Fix Semgrep findings in Python tooling (#5899 )

- generate_docset.py: use SHA-256 instead of SHA-1 for the cache file name digest of downloaded images. - generate_docset.py: suppress dynamic-urllib-use-detected; the URL scheme is restricted to http(s) right before the call. - generate_natvis.py: suppress direct-use-of-jinja2; the template renders a local XML file with autoescape enabled. Signed-off-by: Niels Lohmann <mail@nlohmann.me>
Bump jsdom from 30.1.2 to 30.1.3 in /docs/mkdocs/scripts/mermaid (#5898 )
2026-10-23 06:18:56 +00:00 · 2026-10-23 07:11:17 +02:00 · 2026-10-23 06:54:23 +02:00 · 2026-10-23 06:54:07 +02:00 · 2026-10-23 06:53:50 +02:00 · 2026-10-23 06:53:32 +02:00
31 changed files with 7108 additions and 3751 deletions
@@ -38,14 +38,14 @@ jobs:
    # Initializes the CodeQL tools for scanning.
    - name: Initialize CodeQL
-      uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
+      uses: github/codeql-action/init@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
      with:
        languages: c-cpp
    # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
    # If this step fails, then you should remove it and run the build manually (see below)
    - name: Autobuild
-      uses: github/codeql-action/autobuild@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
+      uses: github/codeql-action/autobuild@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
+      uses: github/codeql-action/analyze@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
@@ -37,6 +37,14 @@ jobs:
            var matchArtifact = artifacts.data.artifacts.filter((artifact) => {
              return artifact.name == "pr"
            })[0];
            // a run that failed before its jobs started (e.g. a stale queued
            // run cancelled long after its push) has no artifact to report on
            if (!matchArtifact) {
              core.notice('Run ${{ github.event.workflow_run.id }} has no "pr" artifact; nothing to comment on.');
              core.setOutput('found', 'false');
              return;
            }
            core.setOutput('found', 'true');
            var download = await github.rest.actions.downloadArtifact({
               owner: context.repo.owner,
               repo: context.repo.repo,
@@ -51,9 +59,11 @@ jobs:
      # Extract the untrusted PR artifact into a dedicated empty directory and
      # read only the two expected files by fixed path afterwards. This avoids a
      # malicious archive overwriting workspace files or escaping via ../ paths.
-      - run: unzip -o pr.zip -d ./pr_artifact
+      - if: steps.download.outputs.found == 'true'
        run: unzip -o pr.zip -d ./pr_artifact
      - name: 'Comment on PR'
        if: steps.download.outputs.found == 'true'
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
@@ -47,6 +47,6 @@ jobs:
          output: 'flawfinder_results.sarif'
      - name: Upload analysis results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
+        uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
        with:
          sarif_file: ${{github.workspace}}/flawfinder_results.sarif
@@ -54,7 +54,7 @@ jobs:
    timeout-minutes: 60
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+        uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1
        with:
          egress-policy: audit
@@ -78,7 +78,7 @@ jobs:
      - name: Summary
        run: cat tests/benchmarks/json_view/results/*.md >> "$GITHUB_STEP_SUMMARY"
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: json_view-benchmarks-${{ matrix.runner }}-${{ inputs.compiler || 'g++' }}
          path: tests/benchmarks/json_view/results/
@@ -80,6 +80,6 @@ jobs:
      # Upload the results to GitHub's code scanning dashboard.
      - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
+        uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
        with:
          sarif_file: results.sarif
@@ -65,7 +65,7 @@ jobs:
      # Upload SARIF file generated in previous step
      - name: Upload SARIF file
-        uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
+        uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
        with:
          sarif_file: semgrep.sarif
        if: always()
@@ -341,13 +341,14 @@ def download(url, docs) -> str:
        raise ValueError(f'not an http(s) URL: {url}')
    req = urllib.request.Request(u.geturl(), headers={'User-Agent': USER_AGENT})
    # (the scheme is checked above)
    # nosemgrep: python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected
    with urllib.request.urlopen(req, timeout=20) as r:  # nosec B310
        data = r.read()
        ctype = r.headers.get_content_type()
    path = urllib.parse.unquote(u.path).lstrip('/')
    ext = os.path.splitext(path)[1]
    if u.query or not ext or path.endswith('/'):
-        digest = hashlib.sha1(url.encode(), usedforsecurity=False).hexdigest()[:12]
+        digest = hashlib.sha256(url.encode()).hexdigest()[:12]
        path = os.path.join(os.path.dirname(path), digest + CONTENT_TYPE_EXT.get(ctype, ext or '.bin'))
    rel = os.path.normpath(os.path.join('assets', 'external', u.hostname, path))
    out = os.path.join(docs, rel)
@@ -339,6 +339,11 @@ The `serializer` (used by [`dump`](../api/basic_json/dump.md) and [`operator<<`]
 - `output_stream_adapter` writes to a `std::ostream`.
 - `output_string_adapter` appends to a string.
 The `binary_writer` does not call an adapter for every byte. The `to_*` functions that return a `std::vector` write
 into the vector through a sink (`output_vector_sink`) that is not virtual. The functions that take an output adapter
 write through a sink (`output_adapter_sink`) that collects the output in a buffer of one kibibyte and passes it to the
 adapter in blocks, so that the adapter is called (and a stream locked) once per block instead of once per value.
 ## Value conversion
 Values are converted from and to other types with the `JSONSerializer` template parameter. The default,
@@ -6,7 +6,7 @@
    "": {
      "name": "check-mermaid",
      "dependencies": {
-        "jsdom": "30.1.2",
+        "jsdom": "30.1.3",
        "mermaid": "11.17.2"
      }
    },
@@ -40,9 +40,9 @@
      }
    },
    "node_modules/@asamuzakjp/dom-selector": {
-      "version": "9.2.4",
+      "version": "10.0.3",
-      "resolved": "https://registry.npmjs.org/@asamuzakjp/dom-selector/-/dom-selector-9.2.4.tgz",
+      "resolved": "https://registry.npmjs.org/@asamuzakjp/dom-selector/-/dom-selector-10.0.3.tgz",
-      "integrity": "sha512-YnVzxDxLaqL0t7Q4wfcgHZjg55Wm6y5EaO7Bhu3q9J7wq/8iw3PhsnWiOQhYekx4VexnbkgWpTT6n+QIV7kczw==",
+      "integrity": "sha512-3+777rEPsOOjoy5/sRmIzHnoRDaLpm3XWY2dmWn/N7f/XwDG0bcpnFaKL3X9FYJUbNwLmpcJC1bUYexJRxsFlw==",
      "license": "MIT",
      "dependencies": {
        "bidi-js": "^1.1.0",
@@ -1202,13 +1202,13 @@
      "license": "MIT"
    },
    "node_modules/jsdom": {
-      "version": "30.1.2",
+      "version": "30.1.3",
-      "resolved": "https://registry.npmjs.org/jsdom/-/jsdom-30.1.2.tgz",
+      "resolved": "https://registry.npmjs.org/jsdom/-/jsdom-30.1.3.tgz",
-      "integrity": "sha512-0FFE/jE1rppmVfUrJUgxqXjcwolZYIGtAgj1pTussMhNZxIxi7W/PvfWaMNroGi2B36X1IKHbexpZ9DhkoOPiQ==",
+      "integrity": "sha512-hQMUPvRgN7KxsfIytDQji7bimuJeRQa6Qo5+iuiZQk5CafeRxLIA10/cG5YCBFNpD9RO3oqIiN4CO1Y44kxqXg==",
      "license": "MIT",
      "dependencies": {
        "@asamuzakjp/css-color": "^7.1.3",
-        "@asamuzakjp/dom-selector": "^9.2.4",
+        "@asamuzakjp/dom-selector": "^10.0.3",
        "@bramus/specificity": "^2.4.2",
        "@csstools/css-syntax-patches-for-csstree": "^1.1.15",
        "@exodus/bytes": "^1.16.0",
@@ -1221,7 +1221,7 @@
        "parse5": "^8.0.1",
        "saxes": "^6.0.0",
        "tough-cookie": "^6.0.2",
-        "undici": "^8.11.2",
+        "undici": "^8.12.1",
        "w3c-xmlserializer": "^6.0.0",
        "webidl-conversions": "^8.0.1",
        "whatwg-mimetype": "^5.0.0",
@@ -1521,9 +1521,9 @@
      }
    },
    "node_modules/undici": {
-      "version": "8.11.2",
+      "version": "8.12.2",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-8.11.2.tgz",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-8.12.2.tgz",
-      "integrity": "sha512-u4UB2/IrKdU6lFxumHmmo1a3fCQO5tzQllRorfoRS63txhrB7xTpSn1PftwC4qEHkOaqP95fCWW4lJzwErwzhQ==",
+      "integrity": "sha512-XtuDWVdqTLr3NAxm2ly9/hU6kUsJOgGh1RASzMBbsw6aWCOaQzHdW+QQDfdERjfJ2V5vL5pRPa4RetO9UfivDg==",
      "license": "MIT",
      "engines": {
        "node": ">=22.19.0"
@@ -4,7 +4,7 @@
  "description": "Validate the Mermaid diagrams of the documentation (see check_mermaid.mjs)",
  "type": "module",
  "dependencies": {
-    "jsdom": "30.1.2",
+    "jsdom": "30.1.3",
    "mermaid": "11.17.2"
  }
 }
@@ -86,7 +86,7 @@ JSON_INLINE_VARIABLE constexpr std::size_t max_valueless_container_size = 1 << 2
 /*!
@brief deserialization of BJData, BON8, BSON, CBOR, MessagePack, and UBJSON values
 */
-template<typename BasicJsonType, typename InputAdapterType, typename SAX = json_sax_dom_binary_parser<BasicJsonType, InputAdapterType>>
+template<typename BasicJsonType, typename InputAdapterType, typename SAX = json_sax_dom_parser<BasicJsonType, InputAdapterType>>
 class binary_reader
 {
    using number_integer_t = typename BasicJsonType::number_integer_t;
@@ -8,17 +8,18 @@
 #pragma once
-#include <algorithm> // count, find, min
+#include <algorithm> // count, find, max, min
 #include <array> // array
 #include <cstddef> // size_t
 #include <cstdint> // uint32_t
 #include <cstring> // strlen
 #include <iterator> // begin, end, iterator_traits, random_access_iterator_tag, distance, next, reverse_iterator
 #include <limits> // numeric_limits
 #include <memory> // unique_ptr
 #include <streambuf> // streambuf
 #include <string> // string, char_traits
 #include <type_traits> // enable_if, is_base_of, is_pointer, is_integral, remove_pointer
-#include <utility> // pair, declval
+#include <utility> // declval, move, pair
 #include <vector> // vector
 #ifndef JSON_NO_IO
@@ -72,6 +73,82 @@ enum class input_format_t { json, cbor, msgpack, ubjson, bson, bjdata, bon8 };
 #ifndef JSON_NO_IO
 /*!
 A growable array of characters for the part of a token that an input adapter
 copied out of its window: unlike std::vector<char>::push_back(), appending a
 character takes no reference to a local, and is a few instructions when there
 is room.
 */
 class token_carry_buffer
 {
  public:
    token_carry_buffer() = default;
    token_carry_buffer(const token_carry_buffer&) = delete;
    token_carry_buffer& operator=(const token_carry_buffer&) = delete;
    token_carry_buffer(token_carry_buffer&& rhs) noexcept
        : m_data(std::move(rhs.m_data)), m_end(rhs.m_end), m_capacity_end(rhs.m_capacity_end)
    {
        rhs.m_end = rhs.m_capacity_end = nullptr;
    }
    token_carry_buffer& operator=(token_carry_buffer&&) = delete;
    ~token_carry_buffer() = default;
    void clear() noexcept
    {
        m_end = m_data.get();
    }
    void push_back(char c)
    {
        if (JSON_HEDLEY_UNLIKELY(m_end == m_capacity_end))
        {
            grow(1);
        }
        *m_end++ = c;
    }
    void append(const char* first, const char* last)
    {
        const auto n = static_cast<std::size_t>(last - first);
        const auto room = static_cast<std::size_t>(m_capacity_end - m_end);
        if (n > room)
        {
            grow(n);
        }
        if (n != 0)
        {
            std::memcpy(m_end, first, n);
        }
        m_end += n;
    }
    /// replace the contents of @a out
    void copy_to(std::vector<char>& out) const
    {
        out.assign(m_data.get(), m_end);
    }
  private:
    /// make room for @a extra more characters
    JSON_HEDLEY_NEVER_INLINE void grow(std::size_t extra)
    {
        const auto size = static_cast<std::size_t>(m_end - m_data.get());
        const auto capacity = static_cast<std::size_t>(m_capacity_end - m_data.get());
        const std::size_t new_capacity = (std::max)(capacity < 32 ? static_cast<std::size_t>(32) : 2 * capacity, size + extra);
        std::unique_ptr<char[]> data(new char[new_capacity]); // NOLINT(cppcoreguidelines-avoid-c-arrays,hicpp-avoid-c-arrays,modernize-avoid-c-arrays)
        if (size != 0)
        {
            std::memcpy(data.get(), m_data.get(), size);
        }
        m_data = std::move(data);
        m_end = m_data.get() + size;
        m_capacity_end = m_data.get() + new_capacity;
    }
    std::unique_ptr<char[]> m_data{}; // NOLINT(cppcoreguidelines-avoid-c-arrays,hicpp-avoid-c-arrays,modernize-avoid-c-arrays,readability-redundant-member-init)
    char* m_end = nullptr;
    char* m_capacity_end = nullptr;
 };
 /*!
 Input adapter for stdio file access. This adapter read only 1 byte and do not use any
 buffer. This adapter is a very low level adapter.
