Migrate REUSE metadata from deprecated .reuse/dep5 to REUSE.toml

reuse==6.2.0 (pinned in cmake/requirements/requirements-reuse.txt) warns
"'.reuse/dep5' is deprecated. You are recommended to instead use
REUSE.toml. Use `reuse convert-dep5` to convert." on every
ci_reuse_compliance run. A later reuse release that drops DEP5 support
would break that CI job outright.

Generate REUSE.toml from the 9 Files: stanzas with `reuse convert-dep5`
and remove .reuse/dep5. `reuse lint` still reports full compliance with
spec 3.3 (1268/1268 files with copyright and license information,
unchanged), and `reuse spdx` produces the same per-file copyright and
license entries as before the conversion.

Update the three places that referenced the old file: FILES.md now
documents REUSE.toml with a spec 3.3 link, README.md's REUSE section
names REUSE.toml, and the comment in gen_hedley_undef_check.cmake now
refers to REUSE.toml's blanket path = "**" rule.

Overlaps #4663, which adds an entry to .reuse/dep5; that PR will need to
move its entry into REUSE.toml when rebased on this.

#5716 item 4

Signed-off-by: Niels Lohmann <mail@nlohmann.me>

.github/workflows/macos.yml

@@ -71,3 +71,38 @@ jobs:
         run: cmake --build build --parallel 10
       - name: Test
         run: cd build ; ctest -j 10 --output-on-failure
+
+  swiftpm:
+    runs-on: macos-15
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Check that Package.swift resolves without a deprecation warning
+        run: swift package dump-package
+      - name: Build the SwiftPM documentation example against this checkout
+        run: |
+          mkdir -p /tmp/json-swiftpm-consumer/Sources/MyLibrary
+          cp docs/mkdocs/docs/integration/swift/example.cpp /tmp/json-swiftpm-consumer/Sources/MyLibrary/example.cpp
+          cat > /tmp/json-swiftpm-consumer/Package.swift << EOF
+          // swift-tools-version: 5.9
+          import PackageDescription
+
+          let package = Package(
+              name: "MyPackage",
+              dependencies: [
+                  .package(path: "${{ github.workspace }}")
+              ],
+              targets: [
+                  .target(
+                      name: "MyLibrary",
+                      dependencies: [
+                          .product(name: "json", package: "json")
+                      ],
+                      publicHeadersPath: "."
+                  )
+              ]
+          )
+          EOF
+          cd /tmp/json-swiftpm-consumer
+          swift build

.reuse/dep5

@@ -1,40 +0,0 @@
-Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
-Upstream-Name: json
-Upstream-Contact: Niels Lohmann <mail@nlohmann.me>
-Source: https://github.com/nlohmann/json
-
-Files: *
-Copyright: 2013-2026 Niels Lohmann <https://nlohmann.me>
-License: MIT
-
-Files: include/nlohmann/thirdparty/hedley.hpp
-Copyright: 2016-2021 Evan Nemerson <evan@nemerson.com>
-License: CC0
-
-Files: include/nlohmann/detail/meta/cpp_future.hpp
-Copyright: 2013-2026 Niels Lohmann <https://nlohmann.me> and 2018 The Abseil Authors
-License: MIT AND Apache-2.0
-
-Files: tests/thirdparty/doctest/*
-Copyright: 2016-2023 Viktor Kirilov
-License: MIT
-
-Files: tests/thirdparty/fifo_map/*
-Copyright: 2015-2017 Niels Lohmann
-License: MIT
-
-Files: tests/thirdparty/Fuzzer/*
-Copyright: 2003-2022 LLVM Project.
-License: Apache-2.0
-
-Files: tests/thirdparty/imapdl/*
-Copyright: 2017 Georg Sauthoff <mail@gms.tf>
-License: GPL-3.0-only
-
-Files: tools/amalgamate/*
-Copyright: 2012 Erik Edlund <erik.edlund@32767.se>
-License: BSD-3-Clause
-
-Files: tools/gdb_pretty_printer/*
-Copyright: 2020 Hannes Domani <https://github.com/ssbssa>
-License: MIT

BUILD.bazel

@@ -77,6 +77,7 @@ cc_library(
     name = "singleheader-json",
     hdrs = [
         "single_include/nlohmann/json.hpp",
+        "single_include/nlohmann/json_fwd.hpp",
     ],
     includes = ["single_include"],
     visibility = ["//visibility:public"],

