of_range&);
+    }
+
+    SECTION("legitimate removes still work")
+    {
+        // object member
+        json const doc1 = {{"a", 1}, {"b", 2}};
+        json const patch1 = {{{"op", "remove"}, {"path", "/a"}}};
+        CHECK(doc1.patch(patch1) == json({{"b", 2}}));
+
+        // array element
+        json const doc2 = R"([1, 2, 3])"_json;
+        json const patch2 = {{{"op", "remove"}, {"path", "/1"}}};
+        CHECK(doc2.patch(patch2) == R"([1, 3])"_json);
+    }
+}
+
+TEST_CASE("JSON patch - move where 'from' is a proper prefix of 'path' (regression #5397)")
+{
+    // Regression test for https://github.com/nlohmann/json/issues/5397
+    //
+    // RFC 6902 (§4.4) forbids "from" from being a proper prefix of "path"
+    // for a "move" operation: "a location cannot be moved into one of its
+    // children." "move" is implemented as remove-then-add; for an object
+    // target this happened to throw anyway as a side effect of the "add"
+    // step re-resolving through the now-removed parent, but for an array
+    // target the removal shifted subsequent indices, so "path" silently
+    // re-resolved to a different element and the operation "succeeded"
+    // with a corrupted result. It now throws out_of_range.414 for both
+    // object and array targets.
+
+    SECTION("array target (from the issue)")
+    {
+        json const doc = R"([[1,2],[3]])"_json;
+        json const patch = {{{"op", "move"}, {"from", "/0"}, {"path", "/0/0"}}};
+#if JSON_DIAGNOSTIC_POSITIONS
+        CHECK_THROWS_WITH_AS(doc.patch(patch), "[json.exception.out_of_range.414] (bytes 0-11) cannot move value: 'from' path '/0' is a proper prefix of 'path' '/0/0'", json::out_of_range&);
+#else
+        CHECK_THROWS_WITH_AS(doc.patch(patch), "[json.exception.out_of_range.414] cannot move value: 'from' path '/0' is a proper prefix of 'path' '/0/0'", json::out_of_range&);
+#endif
+    }
+
+    SECTION("object target")
+    {
+        json const doc = R"({"a": {"b": 1}})"_json;
+        json const patch = {{{"op", "move"}, {"from", "/a"}, {"path", "/a/b"}}};
+#if JSON_DIAGNOSTIC_POSITIONS
+        CHECK_THROWS_WITH_AS(doc.patch(patch), "[json.exception.out_of_range.414] (bytes 0-15) cannot move value: 'from' path '/a' is a proper prefix of 'path' '/a/b'", json::out_of_range&);
+#else
+        CHECK_THROWS_WITH_AS(doc.patch(patch), "[json.exception.out_of_range.414] cannot move value: 'from' path '/a' is a proper prefix of 'path' '/a/b'", json::out_of_range&);
+#endif
+    }
+
+    SECTION("from == path is not a proper prefix and must not be rejected")
+    {
+        // "from" equal to "path" is a no-op move; it is not a *proper*
+        // prefix relationship, so this new check must not reject it.
+        json const doc = R"({"a": 1, "b": 2})"_json;
+        json const patch = {{{"op", "move"}, {"from", "/a"}, {"path", "/a"}}};
+        CHECK(doc.patch(patch) == doc);
+    }
+
+    SECTION("raw string prefix that is not a pointer-token prefix must be allowed")
+    {
+        // "/ab" is a string-prefix of "/abc/x" as raw text, but "ab" and
+        // "abc" are different reference tokens, so this is NOT a
+        // pointer-token prefix relationship and the move must succeed.
+        // This is the key case proving the check compares tokens, not
+        // raw pointer text (a naive std::string prefix/rfind check on
+        // the undecoded pointer would wrongly reject this).
+        json const doc = R"({"ab": 1, "abc": {"x": 2}})"_json;
+        json const patch = {{{"op", "move"}, {"from", "/ab"}, {"path", "/abc/x"}}};
+        json const result = R"({"abc": {"x": 1}})"_json;
+        CHECK(doc.patch(patch) == result);
+    }
+
+    SECTION("escaped reference tokens are compared unescaped")
+    {
+        // "from" is the single token "a/b" (escaped as "a~1b"); "path"
+        // addresses member "x" of that same value, so "from" is a