 */
@@ -209,6 +286,7 @@ class input_stream_adapter
        , token_segment(rhs.token_segment)
        , current_in_get_area(rhs.current_in_get_area)
        , tracking_token(rhs.tracking_token)
        , no_get_area(rhs.no_get_area)
 #endif
    {
        rhs.is = nullptr;
@@ -295,37 +373,20 @@ class input_stream_adapter
    std::char_traits<char>::int_type get_character()
    {
 #if !JSON_DISABLE_STREAM_BULK_SCAN
-        // sbumpc() refills the get area if it is exhausted
+        // the character is in the get area: step over it, as sbumpc() does
-        const bool refill = streambuf_access::get_ptr(sb) == streambuf_access::get_end(sb);
+        const char* const next = streambuf_access::get_ptr(sb);
-        if (JSON_HEDLEY_UNLIKELY(refill))
+        if (JSON_HEDLEY_LIKELY(next != streambuf_access::get_end(sb)))
        {
            save_token_segment();
        }
 #endif
        auto res = sb->sbumpc();
        // set eof manually, as we don't use the istream interface.
        if (JSON_HEDLEY_UNLIKELY(res == std::char_traits<char>::eof()))
        {
 #if !JSON_DISABLE_STREAM_BULK_SCAN
            current_in_get_area = false;
 #endif
            is->clear(is->rdstate() | std::ios::eofbit);
        }
 #if !JSON_DISABLE_STREAM_BULK_SCAN
        else if (JSON_HEDLEY_UNLIKELY(refill))
        {
            // the consumed character is at gptr() - 1, unless the streambuf
            // has no get area and returned it from uflow()
            const char* const next = streambuf_access::get_ptr(sb);
            after_refill(res, next != nullptr && next != streambuf_access::get_begin(sb));
        }
        else
        {
            current_in_get_area = true;
            streambuf_access::bump(sb, 1);
            return std::char_traits<char>::to_int_type(*next);
        }
        if (no_get_area)
        {
            return get_character_no_get_area();
        }
 #endif
-        return res;
+        return get_character_slow();
    }
 #endif
@@ -334,6 +395,18 @@ class input_stream_adapter
    {
 #if JSON_PRECISE_STREAM_POSITION
        commit_lookahead();
 #endif
 #if !JSON_DISABLE_STREAM_BULK_SCAN
        // the elements are in the get area: copy them, as sgetn() does, but
        // without the virtual call
        const char* const first = streambuf_access::get_ptr(sb);
        const auto available = static_cast<std::size_t>(streambuf_access::get_end(sb) - first);
        if (JSON_HEDLEY_LIKELY(count * sizeof(T) <= available && count * sizeof(T) <= static_cast<std::size_t>((std::numeric_limits<int>::max)())))
        {
            std::memcpy(dest, first, count * sizeof(T));
            streambuf_access::bump(sb, static_cast<int>(count * sizeof(T)));
            return count * sizeof(T);
        }
 #endif
        auto res = static_cast<std::size_t>(sb->sgetn(reinterpret_cast<char*>(dest), static_cast<std::streamsize>(count * sizeof(T))));
        if (JSON_HEDLEY_UNLIKELY(res < count * sizeof(T)))
@@ -421,7 +494,7 @@ class input_stream_adapter
    // last one if @a drop_last.
    void copy_token(std::vector<char>& out, bool drop_last) const
    {
-        out = token_carry;
+        token_carry.copy_to(out);
        if (token_segment != nullptr)
        {
            out.insert(out.end(), token_segment, current_end());
@@ -434,6 +507,47 @@ class input_stream_adapter
 #endif
  private:
 #if !JSON_PRECISE_STREAM_POSITION
    // the get area is exhausted, or there is none
 #if !JSON_DISABLE_STREAM_BULK_SCAN
    JSON_HEDLEY_NEVER_INLINE
 #endif
    std::char_traits<char>::int_type get_character_slow()
    {
 #if !JSON_DISABLE_STREAM_BULK_SCAN
        // sbumpc() refills the get area if it is exhausted
        const bool refill = streambuf_access::get_ptr(sb) == streambuf_access::get_end(sb);
        if (JSON_HEDLEY_UNLIKELY(refill))
        {
            save_token_segment();
        }
 #endif
        auto res = sb->sbumpc();
        // set eof manually, as we don't use the istream interface.
        if (JSON_HEDLEY_UNLIKELY(res == std::char_traits<char>::eof()))
        {
 #if !JSON_DISABLE_STREAM_BULK_SCAN
            current_in_get_area = false;
 #endif
            is->clear(is->rdstate() | std::ios::eofbit);
        }
 #if !JSON_DISABLE_STREAM_BULK_SCAN
        else if (JSON_HEDLEY_UNLIKELY(refill))
        {
            // the consumed character is at gptr() - 1, unless the streambuf
            // has no get area and returned it from uflow()
            const char* const next = streambuf_access::get_ptr(sb);
            after_refill(res, next != nullptr && next != streambuf_access::get_begin(sb));
        }
        else
        {
            current_in_get_area = true;
        }
 #endif
        return res;
    }
 #endif
 #if !JSON_DISABLE_STREAM_BULK_SCAN
    // Reads the protected get-area pointers of any std::streambuf. Naming the
    // members through a derived class makes forming the member pointers
@@ -457,6 +571,11 @@ class input_stream_adapter
        {
            (s->*(&streambuf_access::gbump))(n);
        }
        // sbumpc() for an exhausted get area
        static std::streambuf::int_type next_character(std::streambuf* s)
        {
            return (s->*(&streambuf_access::uflow))();
        }
    };
    // one past the character last returned by get_character(), if that is in
@@ -477,16 +596,53 @@ class input_stream_adapter
    {
        if (token_segment != nullptr)
        {
-            token_carry.insert(token_carry.end(), token_segment, streambuf_access::get_end(sb));
+            token_carry.append(token_segment, streambuf_access::get_end(sb));
            token_segment = nullptr;
        }
    }
 #if !JSON_PRECISE_STREAM_POSITION
    // The streambuf has no get area (e.g., std::cin synchronized with stdio):
    // every character comes from uflow(), and the token is kept by value.
    JSON_HEDLEY_NEVER_INLINE std::char_traits<char>::int_type get_character_no_get_area()
    {
        // the get area is exhausted, so this is what sbumpc() does
        const auto res = streambuf_access::next_character(sb);
        if (JSON_HEDLEY_UNLIKELY(res == std::char_traits<char>::eof() || streambuf_access::get_end(sb) != nullptr))
        {
            return get_character_no_get_area_other(res);
        }
        // current_in_get_area is false: only the first character of a get
        // area, or the end of the input, is read here
        if (tracking_token)
        {
            token_carry.push_back(std::char_traits<char>::to_char_type(res));
        }
        return res;
    }
    // @a res came from uflow() of a streambuf without a get area: it is the
    // end of the input, or the streambuf has a get area now
    JSON_HEDLEY_NEVER_INLINE std::char_traits<char>::int_type get_character_no_get_area_other(std::char_traits<char>::int_type res)
    {
        if (res == std::char_traits<char>::eof())
        {
            current_in_get_area = false;
            is->clear(is->rdstate() | std::ios::eofbit);
            return res;
        }
        // the consumed character is at gptr() - 1
        after_refill(res, streambuf_access::get_ptr(sb) != streambuf_access::get_begin(sb));
        return res;
    }
 #endif
    // character @a c was just read into a new get area (@a in_get_area) or
    // returned without one
    void after_refill(std::char_traits<char>::int_type c, bool in_get_area)
    {
        current_in_get_area = in_get_area;
        no_get_area = !in_get_area;
        if (!tracking_token)
        {
            return;
@@ -525,13 +681,16 @@ class input_stream_adapter
 #endif
 #if !JSON_DISABLE_STREAM_BULK_SCAN
    /// the part of the current token that was in earlier get areas
-    std::vector<char> token_carry{}; // NOLINT(readability-redundant-member-init)
+    token_carry_buffer token_carry{}; // NOLINT(readability-redundant-member-init)
    /// start of the current token's part in the get area, or nullptr
    const char* token_segment = nullptr;
    /// whether the character last returned by get_character() is in the get area
    bool current_in_get_area = false;
    /// whether a token is tracked at all; the binary readers never start one
    bool tracking_token = false;
    /// whether the streambuf had no get area when it was last asked for a
    /// character
    bool no_get_area = false;
 #endif
 };
 #endif  // JSON_NO_IO
@@ -14,7 +14,6 @@
 #include <cstdio> // snprintf
 #include <cstring> // memcmp
 #include <initializer_list> // initializer_list
 #include <limits> // numeric_limits
 #include <string> // char_traits, string
 #include <utility> // move
 #include <vector> // vector
@@ -1817,15 +1816,6 @@ scan_number_done:
    /// significand (see scan_number_bulk_contiguous())
    bool convert_accumulated_float(const float_significand& s, std::true_type /*native*/) noexcept
    {
        // accept() only needs to know that the value is finite (see the parser):
        // w < 10^19, so a value below 10^max_exponent10 cannot overflow, and a
        // value that underflows is a finite number as well. Only a token that
        // may overflow has to be converted to find out.
        if (JSON_HEDLEY_UNLIKELY(discard_number_values && s.exponent + 19 <= std::numeric_limits<number_float_t>::max_exponent10))
        {
            value_float = 0;
            return true;
        }
        value_float = decimal_to_float<number_float_t>(s);
        return true;
    }
@@ -56,8 +56,8 @@ using parser_callback_t =
 template<typename SAX>
 struct sax_ignores_number_text : std::false_type {};
-template<typename BasicJsonType, typename InputAdapterType, bool Collect>
+template<typename BasicJsonType, typename InputAdapterType>
-struct sax_ignores_number_text<json_sax_dom_parser<BasicJsonType, InputAdapterType, Collect>> : std::true_type {};
+struct sax_ignores_number_text<json_sax_dom_parser<BasicJsonType, InputAdapterType>> : std::true_type {};
 template<typename BasicJsonType, typename InputAdapterType>
 struct sax_ignores_number_text<json_sax_dom_callback_parser<BasicJsonType, InputAdapterType>> : std::true_type {};
@@ -131,7 +131,7 @@ class parser
        }
        else
        {
-            json_sax_dom_parser<BasicJsonType, InputAdapterType, true> sdp(result, allow_exceptions, &m_lexer);
+            json_sax_dom_parser<BasicJsonType, InputAdapterType> sdp(result, allow_exceptions, &m_lexer);
            // in case of an error, return a discarded value
            if (!parse_dom(sdp, strict))
@@ -243,19 +243,12 @@ class parser
    JSON_HEDLEY_NON_NULL(2)
    bool sax_parse_internal(SAX* sax)
    {
        // value to avoid a goto (see comment where set to true)
        bool skip_to_state_evaluation = false;
        // stack to remember the hierarchy of structured values we are parsing
        // true = array; false = object (bytes, not std::vector<bool>, whose
        // push_back() is a call with GCC)
        std::vector<std::uint8_t> states;
-        // a document that starts with a container pushes onto the stack at
+        // value to avoid a goto (see comment where set to true)
-        // once: allocate it in one step instead of growing it from 1 byte
+        bool skip_to_state_evaluation = false;
        if (last_token == token_type::begin_object || last_token == token_type::begin_array)
        {
            states.reserve(32);
        }
        while (true)
        {
@@ -8,14 +8,14 @@
 #pragma once
-#include <algorithm> // all_of
+#include <algorithm> // all_of, copy
 #include <array> // array
 #include <cctype> // isdigit
 #include <cerrno> // errno, ERANGE
 #include <cstddef> // size_t
 #include <cstdint> // uint64_t
 #include <cstdlib> // strtoull
-#include <cstring> // memcmp, memcpy
+#include <cstring> // memchr, memcmp, memcpy
 #ifndef JSON_NO_IO
    #include <iosfwd> // ostream
 #endif  // JSON_NO_IO
@@ -80,14 +80,38 @@ class json_pointer
    /// @sa https://json.nlohmann.me/api/json_pointer/to_string/
    string_t to_string() const
    {
        if (reference_tokens.empty())
        {
            return string_t();
        }
        // one buffer: every token adds its escaped form (at least its length) and a slash
        std::size_t length = 0;
        bool plain = true;
        for (const auto& reference_token : reference_tokens)
        {
            length += reference_token.size() + 1;
            const char* const data = reference_token.data();
            for (std::size_t i = 0, size = reference_token.size(); plain && i < size; ++i)
            {
                plain = data[i] != '~' && data[i] != '/';
            }
        }
        string_t result;
        if (JSON_HEDLEY_LIKELY(plain))
        {
            // nothing to escape: the tokens are copied into the string
            result.resize(length);
            char* out = &result[0];
            for (const auto& reference_token : reference_tokens)
            {
                *out++ = '/';
                out = std::copy(reference_token.data(), reference_token.data() + reference_token.size(), out);
            }
            return result;
        }
        result.reserve(length);
        for (const auto& reference_token : reference_tokens)
        {
@@ -303,6 +327,12 @@ class json_pointer
        exceeds_size_type  ///< @a s converts to an integer that exceeds size_type
    };
    /// whether a reference token is "-" (a plain comparison with a string literal is not always inlined)
    static bool is_dash(const string_t& s) noexcept
    {
        return s.size() == 1 && s[0] == '-';
    }
    /*!
    @param[in] s    reference token to be converted into an array index
    @param[out] idx the integer representation of @a s if @ref array_index_status::ok
@@ -328,7 +358,7 @@ class json_pointer
        // error condition (cf. RFC 6901, Sect. 4); this also covers single-
        // character tokens, so "/x" and "/xy" fail alike; "-" and the empty
        // token are left to the conversion below and are reported as unresolved
-        if (JSON_HEDLEY_UNLIKELY(!s.empty() && s != "-" && !(s[0] >= '0' && s[0] <= '9')))
+        if (JSON_HEDLEY_UNLIKELY(!s.empty() && !is_dash(s) && !(s[0] >= '0' && s[0] <= '9')))
        {
            return array_index_status::not_a_number;
        }
@@ -475,9 +505,40 @@ class json_pointer
        return pos == size;
    }
    /// reserve room for @a n elements of an array type that has reserve()
    template<typename ArrayType>
    static auto reserve_elements(ArrayType& array, const std::size_t n, detail::priority_tag<1> /*unused*/)
    -> decltype(array.reserve(n), void())
    {
        array.reserve(n);
    }
    template<typename ArrayType>
    static void reserve_elements(ArrayType& /*array*/, const std::size_t /*n*/, detail::priority_tag<0> /*unused*/)
    {}
    /// @brief object member access with a key that is only copied if it is inserted
    ///
    /// Objects that can find the position of a key and insert there
    /// (std::map) search once, others look the key up and add it if it is missing.
    template<typename BasicJsonType>
-    static BasicJsonType& object_member(BasicJsonType& object, const string_t& key)
+    static auto object_member_impl(BasicJsonType& object, const string_t& key, detail::priority_tag<1> /*unused*/)
    -> decltype(object.m_data.m_value.object->emplace_hint(object.m_data.m_value.object->lower_bound(key), key, nullptr), std::declval<BasicJsonType&>())
    {
        auto& members = *object.m_data.m_value.object;
        auto it = members.lower_bound(key);
        if (it != members.end() && !members.key_comp()(key, it->first))
        {
            return it->second;
        }
        const auto old_capacity = object.container_capacity();
        it = members.emplace_hint(it, key, nullptr);
        return object.set_parent_after_insert(it->second, old_capacity);
    }
    template<typename BasicJsonType>
    static BasicJsonType& object_member_impl(BasicJsonType& object, const string_t& key, detail::priority_tag<0> /*unused*/)
    {
        auto& members = *object.m_data.m_value.object;
        const auto it = members.find(key);
@@ -488,6 +549,12 @@ class json_pointer
        return object.operator[](key);
    }
    template<typename BasicJsonType>
    static BasicJsonType& object_member(BasicJsonType& object, const string_t& key)
    {
        return object_member_impl(object, key, detail::priority_tag<1> {});
    }
  JSON_PRIVATE_UNLESS_TESTED:
    json_pointer top() const
    {
@@ -720,48 +787,103 @@ class json_pointer
        }
    }
    /*!