CITATION.cff

@@ -10,5 +10,5 @@ title: "JSON for Modern C++"
 version: 3.12.0
 date-released: 2025-04-07
 license: MIT
-repository-code: "https://github.com/nlohmann"
+repository-code: "https://github.com/nlohmann/json"
 url: https://json.nlohmann.me

CMakeLists.txt

@@ -42,8 +42,11 @@ endif()
 ## OPTIONS
 ##
 
+# Build the tests by default only for the main project and only if the tests
+# directory exists (the release archive json.tar.xz does not contain it).
 # VERSION_GREATER_EQUAL is not available in older CMake (< 3.7)
-if(${MAIN_PROJECT} AND (${CMAKE_VERSION} VERSION_EQUAL 3.13 OR ${CMAKE_VERSION} VERSION_GREATER 3.13))
+if(${MAIN_PROJECT} AND (${CMAKE_VERSION} VERSION_EQUAL 3.13 OR ${CMAKE_VERSION} VERSION_GREATER 3.13)
+   AND EXISTS "${CMAKE_CURRENT_SOURCE_DIR}/tests/CMakeLists.txt")
     set(JSON_BuildTests_INIT ON)
 else()
     set(JSON_BuildTests_INIT OFF)

FILES.md

@@ -207,19 +207,19 @@ Further documentation:
 
 ## REUSE
 
-### `.reuse/dep5`
+### `REUSE.toml`
 
 The file defines the licenses of certain third-party components in the repository. The root `Makefile` contains a target `reuse` that checks for compliance.
 
 Further documentation:
 
-- [DEP5](https://reuse.software/spec-3.2/#dep5-deprecated)
+- [REUSE.toml](https://reuse.software/spec-3.3/#reusetoml)
 - [reuse command-line tool](https://pypi.org/project/reuse/)
 - [documentation of linting](https://reuse.readthedocs.io/en/stable/man/reuse-lint.html)
 - [REUSE](http://reuse.software)
 
 > [!IMPORTANT]
-> The filename `.reuse/dep5` is predetermined by REUSE. Alternatively, a `REUSE.toml` file can be used.
+> The filename `REUSE.toml` is predetermined by REUSE. Alternatively, a `.reuse/dep5` file (deprecated) can be used.
 
 ### `.reuse/templates`
 

Makefile

@@ -7,6 +7,9 @@
 # find GNU sed to use `-i` parameter
 SED:=$(shell command -v gsed || which sed)
 
+# find GNU tar to use `--sort` and `--pax-option` parameters
+TAR:=$(shell command -v gtar || which tar)
+
 
 ##########################################################################
 # source files
@@ -215,8 +218,8 @@ ChangeLog.md:
 # archive is created according to the advices of <https://reproducible-builds.org/docs/archives/>.
 json.tar.xz:
 	mkdir json
-	rsync -R $(shell find LICENSE.MIT nlohmann_json.natvis CMakeLists.txt cmake/*.in include single_include -type f) json
-	gtar --sort=name --mtime="@$(shell git log -1 --pretty=%ct)" --owner=0 --group=0 --numeric-owner --pax-option=exthdr.name=%d/PaxHeaders/%f,delete=atime,delete=ctime --create --file - json | xz --compress -9e --threads=2 - > json.tar.xz
+	rsync -R $(shell find LICENSE.MIT nlohmann_json.natvis CMakeLists.txt cmake/*.in include single_include src/modules -type f) json
+	$(TAR) --sort=name --mtime="@$(shell git log -1 --pretty=%ct)" --owner=0 --group=0 --numeric-owner --pax-option=exthdr.name=%d/PaxHeaders/%f,delete=atime,delete=ctime --create --file - json | xz --compress -9e --threads=2 - > json.tar.xz
 	rm -fr json
 
 # We use `-X` to make the resulting ZIP file reproducible, see

Package.swift

@@ -6,7 +6,7 @@ import PackageDescription
 let package = Package(
     name: "nlohmann-json",
      platforms: [
-        .iOS(.v12), .macOS(.v10_13), .tvOS(.v12), .watchOS(.v4), .visionOS(.v1)
+        .iOS(.v12), .macOS(.v10_13), .tvOS(.v12), .watchOS(.v9), .visionOS(.v1)
     ],
     products: [
         .library(name: "json", targets: ["json"])