+        // proper (token-level) prefix of "path" and must be rejected.
+        json const doc = R"({"a/b": {"x": 1}})"_json;
+        json const patch = {{{"op", "move"}, {"from", "/a~1b"}, {"path", "/a~1b/x"}}};
+#if JSON_DIAGNOSTIC_POSITIONS
+        CHECK_THROWS_WITH_AS(doc.patch(patch), "[json.exception.out_of_range.414] (bytes 0-17) cannot move value: 'from' path '/a~1b' is a proper prefix of 'path' '/a~1b/x'", json::out_of_range&);
+#else
+        CHECK_THROWS_WITH_AS(doc.patch(patch), "[json.exception.out_of_range.414] cannot move value: 'from' path '/a~1b' is a proper prefix of 'path' '/a~1b/x'", json::out_of_range&);
+#endif
+    }
+
+    SECTION("ordinary valid moves still work")
+    {
+        // unrelated top-level members
+        json const doc1 = R"({"a": 1, "b": 2})"_json;
+        json const patch1 = {{{"op", "move"}, {"from", "/a"}, {"path", "/c"}}};
+        CHECK(doc1.patch(patch1) == R"({"b": 2, "c": 1})"_json);
+
+        // sibling paths that share a textual prefix but are unrelated
+        json const doc2 = R"({"a": {"x": 1}, "b": {"y": 2}})"_json;
+        json const patch2 = {{{"op", "move"}, {"from", "/a/x"}, {"path", "/b/z"}}};
+        CHECK(doc2.patch(patch2) == R"({"a": {}, "b": {"y": 2, "z": 1}})"_json);
+
+        // "path" is a proper prefix of "from" (the reverse relationship,
+        // which RFC 6902 does not forbid)
+        json const doc3 = R"({"a": {"b": 1}})"_json;
+        json const patch3 = {{{"op", "move"}, {"from", "/a/b"}, {"path", "/a"}}};
+        CHECK(doc3.patch(patch3) == R"({"a": 1})"_json);
+    }
+
+    SECTION("root 'from' is a proper prefix of every non-root 'path'")
+    {
+        // the whole document is a proper prefix of any location inside it
+        json const doc = R"({"a": 1})"_json;
+        json const patch = {{{"op", "move"}, {"from", ""}, {"path", "/a"}}};
+#if JSON_DIAGNOSTIC_POSITIONS
+        CHECK_THROWS_WITH_AS(doc.patch(patch), "[json.exception.out_of_range.414] (bytes 0-8) cannot move value: 'from' path '' is a proper prefix of 'path' '/a'", json::out_of_range&);
+#else
+        CHECK_THROWS_WITH_AS(doc.patch(patch), "[json.exception.out_of_range.414] cannot move value: 'from' path '' is a proper prefix of 'path' '/a'", json::out_of_range&);
+#endif
+    }
+
+    SECTION("root 'path' is never a proper prefix violation for a non-root 'from'")
+    {
+        // the reverse of the above: moving a non-root location to the root
+        // is the "path is a prefix of from" relationship, which RFC 6902
+        // permits (already covered generally above; this pins the root
+        // case specifically, since root is the one path with no reference
+        // tokens at all)
+        json const doc = R"({"a": {"b": 1}})"_json;
+        json const patch = {{{"op", "move"}, {"from", "/a"}, {"path", ""}}};
+        CHECK(doc.patch(patch) == R"({"b": 1})"_json);
+    }
+
+    SECTION("the array-append token '-' is an ordinary child token")
+    {
+        // "-" (append-to-array) addresses a location *inside* the array,
+        // so "from" pointing at the array is still a proper prefix of
+        // "path" ending in "-" and must be rejected like any other child.
+        json const doc = R"({"a": [1, 2]})"_json;
+        json const patch = {{{"op", "move"}, {"from", "/a"}, {"path", "/a/-"}}};
+#if JSON_DIAGNOSTIC_POSITIONS
+        CHECK_THROWS_WITH_AS(doc.patch(patch), "[json.exception.out_of_range.414] (bytes 0-13) cannot move value: 'from' path '/a' is a proper prefix of 'path' '/a/-'", json::out_of_range&);
+#else
+        CHECK_THROWS_WITH_AS(doc.patch(patch), "[json.exception.out_of_range.414] cannot move value: 'from' path '/a' is a proper prefix of 'path' '/a/-'", json::out_of_range&);
+#endif
+    }
+}
+
 TEST_CASE("JSON patch - diff emits array removals in descending index order")
 {
     SECTION("array shrunk to empty")