    @brief the values along the pointer last resolved by @ref resolve_plain
    A patch from @ref basic_json::diff lists its operations in document order,
    so consecutive pointers share most of their reference tokens; the values
    along the previous pointer are kept to resume from the common prefix.
    `steps[k]` is the value after the first `k` reference tokens together with
    the length of the prefix of `*path` that holds them. A value stays valid as
    long as no operation changes its container: callers keep only values up to
    the parent of the pointer they modify, or call `reset()`.
    */
    template<typename BasicJsonType>
    struct plain_steps
    {
        const string_t* path = nullptr;
        std::vector<std::pair<std::size_t, BasicJsonType*>> steps{};
        void reset() noexcept
        {
            path = nullptr;
            steps.clear();
        }
    };
    /*!
    @brief resolve a plain JSON pointer without building its reference tokens
-    @param[in] ptr     the value the pointer starts at
+    @param[in] root    the value the pointer starts at
    @param[in] path    a JSON pointer string
    @param[in] length  the number of leading bytes of @a path to resolve; 0 or
                       the position of a slash
    @param[in,out] token  a string to hold the reference tokens, to reuse its storage
    @param[in,out] cache  the values along the previously resolved pointer;
                          @a path must outlive the next call
    @return the pointed to value, or `nullptr` if the pointer does not denote
-            an existing value, or does so in a way that is not plain: a
+            an existing value, or does so in a way that is not plain: an array
-            reference token with an escape, an array index that is malformed or
+            index that is malformed or out of range, or a "-", or a reference
-            out of range, or a "-". No exception is thrown for these; callers
+            token with an escape. No exception is
-            use @ref json_pointer instead, which handles them.
+            thrown for these; callers use @ref json_pointer instead, which
            handles them.
    */
    template<typename BasicJsonType>
-    static BasicJsonType* resolve_plain(BasicJsonType* ptr, const string_t& path, const std::size_t length, string_t& token)
+    static BasicJsonType* resolve_plain(BasicJsonType* root, const string_t& path, const std::size_t length, string_t& token, plain_steps<BasicJsonType>& cache)
    {
-        for (std::size_t pos = 0; pos < length;)
+        auto& steps = cache.steps;
        // resume from the deepest step that is also a prefix of this path
        std::size_t depth = 1;
        if (cache.path != nullptr && !steps.empty() && steps[0].second == root)
        {
            const string_t& previous = *cache.path;
            for (depth = steps.size(); depth > 1; --depth)
            {
                // a step ends at a token boundary of the previous path
                const std::size_t prefix = steps[depth - 1].first;
                if (prefix <= length && (prefix == length || path[prefix] == '/') && std::memcmp(path.data(), previous.data(), prefix) == 0)
                {
                    break;
                }
            }
            steps.resize(depth);
        }
        else
        {
            steps.assign(1, std::make_pair(std::size_t{0}, root));
        }
        cache.path = &path;
        BasicJsonType* ptr = steps[depth - 1].second;
        for (std::size_t pos = steps[depth - 1].first; pos < length;)
        {
            if (JSON_HEDLEY_UNLIKELY(path[pos] != '/'))
            {
                return nullptr;
            }
-            // the reference token between the slash at pos and the next one
+            // the reference token between the slash at pos and the next one,
-            std::size_t end = path.find_first_of('/', pos + 1);
+            // which must not have an escape
-            if (end == string_t::npos || end > length)
+            const char* const begin = path.data() + pos + 1;
            const char* const limit = path.data() + length;
            const char* end = begin;
            while (end < limit && *end != '/')
            {
-                end = length;
+                if (JSON_HEDLEY_UNLIKELY(*end == '~'))
-            }
+                {
-            token.clear();
+                    return nullptr;
-            token.append(path.data() + pos + 1, end - pos - 1);
+                }
-            if (JSON_HEDLEY_UNLIKELY(token.find_first_of('~') != string_t::npos))
+                ++end;
            {
                return nullptr;
            }
            switch (ptr->type())
            {
                case detail::value_t::object:
                {
                    token.clear();
                    token.append(begin, static_cast<std::size_t>(end - begin));
                    const auto it = ptr->m_data.m_value.object->find(token);
                    if (JSON_HEDLEY_UNLIKELY(it == ptr->m_data.m_value.object->end()))
                    {
@@ -773,8 +895,24 @@ class json_pointer
                case detail::value_t::array:
                {
-                    typename BasicJsonType::size_type idx{};
+                    // an index of up to 18 digits without a leading zero fits into size_type
-                    if (JSON_HEDLEY_UNLIKELY(parse_array_index<BasicJsonType>(token, idx) != array_index_status::ok || idx >= ptr->m_data.m_value.array->size()))
+                    // (9 digits for a 32-bit size_type); everything else is left to json_pointer
                    constexpr std::size_t max_digits = sizeof(typename BasicJsonType::size_type) >= 8 ? 18 : 9;
                    const auto digits = static_cast<std::size_t>(end - begin);
                    if (JSON_HEDLEY_UNLIKELY(digits == 0 || digits > max_digits || (digits > 1 && *begin == '0')))
                    {
                        return nullptr;
                    }
                    typename BasicJsonType::size_type idx = 0;
                    for (const char* c = begin; c != end; ++c)
                    {
                        if (JSON_HEDLEY_UNLIKELY(*c < '0' || *c > '9'))
                        {
                            return nullptr;
                        }
                        idx = static_cast<typename BasicJsonType::size_type>((idx * 10) + static_cast<typename BasicJsonType::size_type>(*c - '0'));
                    }
                    if (JSON_HEDLEY_UNLIKELY(idx >= ptr->m_data.m_value.array->size()))
                    {
                        return nullptr;
                    }
@@ -793,7 +931,8 @@ class json_pointer
                default:
                    return nullptr;
            }
-            pos = end;
+            pos = static_cast<std::size_t>(end - path.data());
            steps.emplace_back(pos, ptr);
        }
        return ptr;
@@ -907,7 +1046,7 @@ class json_pointer
                case detail::value_t::array:
                {
-                    if (JSON_HEDLEY_UNLIKELY(reference_token == "-"))
+                    if (JSON_HEDLEY_UNLIKELY(is_dash(reference_token)))
                    {
                        // "-" always fails the range check
                        JSON_THROW(detail::out_of_range::create(detail::exception_id::pointer_past_the_end_index, detail::concat(
@@ -978,7 +1117,7 @@ class json_pointer
                case detail::value_t::array:
                {
-                    if (JSON_HEDLEY_UNLIKELY(reference_token == "-"))
+                    if (JSON_HEDLEY_UNLIKELY(is_dash(reference_token)))
                    {
                        // "-" cannot be used for const access
                        JSON_THROW(detail::out_of_range::create(detail::exception_id::pointer_past_the_end_index, detail::concat("array index '-' (", std::to_string(ptr->m_data.m_value.array->size()), ") is out of range"), ptr));
@@ -1040,7 +1179,7 @@ class json_pointer
                case detail::value_t::array:
                {
-                    if (JSON_HEDLEY_UNLIKELY(reference_token == "-"))
+                    if (JSON_HEDLEY_UNLIKELY(is_dash(reference_token)))
                    {
                        // "-" always fails the range check
                        return nullptr;
@@ -1117,7 +1256,7 @@ class json_pointer
                case detail::value_t::array:
                {
-                    if (JSON_HEDLEY_UNLIKELY(reference_token == "-"))
+                    if (JSON_HEDLEY_UNLIKELY(is_dash(reference_token)))
                    {
                        // "-" always fails the range check
                        return false;
@@ -1198,33 +1337,32 @@ class json_pointer
        }
        result.reserve(token_count);
-        // extract the reference tokens:
+        // extract the reference tokens: every one runs from after a slash to
-        // - slash: position of the last read slash (or end of string)
+        // the next slash or the end of the string; a token without a '~' (the
-        // - start: position after the previous slash
+        // common case) is stored as it is, others are checked and unescaped
-        for (
+        const char* const data = reference_string.data();
-            // search for the first slash after the first character
+        const char* const end = data + size;
-            std::size_t slash = reference_string.find_first_of('/', 1),
+        for (const char* start = data + 1;; ++start)
            // set the beginning of the first reference token
            start = 1;
            // we can stop if start == 0 (if slash == string_t::npos)
            start != 0;
            // set the beginning of the next reference token
            // (will eventually be 0 if slash == string_t::npos)
            start = (slash == string_t::npos) ? 0 : slash + 1,
            // find next slash
            slash = reference_string.find_first_of('/', start))
        {
-            // use the text between the beginning of the reference token
+            const char* slash = start;
-            // (start) and the last slash (slash).
+            bool escaped = false;
-            const auto count = (slash == string_t::npos ? reference_string.size() : slash) - start;
+            while (slash != end && *slash != '/')
            auto reference_token = string_t(reference_string.data() + start, count);
            // check reference tokens are properly escaped; a token without
            // a '~' (the common case) needs neither check nor unescaping
            std::size_t pos = reference_token.find_first_of('~');
            if (pos != string_t::npos)
            {
-                for (; pos != string_t::npos; pos = reference_token.find_first_of('~', pos + 1))
+                escaped = escaped || *slash == '~';
                ++slash;
            }
            const auto count = static_cast<std::size_t>(slash - start);
            if (JSON_HEDLEY_LIKELY(!escaped))
            {
                result.emplace_back(start, count);
            }
            else
            {
                auto reference_token = string_t(start, count);
                // check reference tokens are properly escaped
                for (std::size_t pos = reference_token.find_first_of('~'); pos != string_t::npos; pos = reference_token.find_first_of('~', pos + 1))
                {
                    JSON_ASSERT(reference_token[pos] == '~');
@@ -1238,10 +1376,14 @@ class json_pointer
                }
                detail::unescape(reference_token);
                result.push_back(std::move(reference_token));
            }
-            // finally, store the reference token
+            if (slash == end)
-            result.push_back(std::move(reference_token));
+            {
                break;
            }
            start = slash;
        }
        return result;
@@ -1276,6 +1418,52 @@ class json_pointer
        obj[key] = std::forward<ValueType>(v);
    }
    /// the number of entries that flattening @a value adds: its primitive
    /// values and empty containers
    template<typename BasicJsonType>
    static std::size_t count_flattened(const BasicJsonType& value)
    {
        std::size_t count = 0;
        std::vector<const BasicJsonType*> pending(1, &value);
        while (!pending.empty())
        {
            const BasicJsonType* const v = pending.back();
            pending.pop_back();
            if (v->is_array() && !v->m_data.m_value.array->empty())
            {
                for (const auto& element : *v->m_data.m_value.array)
                {
                    pending.push_back(&element);
                }
            }
            else if (v->is_object() && !v->m_data.m_value.object->empty())
            {
                for (const auto& member : *v->m_data.m_value.object)
                {
                    pending.push_back(&member.second);
                }
            }
            else
            {
                ++count;
            }
        }
        return count;
    }
    // Reserve the storage for @a value of objects that have a reserve(), so
    // that it does not have to be moved while it grows
    template<typename ObjectType, typename BasicJsonType>
    static auto reserve_flattened(ObjectType& obj, const BasicJsonType& value, detail::priority_tag<1> /*unused*/)
    -> decltype(obj.reserve(std::size_t {}), void())
    {
        obj.reserve(count_flattened(value));
    }
    template<typename ObjectType, typename BasicJsonType>
    static void reserve_flattened(ObjectType& /*obj*/, const BasicJsonType& /*value*/, detail::priority_tag<0> /*unused*/)
    {}
    /// append the decimal representation of @a i to @a out
    static void append_index(string_t& out, std::size_t i)
    {
@@ -1385,6 +1573,7 @@ class json_pointer
            }
        };
        reserve_flattened(object, value, detail::priority_tag<1> {});
        enter(value);
        while (!stack.empty())
        {
@@ -1392,8 +1581,9 @@ class json_pointer
            // frame, which would invalidate a reference to it
            const BasicJsonType* const container = stack.back().container;
-            // drop the path of the previous child
+            // the path of the previous child is replaced by the path of the
-            path.resize(stack.back().path_length);
+            // next one; for an array element in one resize
            const std::size_t path_length = stack.back().path_length;
            if (container->is_array())
            {
@@ -1407,8 +1597,20 @@ class json_pointer
                // iterate array and use index as a reference string
                ++stack.back().index;
-                path.push_back('/');
+                std::array<char, 24> digits{};
-                append_index(path, i);
+                std::size_t pos = digits.size();
                std::size_t rest = i;
                do
                {
                    digits[--pos] = static_cast<char>('0' + (rest % 10));
                    rest /= 10;
                }
                while (rest != 0);
                const std::size_t count = digits.size() - pos;
                path.resize(path_length + 1 + count);
                char* const out = &path[path_length];
                out[0] = '/';
                std::memcpy(out + 1, digits.data() + pos, count);
                enter(array[i]);
            }
            else
@@ -1422,6 +1624,7 @@ class json_pointer
                // iterate object and use keys as reference string
                ++stack.back().member;
                path.resize(path_length);
                path.push_back('/');
                detail::escape_into(path, it->first);
                enter(it->second);
@@ -1517,8 +1720,28 @@ class json_pointer
                {
                    end = key.size();
                }
                const std::size_t token_size = end - pos - 1;
                // a token that is a plain index of up to 9 digits, which is
                // the case for almost all array elements, is not copied
                std::size_t index = 0;
                bool plain_index = current->type() == detail::value_t::array && token_size != 0 && token_size <= 9 && (token_size == 1 || data[pos + 1] != '0');
                for (std::size_t k = pos + 1; plain_index && k < end; ++k)
                {
                    plain_index = data[k] >= '0' && data[k] <= '9';
                    index = (index * 10) + static_cast<std::size_t>(data[k] - '0');
                }
                if (plain_index)
                {
                    current = &current->operator[](static_cast<typename BasicJsonType::size_type>(index));
                    values.push_back(current);
                    ends.push_back(end);
                    pos = end;
                    continue;
                }
                token.clear();
-                token.append(data + pos + 1, end - pos - 1);
+                token.append(data + pos + 1, token_size);
                if (token.find_first_of('~') != string_t::npos)
                {
                    detail::unescape(token);
@@ -1528,10 +1751,13 @@ class json_pointer
                {
                    case detail::value_t::null:
                    {
-                        if (arrays.contains(data, pos))
+                        // a first child 0 makes the value an array without a look-up
                        if ((token_size == 1 && data[pos + 1] == '0') || arrays.contains(data, pos))
                        {
                            // some reference token below this position is 0, so the
                            // value is an array
                            *current = BasicJsonType(detail::value_t::array);
                            reserve_elements(*current->m_data.m_value.array, 2, detail::priority_tag<1> {});
                            current = &current->operator[](array_index<BasicJsonType>(token));
                        }
                        else
@@ -55,6 +55,66 @@ using output_adapter_t = std::shared_ptr<output_adapter_protocol<CharType>>;
 /// output_vector_sink also appends writes of at least this size with insert()
 constexpr std::size_t max_reserve_size = 256;
 /// @brief copy @a length characters, at most 32, without a call of memcpy()
 ///
 /// Short strings are the typical payload of a binary value, and a call of
 /// memcpy() costs more than copying them. A copy of 16 to 32 characters is two
 /// possibly overlapping 16-byte copies, one of 8 to 15 two 8-byte copies, and
 /// so on down to a single character; each is a fixed-size load and store.