README.md

@@ -1204,15 +1204,18 @@ language bindings, format converters, and the like. See the curated [Ecosystem](
 
 Though it's 2026 already, the support for C++11 is still a bit sparse. Currently, the following compilers are known to work:
 
-- GCC 4.8 - 14.2 (and possibly later)
-- Clang 3.4 - 21.0 (and possibly later)
-- Apple Clang 9.1 - 16.0 (and possibly later)
-- Intel C++ Compiler 17.0.2 (and possibly later)
-- Nvidia CUDA Compiler 11.0.221 (and possibly later)
-- Microsoft Visual C++ 2015 / Build Tools 14.0.25123.0 (and possibly later)
-- Microsoft Visual C++ 2017 / Build Tools 15.5.180.51428 (and possibly later)
-- Microsoft Visual C++ 2019 / Build Tools 16.3.1+1def00d3d (and possibly later)
-- Microsoft Visual C++ 2022 / Build Tools 19.30.30709.0 (and possibly later)
+- GCC 4.8 - 16.2 (and possibly later)
+- Clang 3.4 - 22.1 (and possibly later)
+- Apple Clang 15.0 - 21.0 (and possibly later)
+- Intel C++ Compiler Classic (icpc) 2021.10
+- Intel oneAPI DPC++/C++ Compiler (icpx) 2025.3 (and possibly later)
+- NVIDIA CUDA Compiler (nvcc) 11.8 - 12.6 (and possibly later)
+- NVIDIA HPC SDK C++ Compiler (nvc++) 25.5 (and possibly later)
+- Microsoft Visual C++ 2015 / MSVC 19.0 (and possibly later)
+- Microsoft Visual C++ 2017 / MSVC 19.16 (and possibly later)
+- Microsoft Visual C++ 2019 / MSVC 19.29 (and possibly later)
+- Microsoft Visual C++ 2022 / MSVC 19.44 (and possibly later)
+- Microsoft Visual C++ 2026 / MSVC 19.51 (and possibly later)
 
 I would be happy to learn about other compilers/versions.
 
@@ -1402,7 +1405,7 @@ The library is compliant to version 3.3 of the [**REUSE specification**](https:/
 
 - Every source file contains an SPDX copyright header.
 - The full text of all licenses used in the repository can be found in the `LICENSES` folder.
-- File `.reuse/dep5` contains an overview of all files' copyrights and licenses.
+- File `REUSE.toml` contains an overview of all files' copyrights and licenses.
 - Run `pipx run reuse lint` to verify the project's REUSE compliance and `pipx run reuse spdx` to generate a SPDX SBOM.
 
 ## Contact

REUSE.toml

@@ -0,0 +1,58 @@
+version = 1
+SPDX-PackageName = "json"
+SPDX-PackageSupplier = "Niels Lohmann <mail@nlohmann.me>"
+SPDX-PackageDownloadLocation = "https://github.com/nlohmann/json"
+
+[[annotations]]
+path = "**"
+precedence = "aggregate"
+SPDX-FileCopyrightText = "2013-2026 Niels Lohmann <https://nlohmann.me>"
+SPDX-License-Identifier = "MIT"
+
+[[annotations]]
+path = "include/nlohmann/thirdparty/hedley.hpp"
+precedence = "aggregate"
+SPDX-FileCopyrightText = "2016-2021 Evan Nemerson <evan@nemerson.com>"
+SPDX-License-Identifier = "CC0"
+
+[[annotations]]
+path = "include/nlohmann/detail/meta/cpp_future.hpp"
+precedence = "aggregate"
+SPDX-FileCopyrightText = "2013-2026 Niels Lohmann <https://nlohmann.me> and 2018 The Abseil Authors"
+SPDX-License-Identifier = "MIT AND Apache-2.0"
+
+[[annotations]]
+path = "tests/thirdparty/doctest/**"
+precedence = "aggregate"
+SPDX-FileCopyrightText = "2016-2023 Viktor Kirilov"
+SPDX-License-Identifier = "MIT"
+
+[[annotations]]
+path = "tests/thirdparty/fifo_map/**"
+precedence = "aggregate"
+SPDX-FileCopyrightText = "2015-2017 Niels Lohmann"
+SPDX-License-Identifier = "MIT"
+
+[[annotations]]
+path = "tests/thirdparty/Fuzzer/**"
+precedence = "aggregate"
+SPDX-FileCopyrightText = "2003-2022 LLVM Project."
+SPDX-License-Identifier = "Apache-2.0"
+
+[[annotations]]
+path = "tests/thirdparty/imapdl/**"
+precedence = "aggregate"
+SPDX-FileCopyrightText = "2017 Georg Sauthoff <mail@gms.tf>"
+SPDX-License-Identifier = "GPL-3.0-only"
+
+[[annotations]]
+path = "tools/amalgamate/**"
+precedence = "aggregate"
+SPDX-FileCopyrightText = "2012 Erik Edlund <erik.edlund@32767.se>"
+SPDX-License-Identifier = "BSD-3-Clause"
+
+[[annotations]]
+path = "tools/gdb_pretty_printer/**"
+precedence = "aggregate"
+SPDX-FileCopyrightText = "2020 Hannes Domani <https://github.com/ssbssa>"
+SPDX-License-Identifier = "MIT"