tests/src/unit-no-mem-leak-on-adl-serialize.cpp

@@ -70,7 +70,7 @@ TEST_CASE("check_for_mem_leak_on_adl_to_json-2")
     }
 }
 
-TEST_CASE("check_for_mem_leak_on_adl_to_json-3")
+TEST_CASE("check_for_mem_leak_on_adl_to_json-2")
 {
     try
     {

tests/src/unit-no_io_and_user_exceptions.cpp

@@ -1,91 +0,0 @@
-//     __ _____ _____ _____
-//  __|  |   __|     |   | |  JSON for Modern C++ (supporting code)
-// |  |  |__   |  |  | | | |  version 3.12.0
-// |_____|_____|_____|_|___|  https://github.com/nlohmann/json
-//
-// SPDX-FileCopyrightText: 2013-2026 Niels Lohmann <https://nlohmann.me>
-// SPDX-License-Identifier: MIT
-
-// This translation unit is a dedicated, small compile-and-run check for two
-// configuration macros that (per #5423) were never exercised anywhere in the
-// test matrix:
-// - JSON_NO_IO, which removes the library's <istream>/<ostream> support
-//   (operator<<, operator>>, and the stream-based overloads of dump()/parse())
-// - the JSON_THROW_USER / JSON_TRY_USER / JSON_CATCH_USER trio, which lets a
-//   user replace the library's internal exception handling
-//
-// Both macros are about excluding/replacing a facility the library would
-// otherwise pull in on its own, and defining one has no bearing on the other,
-// so -- to keep the test matrix small -- they are exercised together in a
-// single dedicated file instead of two.
-//
-// JSON_NO_IO requires this file itself to never rely on <iostream>/<sstream>;
-// only string-based parsing/dumping is used below.
-#define JSON_NO_IO 1
-
-// The user-supplied exception macros below are a *conforming* replacement:
-// they simply forward to the real throw/try/catch keywords (via a counter so
-// the test can assert each macro was actually invoked, not just defined), so
-// every exception-related behavior the library relies on internally --
-// including rethrowing std::out_of_range as json::out_of_range in at() --
-// keeps working exactly as it would with the library's own default macros.
-static int json_throw_user_call_count = 0; // NOLINT(cppcoreguidelines-avoid-non-const-global-variables)
-
-#define JSON_THROW_USER(exception) do { ++json_throw_user_call_count; throw (exception); } while (false) // NOLINT(cppcoreguidelines-macro-usage)
-#define JSON_TRY_USER try // NOLINT(cppcoreguidelines-macro-usage)
-#define JSON_CATCH_USER(exception) catch (exception) // NOLINT(cppcoreguidelines-macro-usage)
-
-#include "doctest_compatibility.h"
-
-#include <nlohmann/json.hpp>
-using json = nlohmann::json;
-
-TEST_CASE("JSON_NO_IO")
-{
-    // everything that does not touch <istream>/<ostream> must keep working:
-    // parsing from and dumping to std::string
-    const json j = json::parse(R"({"a":[1,2,3],"b":true})");
-    CHECK(j.dump() == R"({"a":[1,2,3],"b":true})");
-    CHECK(j.at("a").size() == 3);
-    CHECK(j.at("b").get<bool>() == true);
-}
-
-// this test relies on CHECK_THROWS_AS() actually invoking the guarded
-// expression so json_throw_user_call_count gets bumped and can be observed
-// afterwards; doctest's "--no-throw" test filter (which ci_test_noexceptions
-// passes, together with a global -DJSON_NOEXCEPTION added to CMAKE_CXX_FLAGS
-// for every translation unit in that build, this file included) compiles
-// CHECK_THROWS_AS() out to a no-op that never even invokes the given
-// expression -- so json::parse()/at() below would never be called at all and
-// the call-count assertions would fail even though our JSON_THROW_USER
-// override (which always really throws, regardless of JSON_NOEXCEPTION) would
-// have worked fine on its own
-#if !defined(JSON_NOEXCEPTION)
-TEST_CASE("JSON_THROW_USER, JSON_TRY_USER, JSON_CATCH_USER")
-{
-    json_throw_user_call_count = 0;
-
-    // json::parse() is [[nodiscard]] (JSON_HEDLEY_WARN_UNUSED_RESULT); under
-    // GCC in C++11 mode that expands to __attribute__((warn_unused_result)),
-    // which -- unlike a [[nodiscard]] attribute proper -- GCC does not
-    // consider satisfied by doctest's CHECK_THROWS_AS() wrapping the
-    // expression in a (void) cast, so the discarded return value would still
-    // be flagged under -Werror=unused-result; assign it to discard it instead,
-    // matching the established `json _ = json::parse(...)` pattern used
-    // elsewhere in the test suite (see unit-class_parser.cpp)
-    json _; // NOLINT(readability-identifier-naming)
-
-    // a parse error goes through JSON_THROW directly, i.e., through our
-    // JSON_THROW_USER override
-    CHECK_THROWS_AS(_ = json::parse("this is not JSON"), json::parse_error&);
-    CHECK(json_throw_user_call_count > 0);
-
-    // at() on an out-of-range array index internally catches std::out_of_range
-    // (JSON_TRY_USER/JSON_CATCH_USER) and rethrows it as json::out_of_range
-    // (JSON_THROW_USER again), so this exercises all three macros together
-    const int count_before = json_throw_user_call_count;
-    const json arr = json::array({1, 2, 3});
-    CHECK_THROWS_AS(arr.at(10), json::out_of_range&);
-    CHECK(json_throw_user_call_count > count_before);
-}
-#endif