 /// Nothing outside of [src, src + length) is read or written.
 template<typename CharType>
 inline void copy_short(CharType* dst, const CharType* src, const std::size_t length, std::true_type /*is_byte*/) noexcept
 {
    JSON_ASSERT(length <= 32);
    if (length >= 16)
    {
        std::array<char, 16> first; // NOLINT(cppcoreguidelines-pro-type-member-init,hicpp-member-init): written before read
        std::array<char, 16> last; // NOLINT(cppcoreguidelines-pro-type-member-init,hicpp-member-init): written before read
        std::memcpy(first.data(), src, 16);
        std::memcpy(last.data(), src + (length - 16), 16);
        std::memcpy(dst, first.data(), 16);
        std::memcpy(dst + (length - 16), last.data(), 16);
    }
    else if (length >= 8)
    {
        std::array<char, 8> first; // NOLINT(cppcoreguidelines-pro-type-member-init,hicpp-member-init): written before read
        std::array<char, 8> last; // NOLINT(cppcoreguidelines-pro-type-member-init,hicpp-member-init): written before read
        std::memcpy(first.data(), src, 8);
        std::memcpy(last.data(), src + (length - 8), 8);
        std::memcpy(dst, first.data(), 8);
        std::memcpy(dst + (length - 8), last.data(), 8);
    }
    else if (length >= 4)
    {
        std::array<char, 4> first; // NOLINT(cppcoreguidelines-pro-type-member-init,hicpp-member-init): written before read
        std::array<char, 4> last; // NOLINT(cppcoreguidelines-pro-type-member-init,hicpp-member-init): written before read
        std::memcpy(first.data(), src, 4);
        std::memcpy(last.data(), src + (length - 4), 4);
        std::memcpy(dst, first.data(), 4);
        std::memcpy(dst + (length - 4), last.data(), 4);
    }
    else if (length != 0)
    {
        // 1 to 3: the first, the middle, and the last character
        const CharType a = src[0];
        const CharType b = src[length >> 1];
        const CharType c = src[length - 1];
        dst[0] = a;
        dst[length >> 1] = b;
        dst[length - 1] = c;
    }
 }
 /// @brief copy @a length characters, of a character type wider than a byte
 template<typename CharType>
 inline void copy_short(CharType* dst, const CharType* src, const std::size_t length, std::false_type /*is_byte*/) noexcept
 {
    std::memcpy(dst, src, length * sizeof(CharType));
 }
 /// the number of characters an empty vector is grown to by output_vector_sink
 constexpr std::size_t min_vector_sink_capacity = 64;
 /// @brief non-virtual output sink writing into a std::vector
 ///
 /// This sink is not part of the virtual output_adapter_protocol hierarchy: it is
@@ -78,7 +138,7 @@ class output_vector_sink
 {
  public:
    explicit output_vector_sink(std::vector<CharType, AllocatorType>& vec) noexcept
-        : v(&vec), position(vec.size())
+        : v(&vec), cursor(vec.data() + vec.size()), limit(cursor)
    {}
    output_vector_sink(const output_vector_sink&) = delete;
@@ -86,7 +146,7 @@ class output_vector_sink
    output_vector_sink& operator=(output_vector_sink&&) = delete;
    output_vector_sink(output_vector_sink&& other) noexcept
-        : v(other.v), position(other.position)
+        : v(other.v), cursor(other.cursor), limit(other.limit)
    {
        other.v = nullptr;
    }
@@ -95,7 +155,7 @@ class output_vector_sink
    {
        if (v != nullptr)
        {
-            v->resize(position);
+            v->resize(position());
        }
    }
@@ -104,11 +164,11 @@ class output_vector_sink
    JSON_HEDLEY_ALWAYS_INLINE
    void write_character(CharType c)
    {
-        if (JSON_HEDLEY_UNLIKELY(position == v->size()))
+        if (JSON_HEDLEY_UNLIKELY(cursor == limit))
        {
            grow(1);
        }
-        (*v)[position++] = c;
+        *cursor++ = c;
    }
    // no JSON_HEDLEY_NON_NULL here: binary_writer legitimately passes a null
@@ -117,7 +177,7 @@ class output_vector_sink
    JSON_HEDLEY_ALWAYS_INLINE
    void write_characters(const CharType* s, std::size_t length)
    {
-        if (JSON_HEDLEY_UNLIKELY(v->size() - position < length))
+        if (JSON_HEDLEY_UNLIKELY(space() < length))
        {
            if (length >= max_reserve_size)
            {
@@ -126,10 +186,15 @@ class output_vector_sink
            }
            grow(length);
        }
-        if (length != 0)
+        if (length <= 32)
        {
-            std::memcpy(v->data() + position, s, length * sizeof(CharType));
+            copy_short(cursor, s, length, std::integral_constant<bool, sizeof(CharType) == 1>());
-            position += length;
+            cursor += length;
        }
        else
        {
            std::memcpy(cursor, s, length * sizeof(CharType));
            cursor += length;
        }
    }
@@ -144,21 +209,37 @@ class output_vector_sink
    CharType* reserve(const std::size_t length)
    {
        JSON_ASSERT(length <= max_reserve_size);
-        if (JSON_HEDLEY_UNLIKELY(v->size() - position < length))
+        if (JSON_HEDLEY_UNLIKELY(space() < length))
        {
            grow(length);
        }
-        return v->data() + position;
+        return cursor;
    }
    /// keep the first @a length characters written to the space from reserve()
    JSON_HEDLEY_ALWAYS_INLINE
    void commit(const std::size_t length) noexcept
    {
-        position += length;
+        cursor += length;
    }
    /// nothing to pass on: the characters are in the vector (see output_adapter_sink)
    void flush() noexcept
    {}
  private:
    /// number of characters of *v written so far
    std::size_t position() const noexcept
    {
        return static_cast<std::size_t>(cursor - v->data());
    }
    /// number of characters that fit the vector behind the write position
    std::size_t space() const noexcept
    {
        return static_cast<std::size_t>(limit - cursor);
    }
    /// make room for at least @a length more characters after the position;
    /// kept out of line so that the write functions stay small enough for
    /// GCC to inline them into the writer
@@ -166,12 +247,15 @@ class output_vector_sink
    void grow(const std::size_t length)
    {
        // use the capacity the vector already has, else at least double it;
-        // never less than 64 characters, so that a small value does not
+        // never less than min_vector_sink_capacity, so that a small value does not
        // reallocate for every few bytes
-        const std::size_t needed = position + length;
+        const std::size_t written = position();
-        v->resize((std::max)(std::size_t{64}, needed <= v->capacity()
+        const std::size_t needed = written + length;
        v->resize((std::max)(min_vector_sink_capacity, needed <= v->capacity()
                             ? v->capacity()
                             : (std::max)(needed, v->capacity() * 2)));
        cursor = v->data() + written;
        limit = v->data() + v->size();
    }
    /// append @a length (at least max_reserve_size) characters that do not fit
@@ -181,20 +265,24 @@ class output_vector_sink
    JSON_HEDLEY_NEVER_INLINE
    void append(const CharType* s, const std::size_t length)
    {
-        v->resize(position);
+        const std::size_t written = position();
-        if (v->capacity() - position < length)
+        v->resize(written);
        if (v->capacity() - written < length)
        {
            // grow geometrically, with room for the writes that follow, so
            // that the next grow() need not reallocate right away
-            v->reserve((std::max)(v->capacity() * 2, position + length + max_reserve_size));
+            v->reserve((std::max)(v->capacity() * 2, written + length + max_reserve_size));
        }
        v->insert(v->end(), s, s + length);
-        position = v->size();
+        cursor = v->data() + v->size();
        limit = cursor;
    }
    std::vector<CharType, AllocatorType>* v;
-    /// number of characters of *v written so far
+    /// the write position: in *v, at the number of characters written so far
-    std::size_t position;
+    CharType* cursor;
    /// the end of *v
    CharType* limit;
 };
 /// output adapter for byte vectors
@@ -277,9 +365,17 @@ class output_string_adapter : public output_adapter_protocol<CharType>
 ///
 /// Wraps the polymorphic output_adapter_t so the same binary_writer template can
 /// also target arbitrary adapters (output streams, strings, user-provided
-/// adapters) via the `output_adapter`-based overloads. Each write still goes
+/// adapters) via the `output_adapter`-based overloads.
-/// through one virtual call, exactly as before; only the concrete sinks above
+///
-/// avoid it.
+/// A write through the adapter is a virtual call, and for a stream a call with
 /// a sentry on top, which costs more than encoding the few bytes of most values.
 /// The sink therefore collects what is written in a buffer and passes it on in
 /// one piece when it is full, a write is too large for it, or @ref flush is
 /// called. Everything written reaches the adapter in the same order and with
 /// the same bytes; the destructor passes on what is left, so that a write that
 /// throws leaves the adapter with exactly the bytes written before it. Only
 /// @ref flush can report an error of the adapter (the destructor must not
 /// throw), so it has to be called once the value is written.
 template<typename CharType>
 class output_adapter_sink
 {
@@ -290,36 +386,121 @@ class output_adapter_sink
        JSON_ASSERT(oa);
    }
    output_adapter_sink(const output_adapter_sink&) = delete;
    output_adapter_sink& operator=(const output_adapter_sink&) = delete;
    output_adapter_sink& operator=(output_adapter_sink&&) = delete;
    output_adapter_sink(output_adapter_sink&& other) noexcept
        : oa(std::move(other.oa)), used(other.used)
    {
        std::memcpy(buffer.data(), other.buffer.data(), other.used * sizeof(CharType));
        other.used = 0;
    }
    ~output_adapter_sink()
    {
        // a normal return has flushed already, so this is for a write that threw
        if (used != 0)
        {
            JSON_TRY
            {
                flush();
            }
            JSON_CATCH(...)
            {
                // nothing can be done about an adapter that throws here
            }
        }
    }
    JSON_HEDLEY_ALWAYS_INLINE
    void write_character(CharType c)
    {
-        oa->write_character(c);
+        if (JSON_HEDLEY_UNLIKELY(used == buffer_size))
        {
            flush();
        }
        buffer[used++] = c;
    }
    // no JSON_HEDLEY_NON_NULL: forwards (null, 0) for empty payloads, exactly as
    // the type-erased path already did before this sink existed
    JSON_HEDLEY_ALWAYS_INLINE
    void write_characters(const CharType* s, std::size_t length)
    {
-        oa->write_characters(s, length);
+        if (JSON_HEDLEY_UNLIKELY(buffer_size - used < length))
        {
            write_large(s, length);
            return;
        }
        if (length <= 32)
        {
            copy_short(buffer.data() + used, s, length, std::integral_constant<bool, sizeof(CharType) == 1>());
            used += length;
        }
        else
        {
            std::memcpy(buffer.data() + used, s, length * sizeof(CharType));
            used += length;
        }
    }
    /// space for writing up to @a length characters (see
    /// output_vector_sink::reserve)
-    CharType* reserve(const std::size_t length) noexcept
+    JSON_HEDLEY_ALWAYS_INLINE
    CharType* reserve(const std::size_t length)
    {
        JSON_ASSERT(length <= max_reserve_size);
-        static_cast<void>(length);
+        if (JSON_HEDLEY_UNLIKELY(buffer_size - used < length))
-        return reserved.data();
+        {
            flush();
        }
        return buffer.data() + used;
    }
-    /// write the first @a length characters written to the space from reserve()
+    /// keep the first @a length characters written to the space from reserve()
-    void commit(const std::size_t length)
+    JSON_HEDLEY_ALWAYS_INLINE
    void commit(const std::size_t length) noexcept
    {
-        oa->write_characters(reserved.data(), length);
+        used += length;
    }
    /// pass everything written so far on to the adapter
    void flush()
    {
        if (used != 0)
        {
            // reset first: the characters count as written even if the adapter throws
            const std::size_t length = used;
            used = 0;
            oa->write_characters(buffer.data(), length);
        }
    }
  private:
    /// a write that does not fit the space left in the buffer
    JSON_HEDLEY_NEVER_INLINE
    void write_large(const CharType* s, const std::size_t length)
    {
        flush();
        if (length >= buffer_size)
        {
            oa->write_characters(s, length);
        }
        else
        {
            std::memcpy(buffer.data(), s, length * sizeof(CharType));
            used = length;
        }
    }
    /// large enough for reserve() at any time
    static constexpr std::size_t buffer_size = 4 * max_reserve_size;
    output_adapter_t<CharType> oa;
-    std::array<CharType, max_reserve_size> reserved{};
+    /// number of characters of @ref buffer not yet passed on
    std::size_t used = 0;
    std::array<CharType, buffer_size> buffer{};
 };
 /// @brief whether std::basic_string<CharType> has a non-deprecated std::char_traits
@@ -40,7 +40,7 @@ template<typename BasicJsonType, bool Editable>
 BasicJsonType materialize(const document_data& d, const node* n)
 {
    using string_t = typename BasicJsonType::string_t;
-    using sax_t = json_sax_dom_parser<BasicJsonType, iterator_input_adapter<const char*>, true>;
+    using sax_t = json_sax_dom_parser<BasicJsonType, iterator_input_adapter<const char*>>;
    using nav = navigation<Editable>;
    // the open containers: their next element (or key of the next member),
@@ -19,6 +19,7 @@
 #define INCLUDE_NLOHMANN_JSON_HPP_
 #include <algorithm> // all_of, find, for_each, none_of
 #include <array> // array
 #include <cmath> // isnan
 #include <cstddef> // nullptr_t, ptrdiff_t, size_t
 #include <cstdint> // uint8_t
@@ -158,10 +159,8 @@ class basic_json // NOLINT(cppcoreguidelines-special-member-functions,hicpp-spec
    friend class ::nlohmann::detail::binary_writer;
    template<typename BasicJsonType, typename InputType, typename SAX>
    friend class ::nlohmann::detail::binary_reader;
    template<typename BasicJsonType, typename InputAdapterType, bool Collect>
    friend class ::nlohmann::detail::json_sax_dom_parser;
    template<typename BasicJsonType, typename InputAdapterType>
-    friend class ::nlohmann::detail::json_sax_dom_binary_parser;
+    friend class ::nlohmann::detail::json_sax_dom_parser;
    template<typename BasicJsonType, typename InputAdapterType>
    friend class ::nlohmann::detail::json_sax_dom_callback_parser;
 #if JSON_DIAGNOSTIC_POSITIONS
@@ -6289,7 +6288,7 @@ public:
           from_ubjson/from_bjdata/from_bon8/from_bson overloads
    Building the @ref binary_reader as a named local, rather than as a
-    temporary that @ref detail::json_sax_dom_binary_parser::parse is called on in
+    temporary that @ref detail::json_sax_dom_parser::parse is called on in
    the same expression, avoids a false-positive cppcheck accessMoved
    warning in each of the 16 callers.