cmake/scripts/gen_bazel_build_file.cmake

@@ -48,6 +48,7 @@ cc_library(
     name = "singleheader-json",
     hdrs = [
         "single_include/nlohmann/json.hpp",
+        "single_include/nlohmann/json_fwd.hpp",
     ],
     includes = ["single_include"],
     visibility = ["//visibility:public"],

cmake/scripts/gen_hedley_undef_check.cmake

@@ -64,7 +64,7 @@ if(MODE STREQUAL "undef")
     # recipe is self-contained and its output is byte-stable across reruns.
     # The embedded SPDX tags below are part of the *generated* file's
     # content, not a REUSE header for this .cmake script itself (which is
-    # already covered by the blanket "Files: *" rule in .reuse/dep5) -- keep
+    # already covered by the blanket path = "**" rule in REUSE.toml) -- keep
     # them wrapped in REUSE-IgnoreStart/End so `reuse lint` does not try to
     # parse "MIT\n")" as this file's own SPDX-License-Identifier value.
     # REUSE-IgnoreStart

docs/mkdocs/docs/integration/cmake.md

@@ -125,7 +125,7 @@ automatically download a release as a dependency at configure time.
 
 ### `JSON_BuildTests`
 
-Build the unit tests when [`BUILD_TESTING`](https://cmake.org/cmake/help/latest/command/enable_testing.html) is enabled. This option is `ON` by default if the library's CMake project is the top project. That is, when integrating the library as described above, the test suite is not built unless explicitly switched on with this option.
+Build the unit tests when [`BUILD_TESTING`](https://cmake.org/cmake/help/latest/command/enable_testing.html) is enabled. This option is `ON` by default if the library's CMake project is the top project and the `tests` directory exists (the release archive `json.tar.xz` does not contain it). That is, when integrating the library as described above, the test suite is not built unless explicitly switched on with this option.
 
 ### `JSON_CI`
 

docs/mkdocs/docs/integration/package_managers.md

@@ -443,6 +443,30 @@ installed by adding the `-DJSON_MultipleHeaders=ON` flag (i.e., `cget install nl
     - :octicons-file-24: File issues at the [library issue tracker](https://github.com/nlohmann/json/issues)
     - :octicons-question-24: [Xcode documentation](https://developer.apple.com/documentation/xcode/adding-package-dependencies-to-your-app)
 
+The `json` target's public headers live at `single_include/nlohmann`, so a consumer must write `#include <json.hpp>` rather than the
+`#include <nlohmann/json.hpp>` form used elsewhere in this documentation. The `json` target also ships only headers, and SwiftPM/Xcode
+expect every library target to produce an object file to link against; without one, linking a consumer fails with a missing `json.o`
+([#4650](https://github.com/nlohmann/json/issues/4650)). The workaround is to add at least one `.cpp` file of your own to the target
+that depends on `json`.
+
+??? example
+
+    1. Create the following files:
+
+        ```swift title="Package.swift"
+        --8<-- "integration/swift/Package.swift"
+        ```
+
+        ```cpp title="Sources/MyLibrary/example.cpp"
+        --8<-- "integration/swift/example.cpp"
+        ```
+
+    2. Build
+
+        ```shell
+        swift build
+        ```
+
 ## NuGet
 