tests/src/unit-regression2.cpp

@@ -18,14 +18,6 @@
 // for some reason including this after the json header leads to linker errors with VS 2017...
 #include <locale>
 
-// skip tests if JSON_DisableEnumSerialization=ON (#4384): std::byte is a
-// scoped enum, so get<std::byte>() (needed below to get<std::vector<std::byte>>()
-// from a plain JSON array, not just from an already-binary value) relies on
-// enum serialization being enabled
-#if defined(JSON_DISABLE_ENUM_SERIALIZATION) && (JSON_DISABLE_ENUM_SERIALIZATION == 1)
-    #define SKIP_TESTS_FOR_ENUM_SERIALIZATION
-#endif
-
 #define JSON_TESTS_PRIVATE
 #include <nlohmann/json.hpp>
 using json = nlohmann::json;
@@ -1144,7 +1136,6 @@ TEST_CASE("regression tests 2")
         CHECK((decoded == json_4804::array()));
     }
 
-#ifndef SKIP_TESTS_FOR_ENUM_SERIALIZATION
     SECTION("discussion #4209 - custom BinaryType direct assignment and round-tripping")
     {
         // Test that assigning a custom BinaryType directly creates a binary value, not an array
@@ -1178,7 +1169,6 @@ TEST_CASE("regression tests 2")
         CHECK(extracted[1] == std::byte{2});
         CHECK(extracted[2] == std::byte{3});
     }
-#endif
 
     SECTION("issue #5046 - implicit conversion of return json to std::optional no longer implicit")
     {

tests/src/unit-std-format.cpp

@@ -52,23 +52,6 @@ TEST_CASE("std::formatter<nlohmann::json>")
         CHECK(std::format("{:2}", j) == j.dump(2));
         CHECK(std::format("{:#2}", j) == j.dump(2));
         CHECK(std::format("{:8}", j) == j.dump(8));
-        // multi-digit widths must accumulate every digit, not just the first
-        CHECK(std::format("{:12}", j) == j.dump(12));
-        CHECK(std::format("{:#12}", j) == j.dump(12));
-        CHECK(std::format("{:10}", j) == j.dump(10));
-    }
-
-    SECTION("bare alignment with no fill character defaults to a space indent character")
-    {
-        const json j = {{"foo", 1}, {"bar", {1, 2, 3}}};
-        // without a preceding fill character, the alignment character itself must not
-        // be mistaken for the indent character -- the default space is kept
-        CHECK(std::format("{:<}", j) == j.dump());
-        CHECK(std::format("{:>}", j) == j.dump());
-        CHECK(std::format("{:^}", j) == j.dump());
-        CHECK(std::format("{:<3}", j) == j.dump(3, ' '));
-        CHECK(std::format("{:>3}", j) == j.dump(3, ' '));
-        CHECK(std::format("{:^3}", j) == j.dump(3, ' '));
     }
 
     SECTION("fill-and-align sets the indent character, like dump(indent, indent_char)")