    */
@@ -6300,7 +6299,7 @@ public:
                                       const cbor_tag_handler_t tag_handler = cbor_tag_handler_t::error)
    {
        basic_json result;
-        detail::json_sax_dom_binary_parser<basic_json, InputAdapterType> sdp(result, allow_exceptions);
+        detail::json_sax_dom_parser<basic_json, InputAdapterType> sdp(result, allow_exceptions);
        binary_reader<InputAdapterType> reader(std::move(ia), format, error_handler);
        if (!reader.sax_parse(&sdp, strict, tag_handler))
        {
@@ -6323,7 +6322,7 @@ public:
            const error_handler_t error_handler = detail::binary_writer_default_error_handler())
    {
        std::vector<std::uint8_t> result;
-        result.reserve(detail::binary_reserve_hint(j));
+        result.reserve(detail::binary_initial_capacity(j));
        vector_writer(result, error_handler).write_cbor(j);
        return result;
    }
@@ -6333,7 +6332,9 @@ public:
    static void to_cbor(const basic_json& j, detail::output_adapter<std::uint8_t> o,
                        const error_handler_t error_handler = detail::binary_writer_default_error_handler())
    {
-        binary_writer<std::uint8_t>(o, error_handler).write_cbor(j);
+        binary_writer<std::uint8_t> writer(o, error_handler);
        writer.write_cbor(j);
        writer.flush();
    }
    /// @brief create a CBOR serialization of a given JSON value
@@ -6341,7 +6342,9 @@ public:
    static void to_cbor(const basic_json& j, detail::output_adapter<char> o,
                        const error_handler_t error_handler = detail::binary_writer_default_error_handler())
    {
-        binary_writer<char>(o, error_handler).write_cbor(j);
+        binary_writer<char> writer(o, error_handler);
        writer.write_cbor(j);
        writer.flush();
    }
    /// @brief create a MessagePack serialization of a given JSON value
@@ -6350,7 +6353,7 @@ public:
            const error_handler_t error_handler = error_handler_t::keep)
    {
        std::vector<std::uint8_t> result;
-        result.reserve(detail::binary_reserve_hint(j));
+        result.reserve(detail::binary_initial_capacity(j));
        vector_writer(result, error_handler).write_msgpack(j);
        return result;
    }
@@ -6360,7 +6363,9 @@ public:
    static void to_msgpack(const basic_json& j, detail::output_adapter<std::uint8_t> o,
                           const error_handler_t error_handler = error_handler_t::keep)
    {
-        binary_writer<std::uint8_t>(o, error_handler).write_msgpack(j);
+        binary_writer<std::uint8_t> writer(o, error_handler);
        writer.write_msgpack(j);
        writer.flush();
    }
    /// @brief create a MessagePack serialization of a given JSON value
@@ -6368,7 +6373,9 @@ public:
    static void to_msgpack(const basic_json& j, detail::output_adapter<char> o,
                           const error_handler_t error_handler = error_handler_t::keep)
    {
-        binary_writer<char>(o, error_handler).write_msgpack(j);
+        binary_writer<char> writer(o, error_handler);
        writer.write_msgpack(j);
        writer.flush();
    }
    /// @brief create a UBJSON serialization of a given JSON value
@@ -6379,7 +6386,7 @@ public:
            const error_handler_t error_handler = detail::binary_writer_default_error_handler())
    {
        std::vector<std::uint8_t> result;
-        result.reserve(detail::binary_reserve_hint(j));
+        result.reserve(detail::binary_initial_capacity(j));
        vector_writer(result, error_handler).write_ubjson(j, use_size, use_type);
        return result;
    }
@@ -6390,7 +6397,9 @@ public:
                          const bool use_size = false, const bool use_type = false,
                          const error_handler_t error_handler = detail::binary_writer_default_error_handler())
    {
-        binary_writer<std::uint8_t>(o, error_handler).write_ubjson(j, use_size, use_type);
+        binary_writer<std::uint8_t> writer(o, error_handler);
        writer.write_ubjson(j, use_size, use_type);
        writer.flush();
    }
    /// @brief create a UBJSON serialization of a given JSON value
@@ -6399,7 +6408,9 @@ public:
                          const bool use_size = false, const bool use_type = false,
                          const error_handler_t error_handler = detail::binary_writer_default_error_handler())
    {
-        binary_writer<char>(o, error_handler).write_ubjson(j, use_size, use_type);
+        binary_writer<char> writer(o, error_handler);
        writer.write_ubjson(j, use_size, use_type);
        writer.flush();
    }
    /// @brief create a BJData serialization of a given JSON value
@@ -6411,7 +6422,7 @@ public:
            const error_handler_t error_handler = detail::binary_writer_default_error_handler())
    {
        std::vector<std::uint8_t> result;
-        result.reserve(detail::binary_reserve_hint(j));
+        result.reserve(detail::binary_initial_capacity(j));
        vector_writer(result, error_handler).write_ubjson(j, use_size, use_type, true, true, version);
        return result;
    }
@@ -6423,7 +6434,9 @@ public:
                          const bjdata_version_t version = bjdata_version_t::draft2,
                          const error_handler_t error_handler = detail::binary_writer_default_error_handler())
    {
-        binary_writer<std::uint8_t>(o, error_handler).write_ubjson(j, use_size, use_type, true, true, version);
+        binary_writer<std::uint8_t> writer(o, error_handler);
        writer.write_ubjson(j, use_size, use_type, true, true, version);
        writer.flush();
    }
    /// @brief create a BJData serialization of a given JSON value
@@ -6433,7 +6446,9 @@ public:
                          const bjdata_version_t version = bjdata_version_t::draft2,
                          const error_handler_t error_handler = detail::binary_writer_default_error_handler())
    {
-        binary_writer<char>(o, error_handler).write_ubjson(j, use_size, use_type, true, true, version);
+        binary_writer<char> writer(o, error_handler);
        writer.write_ubjson(j, use_size, use_type, true, true, version);
        writer.flush();
    }
    /// @brief create a BSON serialization of a given JSON value
@@ -6442,7 +6457,7 @@ public:
            const error_handler_t error_handler = detail::binary_writer_default_error_handler())
    {
        std::vector<std::uint8_t> result;
-        result.reserve(detail::binary_reserve_hint(j));
+        result.reserve(detail::binary_initial_capacity(j));
        vector_writer(result, error_handler).write_bson(j);
        return result;
    }
@@ -6452,7 +6467,9 @@ public:
    static void to_bson(const basic_json& j, detail::output_adapter<std::uint8_t> o,
                        const error_handler_t error_handler = detail::binary_writer_default_error_handler())
    {
-        binary_writer<std::uint8_t>(o, error_handler).write_bson(j);
+        binary_writer<std::uint8_t> writer(o, error_handler);
        writer.write_bson(j);
        writer.flush();
    }
    /// @brief create a BSON serialization of a given JSON value
@@ -6460,7 +6477,9 @@ public:
    static void to_bson(const basic_json& j, detail::output_adapter<char> o,
                        const error_handler_t error_handler = detail::binary_writer_default_error_handler())
    {
-        binary_writer<char>(o, error_handler).write_bson(j);
+        binary_writer<char> writer(o, error_handler);
        writer.write_bson(j);
        writer.flush();
    }
    /// @brief create a BON8 serialization of a given JSON value
@@ -6468,7 +6487,7 @@ public:
    static std::vector<std::uint8_t> to_bon8(const basic_json& j)
    {
        std::vector<std::uint8_t> result;
-        result.reserve(detail::binary_reserve_hint(j));
+        result.reserve(detail::binary_initial_capacity(j));
        vector_writer(result).write_bon8(j);
        return result;
    }
@@ -6477,14 +6496,18 @@ public:
    /// @sa https://json.nlohmann.me/api/basic_json/to_bon8/
    static void to_bon8(const basic_json& j, detail::output_adapter<std::uint8_t> o)
    {
-        binary_writer<std::uint8_t>(o).write_bon8(j);
+        binary_writer<std::uint8_t> writer(o);
        writer.write_bon8(j);
        writer.flush();
    }
    /// @brief create a BON8 serialization of a given JSON value
    /// @sa https://json.nlohmann.me/api/basic_json/to_bon8/
    static void to_bon8(const basic_json& j, detail::output_adapter<char> o)
    {
-        binary_writer<char>(o).write_bon8(j);
+        binary_writer<char> writer(o);
        writer.write_bon8(j);
        writer.flush();
    }
    /// @brief create a JSON value from an input in CBOR format
@@ -6880,6 +6903,72 @@ public:
    /// @name JSON Patch functions
    /// @{
  private:
    /// the members of an operation of a JSON patch that are of interest
    struct patch_members
    {
        basic_json* op = nullptr;
        basic_json* path = nullptr;
        basic_json* value = nullptr;
        basic_json* from = nullptr;
    };
    /// @brief find the members "op", "path", "value", and "from" of the object @a val in one pass
    static patch_members find_patch_members(const basic_json& val, std::true_type /*key_type is string_t*/)
    {
        patch_members members;
        for (auto& member : *val.m_data.m_value.object)
        {
            const string_t& key = member.first;
            switch (key.size())
            {
                case 2:
                    if (key == "op")
                    {
                        members.op = &member.second;
                    }
                    break;
                case 4:
                    if (key == "path")
                    {
                        members.path = &member.second;
                    }
                    else if (key == "from")
                    {
                        members.from = &member.second;
                    }
                    break;
                case 5:
                    if (key == "value")
                    {
                        members.value = &member.second;
                    }
                    break;
                default:
                    break;
            }
        }
        return members;
    }
    /// @brief find the members by lookup for key types other than string_t
    static patch_members find_patch_members(const basic_json& val, std::false_type /*key_type is not string_t*/)
    {
        const auto find_member = [&val](const char* name) -> basic_json *
        {
            const auto it = val.m_data.m_value.object->find(string_t(name));
            return it != val.m_data.m_value.object->end() ? &it->second : nullptr;
        };
        patch_members members;
        members.op = find_member("op");
        members.path = find_member("path");
        members.value = find_member("value");
        members.from = find_member("from");
        return members;
    }
  public:
    /// @brief applies a JSON patch in-place without copying the object
    /// @sa https://json.nlohmann.me/api/basic_json/patch/
    void patch_inplace(const basic_json& json_patch)
@@ -7053,18 +7142,18 @@ public:
        // a diff creates them: apply the operation and return true; return
        // false, with nothing changed, for all others
        string_t token;
-        const string_t value_key = "value";
+        typename json_pointer::template plain_steps<basic_json> steps;
-        const auto try_plain = [&result, &token, &value_key](patch_operations operation, const string_t& path, const basic_json & val)
+        const auto try_plain = [&result, &token, &steps](patch_operations operation, const string_t& path, const patch_members & members, const basic_json & val)
        {
-            if (path.empty() || path.find_first_of('~') != string_t::npos)
+            if (path.empty())
            {
                return false;
            }
            // a missing "value" is reported below
-            const auto value_it = val.m_data.m_value.object->find(value_key);
+            const basic_json* const value_ptr = members.value;
-            const basic_json& value = value_it != val.m_data.m_value.object->end() ? value_it->second : val;
+            const basic_json& value = value_ptr != nullptr ? *value_ptr : val;
-            if (operation != patch_operations::remove && value_it == val.m_data.m_value.object->end())
+            if (operation != patch_operations::remove && value_ptr == nullptr)
            {
                return false;
            }
@@ -7073,7 +7162,7 @@ public:
            {
                case patch_operations::replace:
                {
-                    basic_json* const target = json_pointer::resolve_plain(&result, path, path.size(), token);
+                    basic_json* const target = json_pointer::resolve_plain(&result, path, path.size(), token, steps);
                    if (target == nullptr)
                    {
                        return false;
@@ -7084,7 +7173,7 @@ public:
                case patch_operations::test:
                {
-                    const basic_json* const target = json_pointer::resolve_plain(&result, path, path.size(), token);
+                    const basic_json* const target = json_pointer::resolve_plain(&result, path, path.size(), token, steps);
                    // a failing test is reported below
                    return target != nullptr && *target == value;
                }
@@ -7104,13 +7193,17 @@ public:
                    }
                    --slash;
-                    basic_json* const parent = json_pointer::resolve_plain(&result, path, slash, token);
+                    basic_json* const parent = json_pointer::resolve_plain(&result, path, slash, token, steps);
                    if (parent == nullptr)
                    {
                        return false;
                    }
                    token.clear();
                    token.append(path.data() + slash + 1, path.size() - slash - 1);
                    if (token.find_first_of('~') != string_t::npos)
                    {
                        return false;
                    }
                    if (operation == patch_operations::add)
                    {
@@ -7166,31 +7259,32 @@ public:
            }
        };
        // the name of the first member to check
        const string_t op_member = "op";
        // iterate and apply the operations
        for (const auto& val : json_patch)
        {
            // wrapper to get a value for an operation
-            const auto get_value = [&val](const string_t& op,
+            const auto get_value = [&val](basic_json * found,
-                                          const string_t& member,
+                                          const string_t& op,
                                          const char* member,
                                          bool string_type) -> basic_json &
            {
                // find value
                auto it = val.m_data.m_value.object->find(member);
                // check if the desired value is present
-                if (JSON_HEDLEY_UNLIKELY(it == val.m_data.m_value.object->end()))
+                if (JSON_HEDLEY_UNLIKELY(found == nullptr))
                {
-                    detail::throw_patch_missing_member(op, member, false, val);
+                    detail::throw_patch_missing_member(op, string_t(member), false, val);
                }
                // check if the result is of type string
-                if (JSON_HEDLEY_UNLIKELY(string_type && !it->second.is_string()))
+                if (JSON_HEDLEY_UNLIKELY(string_type && !found->is_string()))
                {
-                    detail::throw_patch_missing_member(op, member, true, val);
+                    detail::throw_patch_missing_member(op, string_t(member), true, val);
                }
                // no error: return value
-                return it->second;
+                return *found;
            };
            // type check: every element of the array must be an object
@@ -7199,26 +7293,30 @@ public:
                detail::throw_patch_not_an_array(val);
            }
            const patch_members members = find_patch_members(val, std::is_same<typename object_t::key_type, string_t> {});
            // collect mandatory members
-            const string_t& op = *get_value("op", "op", true).m_data.m_value.string;
+            const string_t& op = *get_value(members.op, op_member, "op", true).m_data.m_value.string;
-            const string_t& path = *get_value(op, "path", true).m_data.m_value.string;
+            const string_t& path = *get_value(members.path, op, "path", true).m_data.m_value.string;
            const patch_operations operation = get_op(op);
            // the usual operations on a plain pointer are applied without
            // building the pointer's reference tokens; anything else (and
            // every error) is handled below
-            if (try_plain(operation, path, val))
+            if (try_plain(operation, path, members, val))
            {
                continue;
            }
            // the general operations may change any container
            steps.reset();
            json_pointer ptr(path);
            switch (operation)
            {
                case patch_operations::add:
                {
-                    operation_add(ptr, get_value("add", "value", false));
+                    operation_add(ptr, get_value(members.value, "add", "value", false));
                    break;
                }
@@ -7231,13 +7329,13 @@ public:
                case patch_operations::replace:
                {
                    // the "path" location must exist - use at()
-                    result.at(ptr) = get_value("replace", "value", false);
+                    result.at(ptr) = get_value(members.value, "replace", "value", false);
                    break;
                }
                case patch_operations::move:
                {
-                    const string_t& from_path = *get_value("move", "from", true).m_data.m_value.string;
+                    const string_t& from_path = *get_value(members.from, "move", "from", true).m_data.m_value.string;
                    json_pointer from_ptr(from_path);
                    if (JSON_HEDLEY_UNLIKELY(is_proper_prefix(from_ptr, ptr)))
@@ -7260,7 +7358,7 @@ public:
                case patch_operations::copy:
                {
-                    const string_t& from_path = *get_value("copy", "from", true).m_data.m_value.string;
+                    const string_t& from_path = *get_value(members.from, "copy", "from", true).m_data.m_value.string;
                    const json_pointer from_ptr(from_path);
                    // The copy is functionally identical to an "add"
@@ -7278,7 +7376,7 @@ public:
                    {
                        // check if "value" matches the one at "path"
                        // the "path" location must exist - use at()
-                        success = (result.at(ptr) == get_value("test", "value", false));
+                        success = (result.at(ptr) == get_value(members.value, "test", "value", false));
                    }
                    JSON_INTERNAL_CATCH (out_of_range&)
                    {
@@ -7370,13 +7468,18 @@ public:
    /// @brief append an operation @a op for @a path to @a result, with @a value if it is not null
    static void diff_operation(basic_json& result, const char* op, const string_t& path, const basic_json* value)
    {
        // the keys are distinct and in the order of std::map; the members are
        // added without looking them up
        basic_json entry(value_t::object);
-        entry["op"] = op;
+        auto& members = *entry.m_data.m_value.object;
-        entry["path"] = path;
+        auto hint = members.end();
        json_pointer::add_flattened(members, hint, string_t("op"), string_t(op), detail::priority_tag<2> {});
        json_pointer::add_flattened(members, hint, string_t("path"), path, detail::priority_tag<2> {});
        if (value != nullptr)
        {
-            entry["value"] = *value;
+            json_pointer::add_flattened(members, hint, string_t("value"), *value, detail::priority_tag<2> {});
        }
        entry.set_parents();
        result.push_back(std::move(entry));
    }
@@ -7398,6 +7501,62 @@ public:
        diff_operation(result, "add", path, &value);
    }
    /// @brief the values in the target of the members of a source object, for the
    ///        objects of up to 16 members without allocating
    ///
    /// reserve() must be called with the number of values that are added.
    class diff_target_values
    {
      public:
        diff_target_values() noexcept
            : inline_items() // NOLINT(readability-redundant-member-init)
        {}
        diff_target_values(const diff_target_values&) = delete;
        diff_target_values& operator=(const diff_target_values&) = delete;
        diff_target_values(diff_target_values&&) = delete;
        diff_target_values& operator=(diff_target_values&&) = delete;
        ~diff_target_values() = default;
        void reserve(const std::size_t n)
        {
            if (n > inline_size)
            {
                large.resize(n);
                items = large.data();
            }
        }
        void push_back(const basic_json* value)
        {
            items[count++] = value;
        }
        std::size_t size() const noexcept
        {
            return count;
        }
        const basic_json* operator[](const std::size_t i) const noexcept
        {
            return items[i];
        }
      private:
        static constexpr std::size_t inline_size = 16;
        /// the values of a small object, left uninitialized: they are written
        /// before they are read (the user-provided constructor keeps the
        /// member initialization, which -Weffc++ asks for, from zeroing them)
        struct uninitialized_items : std::array<const basic_json*, inline_size>
        {
            uninitialized_items() noexcept {} // NOLINT(modernize-use-equals-default,hicpp-use-equals-default,cppcoreguidelines-pro-type-member-init,hicpp-member-init): see above
        };
        std::size_t count = 0;
        std::vector<const basic_json*> large{}; // NOLINT(readability-redundant-member-init)
        uninitialized_items inline_items;
        const basic_json** items = inline_items.data();
    };
    /// @brief append "/" and the decimal representation of @a index to @a path
    static void diff_append_index(string_t& path, std::size_t index)
    {
@@ -7478,8 +7637,9 @@ public:
    operations that remove every member of @a source and add every member of
    @a target to @a result, and returns false.
    */
    template<typename TargetValues>
    static bool diff_object_keys(basic_json& result, const basic_json& source, const basic_json& target,
-                                 const string_t& path, std::vector<const basic_json*>& target_values,
+                                 const string_t& path, TargetValues& target_values,
                                 std::vector<const_iterator>& added)
    {
        // first pass: one lookup per source key
@@ -7693,7 +7853,7 @@ public:
            case value_t::object:
            {
-                std::vector<const basic_json*> target_values;
+                diff_target_values target_values;
                std::vector<const_iterator> added;
                if (diff_object_keys(result, source, target, path, target_values, added))
                {
@@ -5770,7 +5770,7 @@ template<typename BasicJsonType, bool Editable>
 BasicJsonType materialize(const document_data& d, const node* n)
 {
    using string_t = typename BasicJsonType::string_t;
-    using sax_t = json_sax_dom_parser<BasicJsonType, iterator_input_adapter<const char*>, true>;
+    using sax_t = json_sax_dom_parser<BasicJsonType, iterator_input_adapter<const char*>>;
    using nav = navigation<Editable>;
    // the open containers: their next element (or key of the next member),
@@ -492,3 +492,278 @@ TEST_CASE("binary_reserve_hint never over-reserves")
        CHECK(nlohmann::detail::binary_reserve_hint(json({{"a", 1}, {"b", 2}})) == 5);
    }
 }
 namespace
 {
 // numbers around every boundary of the integer encodings, and floats of each
 // kind (exact in float, needing double, special values)
 std::vector<json> boundary_numbers()
 {
    std::vector<json> numbers;
    for (int k = 0; k < 64; ++k)
    {
        const std::uint64_t p = std::uint64_t{1} << k;
        for (const std::uint64_t d :
                {
                    p - 1, p, p + 1
                })
        {
            numbers.emplace_back(d);
            if (d <= static_cast<std::uint64_t>((std::numeric_limits<std::int64_t>::max)()))
            {
                numbers.emplace_back(static_cast<std::int64_t>(d));
                numbers.emplace_back(-static_cast<std::int64_t>(d));
                numbers.emplace_back(-static_cast<std::int64_t>(d) - 1);
            }
        }
    }
    numbers.emplace_back((std::numeric_limits<std::int64_t>::min)());
    numbers.emplace_back((std::numeric_limits<std::uint64_t>::max)());
    for (const double f :
            {
                0.0, -0.0, 1.0, -1.0, 0.5, 0.1, 3.25, 1e300, -1e-300, 3.4028234663852886e38, 1e39,
                std::numeric_limits<double>::infinity(), -std::numeric_limits<double>::infinity(),
                std::numeric_limits<double>::quiet_NaN()
            })
    {
        numbers.emplace_back(f);
    }
    return numbers;
 }
 // the concatenation of the encodings of the elements of @a numbers[first, first + count)
 template<typename Single>
 std::vector<std::uint8_t> concat_singles(const std::vector<json>& numbers, const std::size_t first, const std::size_t count, Single single)
 {
    std::vector<std::uint8_t> bytes;
    for (std::size_t i = first; i < first + count; ++i)
    {
        const auto one = single(numbers[i]);
        bytes.insert(bytes.end(), one.begin(), one.end());
    }
    return bytes;
 }
 } // namespace
 // Runs of numbers in arrays are encoded straight into space reserved from the
 // sink, by code that is separate from the encoding of a single value. Both have
 // to agree on every number: an array is its head and the encodings of its
 // elements, one after the other.
 TEST_CASE("runs of numbers in arrays are encoded as the numbers one by one")
 {
    const std::vector<json> numbers = boundary_numbers();
    // arrays of every length that a one-byte head covers, so that runs are as
    // long as, and longer and shorter than, what fits one reservation
    for (const std::size_t count :
            {
                1u, 2u, 3u, 5u, 14u, 15u, 23u
            })
    {
        for (std::size_t first = 0; first + count <= numbers.size(); first += 7)
        {
            const json array(std::vector<json>(numbers.begin() + static_cast<std::ptrdiff_t>(first),
                                               numbers.begin() + static_cast<std::ptrdiff_t>(first + count)));
            CAPTURE(array.dump(-1, ' ', false, json::error_handler_t::replace))
            std::vector<std::uint8_t> expected{static_cast<std::uint8_t>(0x80 + count)};
            auto elements = concat_singles(numbers, first, count, [](const json & j)
            {
                return json::to_cbor(j);
            });
            expected.insert(expected.end(), elements.begin(), elements.end());
            CHECK(json::to_cbor(array) == expected);
            expected.assign(1, static_cast<std::uint8_t>(count <= 15 ? 0x90 + count : 0xDC));
            if (count > 15)
            {
                expected.push_back(0);
                expected.push_back(static_cast<std::uint8_t>(count));
            }
            elements = concat_singles(numbers, first, count, [](const json & j)
            {
                return json::to_msgpack(j);
            });
            expected.insert(expected.end(), elements.begin(), elements.end());
            CHECK(json::to_msgpack(array) == expected);
            for (const bool bjdata :
                    {
                        false, true
                    })
            {
                expected.assign(1, static_cast<std::uint8_t>('['));
                elements = concat_singles(numbers, first, count, [bjdata](const json & j)
                {
                    return bjdata ? json::to_bjdata(j) : json::to_ubjson(j);
                });
                expected.insert(expected.end(), elements.begin(), elements.end());
                expected.push_back(static_cast<std::uint8_t>(']'));
                CHECK((bjdata ? json::to_bjdata(array) : json::to_ubjson(array)) == expected);
            }
            // BON8 has no integers above the int64 range
            bool representable = true;
            for (std::size_t i = first; i < first + count; ++i)
            {
                representable = representable && bon8_representable(numbers[i]);
            }
            if (representable)
            {
                expected.assign(1, static_cast<std::uint8_t>(count <= 4 ? 0x80 + count : 0x85));
                elements = concat_singles(numbers, first, count, [](const json & j)
                {
                    return json::to_bon8(j);
                });
                expected.insert(expected.end(), elements.begin(), elements.end());
                if (count > 4)
                {
                    expected.push_back(0xFE);
                }
                CHECK(json::to_bon8(array) == expected);
            }
            else
            {
                CHECK_THROWS_AS(json::to_bon8(array), json::out_of_range&);
            }
        }
    }
 }
 // An array that is written in more than one reservation (more numbers than fit
 // one), and arrays of an index with more digits, round trip for every format.
 TEST_CASE("large arrays and many digits of indices round trip")
 {
    json array = json::array();
    for (int i = 0; i < 12000; ++i)
    {
        switch (i % 4)
        {
            case 0:
                array.push_back(i);
                break;
            case 1:
                array.push_back(-i);
                break;
            case 2:
                array.push_back(i * 0.25);
                break;
            default:
                array.push_back(i % 8 == 3);
                break;
        }
    }
    json document = json::object();
    document["numbers"] = array;
    document["nested"] = json::array({array, "text", array});
    CHECK(json::from_cbor(json::to_cbor(document)) == document);
    CHECK(json::from_msgpack(json::to_msgpack(document)) == document);
    CHECK(json::from_ubjson(json::to_ubjson(document)) == document);
    CHECK(json::from_ubjson(json::to_ubjson(document, true, true)) == document);
    CHECK(json::from_bjdata(json::to_bjdata(document)) == document);
    CHECK(json::from_bson(json::to_bson(document)) == document);
    CHECK(json::from_bon8(json::to_bon8(document)) == document);
 }
 // Strings and keys are written with their head in one reservation up to a
 // length; around that length, and with every kind of head, they must read back.
 TEST_CASE("strings of every head length round trip")
 {
    json document = json::object();
    json array = json::array();
    for (const std::size_t length :
            {
                0u, 1u, 2u, 3u, 4u, 7u, 8u, 15u, 16u, 17u, 23u, 24u, 25u, 31u, 32u, 33u, 63u, 127u, 128u, 129u, 200u, 245u, 246u, 247u, 248u, 249u, 250u, 251u, 252u, 253u, 254u, 255u, 256u, 257u, 300u, 1000u, 65535u, 65536u, 70000u
            })
    {
        const std::string text(length, 'x');
        array.push_back(text);
        document[std::string(length, 'k')] = text;
    }
    document["array"] = array;
    CHECK(json::from_cbor(json::to_cbor(document)) == document);
    CHECK(json::from_msgpack(json::to_msgpack(document)) == document);
    CHECK(json::from_ubjson(json::to_ubjson(document)) == document);
    CHECK(json::from_ubjson(json::to_ubjson(document, true, true)) == document);
    CHECK(json::from_bjdata(json::to_bjdata(document)) == document);
    CHECK(json::from_bson(json::to_bson(document)) == document);
    CHECK(json::from_bon8(json::to_bon8(document)) == document);
 }
 #if !defined(JSON_NOEXCEPTION)
 // What a write that throws leaves behind in an output adapter is what was written
 // before it, whatever the adapter and however the adapter sink buffers. (Without
 // exceptions, the writes in CHECK_THROWS_AS do not run.)
 TEST_CASE("a write that throws leaves the same bytes in every kind of output")
 {
    json array = json::array();
    for (int i = 0; i < 700; ++i)
    {
        array.push_back(i * 1000);
        array.push_back("text " + std::to_string(i));
    }
    array.push_back("bad \xFF byte");
    json document = json::object();
    document["first"] = array;
    document["second"] = 1;
    const auto strict = json::error_handler_t::strict;
    SECTION("cbor")
    {
        std::vector<std::uint8_t> as_vector;
        std::string as_string;
        std::ostringstream as_stream;
        CHECK_THROWS_AS(json::to_cbor(document, as_vector, strict), json::type_error&);
        CHECK_THROWS_AS(json::to_cbor(document, as_string, strict), json::type_error&);
        CHECK_THROWS_AS(json::to_cbor(document, as_stream, strict), json::type_error&);
        CHECK(!as_vector.empty());
        CHECK(std::string(reinterpret_cast<const char*>(as_vector.data()), as_vector.size()) == as_string); // NOLINT(cppcoreguidelines-pro-type-reinterpret-cast)
        CHECK(as_stream.str() == as_string);
    }
    SECTION("msgpack")
    {
        std::vector<std::uint8_t> as_vector;
        std::string as_string;
        std::ostringstream as_stream;
        CHECK_THROWS_AS(json::to_msgpack(document, as_vector, strict), json::type_error&);
        CHECK_THROWS_AS(json::to_msgpack(document, as_string, strict), json::type_error&);
        CHECK_THROWS_AS(json::to_msgpack(document, as_stream, strict), json::type_error&);
        CHECK(!as_vector.empty());
        CHECK(std::string(reinterpret_cast<const char*>(as_vector.data()), as_vector.size()) == as_string); // NOLINT(cppcoreguidelines-pro-type-reinterpret-cast)
        CHECK(as_stream.str() == as_string);
    }
    SECTION("ubjson")
    {
        std::vector<std::uint8_t> as_vector;
        std::string as_string;
        std::ostringstream as_stream;
        CHECK_THROWS_AS(json::to_ubjson(document, as_vector, false, false, strict), json::type_error&);
        CHECK_THROWS_AS(json::to_ubjson(document, as_string, false, false, strict), json::type_error&);
        CHECK_THROWS_AS(json::to_ubjson(document, as_stream, false, false, strict), json::type_error&);
        CHECK(!as_vector.empty());
        CHECK(std::string(reinterpret_cast<const char*>(as_vector.data()), as_vector.size()) == as_string); // NOLINT(cppcoreguidelines-pro-type-reinterpret-cast)
        CHECK(as_stream.str() == as_string);
    }
    SECTION("bson")
    {
        // the size pass finds the string before anything is written
        std::vector<std::uint8_t> as_vector;
        std::string as_string;
        std::ostringstream as_stream;
        CHECK_THROWS_AS(json::to_bson(document, as_vector, strict), json::type_error&);
        CHECK_THROWS_AS(json::to_bson(document, as_string, strict), json::type_error&);
        CHECK_THROWS_AS(json::to_bson(document, as_stream, strict), json::type_error&);
        CHECK(as_vector.empty());
        CHECK(as_string.empty());
        CHECK(as_stream.str().empty());
    }
 }
 #endif
@@ -2952,81 +2952,3 @@ TEST_CASE("diagnostic positions: value lifetime, input adapters, and SAX")
    }
 }
 #endif
 TEST_CASE("accept() agrees with parse() on floats around the overflow limit")
 {
    // accept() does not convert a float that cannot overflow; the tokens
    // around the limit (and beyond it) must still be rejected exactly as
    // parse() rejects them
    const char* const numbers[] =
    {
        "1e0", "123.456e-5", "1e-400", "-1e-400", "1e307", "1e308", "1e309", "-1e309",
        "10e307", "100e307", "0.1e309", "0.1e310", "1E+308", "1E+309",
        "1.7976931348623157e308", "1.7976931348623159e308", "1.8e308", "-1.7976931348623157e308",
        "12345678901234567e291", "12345678901234567e292", "123456789012345678e290", "123456789012345678e291",
        "1234567890123456789e289", "1234567890123456789e290", "9999999999999999999e289", "9999999999999999999e290",
        "0.00000000000000000001e328", "0.00000000000000000001e329"
    };
    for (const char* number : numbers)
    {
        for (const std::string& text :
                {
                    std::string(number), "[" + std::string(number) + "]", "{\"a\":" + std::string(number) + "}"
                })
        {
            INFO(text);
            const bool parses = !json::parse(text, nullptr, false).is_discarded();
            CHECK(json::accept(text) == parses);
        }
    }
 }
 namespace
 {
 // a DOM parser that reports parse errors without throwing, as in the sax_no_exception example
 template<typename BasicJsonType>
 class quiet_dom_parser : public nlohmann::detail::json_sax_dom_parser<BasicJsonType, nlohmann::detail::string_input_adapter_type>
 {
  public:
    explicit quiet_dom_parser(BasicJsonType& j)
        : nlohmann::detail::json_sax_dom_parser<BasicJsonType, nlohmann::detail::string_input_adapter_type>(j, false)
    {}
    bool parse_error(std::size_t /*unused*/, const std::string& /*unused*/, const nlohmann::detail::exception& /*unused*/)
    {
        return false;
    }
 };
 template<typename BasicJsonType>
 std::string read_before_error(const std::string& text)
 {
    BasicJsonType j;
    quiet_dom_parser<BasicJsonType> sax(j);
    CHECK(!BasicJsonType::sax_parse(text, &sax));
    return j.dump();
 }
 } // namespace
 TEST_CASE("a json_sax_dom_parser keeps the values read before a parse error")
 {
    // a json_sax_dom_parser that a user constructs stores every value in place, so a
    // handler that does not throw on a parse error sees what was read before it
    const std::vector<std::pair<std::string, std::string>> cases =
    {
        {"[1,2,3,]", "[1,2,3]"},
        {"[[1,[2,3],4],[5,", "[[1,[2,3],4],[5]]"},
        {R"({"a":1,"b":[1,2,{"c":)", R"({"a":1,"b":[1,2,{"c":null}]})"},
        {R"({"a":1,"a":)", R"({"a":1})"},
        {"[0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,]", "[0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19]"},
        {R"({"k0":0,"k1":1,"k2":{"x":[true,)", R"({"k0":0,"k1":1,"k2":{"x":[true]}})"},
        {R"([{},[],{"a":[]},x)", R"([{},[],{"a":[]}])"},
    };
    for (const auto& c : cases)
    {
        CAPTURE(c.first)
        CHECK(read_before_error<json>(c.first) == c.second);
        CHECK(read_before_error<nlohmann::ordered_json>(c.first) == c.second);
    }
 }
@@ -285,6 +285,58 @@ TEST_CASE("custom number types: integers beyond 64 bits")
        CHECK(wide_json::to_bjdata(wide_json::array({uint_big, uint_big}), true, true) == expected_bjdata_array);
    }
    SECTION("integers in arrays and objects")
    {
        // runs of numbers and scalar object members are encoded by loops of
        // their own for the number types up to 64 bits; a wider number type
        // takes the generic path, which checks the range of every integer
        const wide_json run = wide_json::array({make_int(1), make_int(-3), make_uint(7), wide_json(1.5), int_big, make_int(5)});
        const wide_json run_negative = wide_json::array({make_int(1), make_int(-3), int_big_negative});
        const wide_json run_unsigned = wide_json::array({make_uint(1), make_uint(7), uint_big});
        const wide_json members = wide_json::object({{"a", make_int(1)}, {"b", wide_json(1.5)}, {"c", int_big}});
        const std::vector<wide_json> failing = {run, run_negative, run_unsigned, members, wrap(run), wrap(members)};
        for (const auto& value : failing)
        {
            CHECK_THROWS_AS(_ = wide_json::to_cbor(value), out_of_range&);
            CHECK_THROWS_AS(_ = wide_json::to_msgpack(value), out_of_range&);
            CHECK_THROWS_AS(_ = wide_json::to_bson(wrap(value)), out_of_range&);
            CHECK_THROWS_AS(_ = wide_json::to_bon8(value), out_of_range&);
        }
 #if !defined(JSON_NOEXCEPTION)
        // a failing write leaves no more than the elements before the failing one
        // (without exceptions, the writes in CHECK_THROWS_AS do not run)
        std::vector<std::uint8_t> out;
        CHECK_THROWS_AS(wide_json::to_cbor(run, out), out_of_range&);
        // (the head of the array, 1, -3, 7, and 1.5 as a single-precision float)
        CHECK(out == std::vector<std::uint8_t>({0x86, 0x01, 0x22, 0x07, 0xFA, 0x3F, 0xC0, 0x00, 0x00}));
        out.clear();
        CHECK_THROWS_AS(wide_json::to_bon8(run, out), out_of_range&);
        CHECK(!out.empty());
 #endif
        // the same values that fit are written exactly as with 64-bit number types
        const wide_json fits = wide_json::array({make_int(1), make_int(-3), make_uint(7), wide_json(1.5), make_int(min_int64), make_int(max_int64), make_int(200), make_int(-70000)});
        const nlohmann::json fits64 = nlohmann::json::array({1, -3, 7, 1.5, (std::numeric_limits<std::int64_t>::min)(), (std::numeric_limits<std::int64_t>::max)(), 200, -70000});
        CHECK(wide_json::to_cbor(fits) == nlohmann::json::to_cbor(fits64));
        CHECK(wide_json::to_msgpack(fits) == nlohmann::json::to_msgpack(fits64));
        CHECK(wide_json::to_ubjson(fits) == nlohmann::json::to_ubjson(fits64));
        CHECK(wide_json::to_ubjson(fits, true, true) == nlohmann::json::to_ubjson(fits64, true, true));
        CHECK(wide_json::to_bjdata(fits) == nlohmann::json::to_bjdata(fits64));
        CHECK(wide_json::to_bjdata(fits, true, true) == nlohmann::json::to_bjdata(fits64, true, true));
        CHECK(wide_json::to_bon8(fits) == nlohmann::json::to_bon8(fits64));
        CHECK(wide_json::to_bson(wrap(fits)) == nlohmann::json::to_bson(nlohmann::json::object({{"v", fits64}})));
        const wide_json fit_members = wide_json::object({{"a", make_int(1)}, {"b", make_int(-300)}, {"c", make_uint(max_uint64)}, {"d", wide_json(2.5)}});
        const nlohmann::json fit_members64 = nlohmann::json::object({{"a", 1}, {"b", -300}, {"c", (std::numeric_limits<std::uint64_t>::max)()}, {"d", 2.5}});
        CHECK(wide_json::to_cbor(fit_members) == nlohmann::json::to_cbor(fit_members64));
        CHECK(wide_json::to_msgpack(fit_members) == nlohmann::json::to_msgpack(fit_members64));
        CHECK(wide_json::to_ubjson(fit_members) == nlohmann::json::to_ubjson(fit_members64));
        CHECK(wide_json::to_bjdata(fit_members) == nlohmann::json::to_bjdata(fit_members64));
        CHECK(wide_json::to_bson(fit_members) == nlohmann::json::to_bson(fit_members64));
    }
    SECTION("BJData ND-array")
    {
        // an ND-array element beyond 64 bits does not fit any dtype, so the
@@ -237,274 +237,3 @@ TEST_CASE("regression test for issue #5673 - ordered_json::emplace with a non-rv
        CHECK(oj.dump() == "{\"a\":1}");
    }
 }
 namespace
 {
 // the sizes around which the DOM parser changes how it stores the elements of
 // an array (16) and the members of an object in a vector (32, and 64 for the
 // key index)
 const std::size_t container_sizes[] = {0, 1, 2, 3, 15, 16, 17, 18, 31, 32, 33, 34, 63, 64, 65, 66, 200};
 template<typename Json>
 std::string array_text(const std::size_t n, const std::size_t depth)
 {
    std::string text = "[";
    for (std::size_t i = 0; i < n; ++i)
    {
        text += (i == 0 ? "" : ",");
        // alternate scalars, empty containers and nested containers
        switch (i % 4)
        {
            case 0:
                text += std::to_string(i);
                break;
            case 1:
                text += "\"s" + std::to_string(i) + "\"";
                break;
            case 2:
                text += depth == 0 ? "[]" : array_text<Json>(n / 2, depth - 1);
                break;
            default:
                text += depth == 0 ? "{}" : "{\"a\":" + array_text<Json>(n / 3, depth - 1) + ",\"b\":null}";
                break;
        }
    }
    return text + "]";
 }
 template<typename Json>
 std::string object_text(const std::size_t n, const std::size_t depth, const bool duplicates)
 {
    std::string text = "{";
    for (std::size_t i = 0; i < n; ++i)
    {
        text += (i == 0 ? "" : ",");
        text += "\"key" + std::to_string(i) + "\":";
        switch (i % 4)
        {
            case 0:
                text += std::to_string(i);
                break;
            case 1:
                text += depth == 0 ? "[]" : array_text<Json>(n / 2, depth - 1);
                break;
            case 2:
                text += depth == 0 ? "{}" : object_text<Json>(n / 2, depth - 1, duplicates);
                break;
            default:
                text += "\"value\"";
                break;
        }
    }
    if (duplicates)
    {
        // keys that are there already, the first and the last one, with other values
        text += n == 0 ? "" : ",";
        text += "\"key0\":[1,2],\"key" + std::to_string(n - 1) + "\":{\"again\":true}";
    }
    return text + "}";
 }
 template<typename Json>
 void check_same_dump(const std::string& text)
 {
    // the text is what dump() writes for the parsed value, and the value
    // survives a second round trip: arrays keep their elements in order, an
    // ordered_json keeps its members in order of appearance
    const Json parsed = Json::parse(text);
    const Json again = Json::parse(parsed.dump());
    CHECK(parsed == again);
    CHECK(parsed.dump() == again.dump());
    CHECK(Json::accept(text));
 }
 } // namespace
 TEST_CASE("parsing containers of sizes around the limits of the DOM parser")
 {
    SECTION("arrays")
    {
        for (const std::size_t n : container_sizes)
        {
            const std::string text = array_text<json>(n, 2);
            INFO("size ", n);
            const json parsed = json::parse(text);
            CHECK(parsed.is_array());
            CHECK(parsed.size() == n);
            for (std::size_t i = 0; i < n; i += 4)
            {
                CHECK(parsed[i] == i);
            }
            check_same_dump<json>(text);
            check_same_dump<ordered_json>(text);
            CHECK(ordered_json::parse(text).dump() == parsed.dump());
        }
    }
    SECTION("objects")
    {
        for (const bool duplicates :
                {
                    false, true
                })
        {
            for (const std::size_t n : container_sizes)
            {
                const std::string text = object_text<json>(n, 2, duplicates);
                INFO("size ", n, " duplicates ", duplicates);
                const json parsed = json::parse(text);
                const ordered_json ordered = ordered_json::parse(text);
                CHECK(parsed.is_object());
                CHECK(ordered.is_object());
                CHECK(parsed.size() == ordered.size());
                // the same members, in the order of their first appearance
                std::size_t i = 0;
                for (auto it = ordered.begin(); it != ordered.end(); ++it, ++i)
                {
                    if (i < n)
                    {
                        CHECK(it.key() == "key" + std::to_string(i));
                    }
                    CHECK(parsed.at(it.key()) == json(it.value()));
                }
                if (duplicates && n > 1)
                {
                    // the later value replaced the earlier one in its place
                    CHECK(ordered.at("key0") == ordered_json::parse("[1,2]"));
                    CHECK(ordered.at("key" + std::to_string(n - 1)) == ordered_json::parse("{\"again\":true}"));
                    CHECK(ordered.begin().key() == "key0");
                    CHECK(ordered.size() == n);
                }
                check_same_dump<json>(text);
                check_same_dump<ordered_json>(text);
            }
        }
    }
    SECTION("objects with many different and repeated keys")
    {
        // 300 members of which a third repeat an earlier key
        std::string text = "{";
        for (std::size_t i = 0; i < 300; ++i)
        {
            text += (i == 0 ? "" : ",");
            text += "\"k" + std::to_string(i % 200) + "\":" + std::to_string(i);
        }
        text += "}";
        const ordered_json ordered = ordered_json::parse(text);
        const json parsed = json::parse(text);
        CHECK(ordered.size() == 200);
        CHECK(parsed.size() == 200);
        std::size_t i = 0;
        for (auto it = ordered.begin(); it != ordered.end(); ++it, ++i)
        {
            CHECK(it.key() == "k" + std::to_string(i));
            // the last value written
            CHECK(it.value() == (i < 100 ? i + 200 : i));
            CHECK(parsed.at(it.key()) == json(it.value()));
        }
    }
 }
 namespace
 {
 // a deterministic source of structure for parsing tests: builds a JSON text
 // and, at the same time, the value it has to parse to
 class tree_generator
 {
  public:
    explicit tree_generator(std::uint32_t seed) : state(seed) {}
    template<typename Json>
    Json make(std::string& text, const std::size_t depth)
    {
        switch (next(depth == 0 ? 5 : 9))
        {
            case 0:
                text += "null";
                return Json(nullptr);
            case 1:
                text += "true";
                return Json(true);
            case 2:
            {
                const int n = static_cast<int>(next(2000)) - 1000;
                text += std::to_string(n);
                return Json(n);
            }
            case 3:
                text += "\"text\"";
                return Json("text");
            case 4:
                text += "2.5";
                return Json(2.5);
            case 5:
            case 6:
            case 7:
            {
                Json array = Json::array();
                text += "[";
                const std::size_t n = size();
                for (std::size_t i = 0; i < n; ++i)
                {
                    text += (i == 0 ? "" : ",");
                    array.push_back(make<Json>(text, depth - 1));
                }
                text += "]";
                return array;
            }
            default:
            {
                Json object = Json::object();
                text += "{";
                const std::size_t n = size();
                for (std::size_t i = 0; i < n; ++i)
                {
                    const std::string key = "k" + std::to_string(i);
                    text += (i == 0 ? "\"" : ",\"") + key + "\":";
                    object[key] = make<Json>(text, depth - 1);
                }
                text += "}";
                return object;
            }
        }
    }
  private:
    std::uint32_t next(const std::uint32_t bound)
    {
        state = state * 1664525U + 1013904223U;
        return (state >> 8) % bound;
    }
    std::size_t size()
    {
        return container_sizes[next(sizeof(container_sizes) / sizeof(*container_sizes))];
    }
    std::uint32_t state;
 };
 } // namespace
 TEST_CASE("parsing random trees of arrays and objects")
 {
    for (std::uint32_t seed = 1; seed <= 150; ++seed)
    {
        INFO("seed ", seed);
        std::string text;
        std::string ordered_text;
        const json expected = tree_generator(seed).make<json>(text, 3);
        const ordered_json ordered_expected = tree_generator(seed).make<ordered_json>(ordered_text, 3);
        CHECK(text == ordered_text);
        CHECK(json::parse(text) == expected);
        CHECK(json::accept(text));
        const ordered_json ordered = ordered_json::parse(text);
        CHECK(ordered == ordered_expected);
        CHECK(ordered.dump() == ordered_expected.dump());
        CHECK(json::parse(text).dump() == expected.dump());
    }
 }
@@ -1580,3 +1580,94 @@ TEST_CASE("invalid UTF-8 at every position is handled like the reference")
        }
    }
 }
 TEST_CASE("short strings are written like the reference, as values and as keys")
 {
    // strings of up to 16 characters (32 with vector instructions) that need no
    // escaping are written as a whole (together with the quotes and, for a key,
    // the colon); everything else, including a string that is merely short,
    // takes the general path.
    // Every length around the edges of the size classes of the fast path is
    // combined with each kind of byte that must send a string to the general
    // path, at each position, and compared with the reference for values and,
    // via the value, for keys.
    const std::vector<std::string> specials =
    {
        "\"", "\\", "\n", "\x1f", "\x7f", "\xc3\xa9", "\xe2\x82\xac", "\xf0\x9f\x98\x80", "\xff", "\x80", "\xc3"
    };
    for (std::size_t length = 0; length <= 36; ++length)
    {
        const std::string plain(length, 'k');
        check_dump_against_reference(plain, false);
        for (const auto& special : specials)
        {
            for (std::size_t pos = 0; pos <= length; ++pos)
            {
                std::string s = plain;
                s.insert(pos, special);
                check_dump_against_reference(s, false);
                for (const bool ensure_ascii :
                        {
                            false, true
                        })
                {
                    // a key and a value are written alike, in compact and
                    // in pretty-printed form
                    const json value = s;
                    const json object = json::object({{s, 1}});
                    for (const auto error_handler :
                            {
                                json::error_handler_t::replace, json::error_handler_t::keep
                            })
                    {
                        const std::string quoted = value.dump(-1, ' ', ensure_ascii, error_handler);
                        CHECK(object.dump(-1, ' ', ensure_ascii, error_handler) == "{" + quoted + ":1}");
                        CHECK(object.dump(2, ' ', ensure_ascii, error_handler) == "{\n  " + quoted + ": 1\n}");
                    }
                }
            }
        }
    }
 }
 TEST_CASE("runs of multi-byte characters are escaped like the reference under ensure_ascii")
 {
    // a run of well-formed multi-byte characters is escaped straight into the
    // write buffer; it has to flush that mid-run, stop at an ASCII character or
    // an ill-formed sequence and leave those to the general path, and pick up
    // behind what the general path has pending
    const std::vector<std::string> characters =
    {
        "\xc2\x80", "\xdf\xbf", "\xe0\xa0\x80", "\xe2\x82\xac", "\xed\x9f\xbf", "\xef\xbf\xbf",
        "\xf0\x90\x80\x80", "\xf0\x9f\x98\x80", "\xf4\x8f\xbf\xbf"
    };
    const std::vector<std::string> interruptions =
    {
        "", "a", "\n", "\"", "\x7f", "\xff", "\x80", "\xc3", "\xe2\x82", "\xf0\x9f\x98", "\xed\xa0\x80"
    };
    for (std::size_t shift = 0; shift <= 13; ++shift)
    {
        for (const auto& interruption : interruptions)
        {
            for (const std::size_t count :
                    {
                        std::size_t{1}, std::size_t{2}, std::size_t{85}, std::size_t{200}
                    })
            {
                std::string s(shift, 'x');
                for (std::size_t i = 0; i < count; ++i)
                {
                    s += characters[(i + shift) % characters.size()];
                }
                s += interruption;
                s += characters[shift % characters.size()];
                s += characters[(shift + 3) % characters.size()];
                check_dump_against_reference(s, shift < 2);
            }
        }
    }
 }
@@ -78,7 +78,8 @@ TEST_CASE("detail::bit_cast")
    // to and from byte arrays
    const auto bytes = bit_cast<std::array<std::uint8_t, 4>>(std::uint32_t{0x01020304u});
-    CHECK(bit_cast<std::uint32_t>(bytes) == 0x01020304u);
+    // qualified: with a std::array argument, ADL would also find std::bit_cast in C++20
    CHECK(nlohmann::detail::bit_cast<std::uint32_t>(bytes) == 0x01020304u);
    static_assert(noexcept(bit_cast<std::uint64_t>(1.0)), "bit_cast must be noexcept");
 }
@@ -48,14 +48,16 @@ namespace
 class chunked_streambuf : public std::streambuf
 {
  public:
-    chunked_streambuf(std::string s, std::size_t chunk_size)
+    // The first @a unbuffered characters are served without a get area, the
-        : m_data(std::move(s)), m_chunk_size(chunk_size)
+    // rest in get areas of @a chunk_size.
    chunked_streambuf(std::string s, std::size_t chunk_size, std::size_t unbuffered = 0)
        : m_data(std::move(s)), m_chunk_size(chunk_size), m_unbuffered(unbuffered)
    {}
  protected:
    int_type underflow() override
    {
-        if (m_chunk_size == 0)
+        if (m_chunk_size == 0 || m_pos < m_unbuffered)
        {
            return m_pos < m_data.size() ? traits_type::to_int_type(m_data[m_pos]) : traits_type::eof();
        }
@@ -77,7 +79,7 @@ class chunked_streambuf : public std::streambuf
    int_type uflow() override
    {
-        if (m_chunk_size == 0)
+        if (m_chunk_size == 0 || m_pos < m_unbuffered)
        {
            return m_pos < m_data.size() ? traits_type::to_int_type(m_data[m_pos++]) : traits_type::eof();
        }
@@ -88,6 +90,7 @@ class chunked_streambuf : public std::streambuf
    std::string m_data;
    std::size_t m_pos = 0;
    std::size_t m_chunk_size;
    std::size_t m_unbuffered;
 };
 // how a test reads from the stream
@@ -101,9 +104,9 @@ enum class read_mode
 // Read @a input from a chunked_streambuf and describe everything observable:
 // the values or the exception, the stream state after each value, and the
 // characters left in the stream.
-std::string observe(const std::string& input, std::size_t chunk_size, read_mode mode)
+std::string observe(const std::string& input, std::size_t chunk_size, read_mode mode, std::size_t unbuffered = 0)
 {
-    chunked_streambuf buf(input, chunk_size);
+    chunked_streambuf buf(input, chunk_size, unbuffered);
    std::istream is(&buf);
    std::string result;
    for (int i = 0; i < 4; ++i)
@@ -212,6 +215,31 @@ TEST_CASE("parsing from a std::istream scans the get area in bulk")
        }
    }
    SECTION("results do not depend on a get area that appears late")
    {
        // the first characters come without a get area, then the streambuf
        // starts to use one: the token that is read at that point is complete
        for (const auto& input : corpus())
        {
            const std::string expected = observe(input, 0, read_mode::extract);
            for (const std::size_t unbuffered :
                    {
                        1u, 2u, 3u, 5u, 8u, 13u, 21u
                    })
            {
                for (const std::size_t chunk_size :
                        {
                            1u, 2u, 3u, 7u, 64u
                        })
                {
                    CAPTURE(input)
                    CAPTURE(unbuffered)
                    CAPTURE(chunk_size)
                    CHECK(observe(input, chunk_size, read_mode::extract, unbuffered) == expected);
                }
            }
        }
    }
 #endif // !defined(JSON_NOEXCEPTION)
    SECTION("values are the same as when parsing from a string")
@@ -139,9 +139,12 @@ if __name__ == '__main__':
    namespaces += [f'{namespaces[0]}::{ns}' for ns in inline_namespaces]
    # The template renders a local XML file, not a web response, and autoescape is enabled.
    # nosemgrep: python.flask.security.xss.audit.direct-use-of-jinja2.direct-use-of-jinja2
    env = jinja2.Environment(loader=jinja2.FileSystemLoader(searchpath=sys.path[0]), autoescape=True, trim_blocks=True,
                                                            lstrip_blocks=True, keep_trailing_newline=True)
    template = env.get_template('nlohmann_json.natvis.j2')
    # nosemgrep: python.flask.security.xss.audit.direct-use-of-jinja2.direct-use-of-jinja2
    natvis = template.render(namespaces=namespaces)
    output = args.output or os.path.join(args.repo_root, 'nlohmann_json.natvis')
Author	SHA1	Message	Date
Niels Lohmann	ffcd392be0	Fix Semgrep findings in Python tooling (#5899 ) - generate_docset.py: use SHA-256 instead of SHA-1 for the cache file name digest of downloaded images. - generate_docset.py: suppress dynamic-urllib-use-detected; the URL scheme is restricted to http(s) right before the call. - generate_natvis.py: suppress direct-use-of-jinja2; the template renders a local XML file with autoescape enabled. Signed-off-by: Niels Lohmann <mail@nlohmann.me>	2026-10-23 07:11:17 +02:00
dependabot[bot]	e28506dd86	Bump jsdom from 30.1.2 to 30.1.3 in /docs/mkdocs/scripts/mermaid (#5898 ) Signed-off-by: Niels Lohmann <mail@nlohmann.me>	2026-10-23 06:54:23 +02:00
dependabot[bot]	03a0595c1e	Bump actions/upload-artifact from 7.0.1 to 7.0.2 (#5897 ) Signed-off-by: Niels Lohmann <mail@nlohmann.me>	2026-10-23 06:54:07 +02:00
dependabot[bot]	4e72af9d54	Bump step-security/harden-runner from 2.21.1 to 2.22.1 (#5896 ) Signed-off-by: Niels Lohmann <mail@nlohmann.me>	2026-10-23 06:53:50 +02:00
dependabot[bot]	0f5d07310c	Bump the codeql-action group with 4 updates (#5895 ) Signed-off-by: Niels Lohmann <mail@nlohmann.me>	2026-10-23 06:53:32 +02:00
Niels Lohmann	0b924f5375	Split and print JSON pointers in one pass (#5887 ) Signed-off-by: Niels Lohmann <mail@nlohmann.me>	2026-10-23 06:53:15 +02:00
Niels Lohmann	6fa14d8f95	Write binary formats through reserved sink space and number runs (#5885 ) Signed-off-by: Niels Lohmann <mail@nlohmann.me>	2026-10-23 06:52:58 +02:00
Niels Lohmann	dec0e9b749	Write strings, scalars and indentation in dump() with fewer calls (#5883 ) Signed-off-by: Niels Lohmann <mail@nlohmann.me>	2026-10-23 06:52:41 +02:00
Niels Lohmann	86d5c56c54	Speed up flatten(), unflatten(), diff() and patch() further (#5886 ) Signed-off-by: Niels Lohmann <mail@nlohmann.me>	2026-10-23 06:48:12 +02:00
Niels Lohmann	aa0b371f7c	Faster std::istream input: inline get-area path, binary reads, unbuffered streambufs (#5884 ) Signed-off-by: Niels Lohmann <mail@nlohmann.me>	2026-10-23 06:48:00 +02:00
Niels Lohmann	ace1030107	Fix develop CI: bit_cast ADL ambiguity and artifact-less comment runs (#5894 ) - unit-stl_helpers.cpp: with a std::array argument, an unqualified bit_cast<...>(bytes) also finds std::bit_cast via ADL in C++20 and MSVC 2019 rejects the call as ambiguous (AppVeyor). Qualify the call. - comment_check_amalgamation.yml: skip, rather than crash, when the triggering run has no "pr" artifact (stale queued runs that complete as failed without ever running a job). Signed-off-by: Niels Lohmann <mail@nlohmann.me>	2026-10-22 20:22:53 +02:00