 !!! abstract "Summary"

docs/mkdocs/docs/integration/swift/Package.swift

@@ -0,0 +1,20 @@
+// swift-tools-version: 5.9
+import PackageDescription
+
+let package = Package(
+    name: "MyPackage",
+    dependencies: [
+        .package(url: "https://github.com/nlohmann/json.git", from: "3.12.0")
+    ],
+    targets: [
+        // the C++ target that uses nlohmann/json
+        .target(
+            name: "MyLibrary",
+            dependencies: [
+                .product(name: "json", package: "json")
+            ],
+            // works around missing public headers in MyLibrary; not related to nlohmann/json
+            publicHeadersPath: "."
+        )
+    ]
+)

docs/mkdocs/docs/integration/swift/example.cpp

@@ -0,0 +1,8 @@
+// MyLibrary must contain at least one .cpp file, or SwiftPM/Xcode will
+// not build a usable "json" library to link against (see nlohmann/json#4650)
+#include <json.hpp>
+
+nlohmann::json example()
+{
+    return nlohmann::json::meta();
+}

include/nlohmann/detail/output/binary_writer.hpp

@@ -29,7 +29,6 @@
 #include <nlohmann/detail/macro_scope.hpp>
 #include <nlohmann/detail/output/output_adapters.hpp>
 #include <nlohmann/detail/string_concat.hpp>
-#include <nlohmann/detail/string_utils.hpp>
 
 NLOHMANN_JSON_NAMESPACE_BEGIN
 namespace detail
@@ -2279,10 +2278,20 @@ class binary_writer
         const std::size_t valid = valid_utf8_prefix(data, s.size());
         if (JSON_HEDLEY_UNLIKELY(valid != s.size()))
         {
-            JSON_THROW(type_error::create(316, concat("invalid UTF-8 byte at index ", std::to_string(valid), ": 0x", detail::hex_byte(data[valid])), &context));
+            JSON_THROW(type_error::create(316, concat("invalid UTF-8 byte at index ", std::to_string(valid), ": 0x", hex_byte(data[valid])), &context));
         }
     }
 
+    /// @return a byte as two uppercase hexadecimal digits
+    static std::string hex_byte(const std::uint8_t byte)
+    {
+        std::string result = "00";
+        constexpr const char* nibble_to_hex = "0123456789ABCDEF";
+        result[0] = nibble_to_hex[byte / 16];
+        result[1] = nibble_to_hex[byte % 16];
+        return result;
+    }
+
     /*!
     @brief write an integer in the shortest encoding
 

include/nlohmann/detail/output/output_adapters.hpp

@@ -8,7 +8,9 @@
 
 #pragma once
 
+#include <algorithm> // copy
 #include <cstddef> // size_t
+#include <iterator> // back_inserter
 #include <memory> // shared_ptr, make_shared
 #include <string> // basic_string
 #include <utility> // move
@@ -29,10 +31,6 @@ namespace detail
 template<typename CharType> struct output_adapter_protocol
 {
     virtual void write_character(CharType c) = 0;
-    /// @param[in] s      pointer to the characters to write; binary_writer legitimately
-    ///                   passes a null pointer together with length 0 for an empty
-    ///                   string or binary value, so implementations must tolerate that
-    /// @param[in] length number of characters at @a s
     virtual void write_characters(const CharType* s, std::size_t length) = 0;
     virtual ~output_adapter_protocol() = default;
 
@@ -99,6 +97,7 @@ class output_vector_adapter : public output_adapter_protocol<CharType>
         sink.write_character(c);
     }
 
+    JSON_HEDLEY_NON_NULL(2)
     void write_characters(const CharType* s, std::size_t length) override
     {
         sink.write_characters(s, length);
@@ -123,6 +122,7 @@ class output_stream_adapter : public output_adapter_protocol<CharType>
         stream.put(c);
     }
 
+    JSON_HEDLEY_NON_NULL(2)
     void write_characters(const CharType* s, std::size_t length) override
     {
         stream.write(s, static_cast<std::streamsize>(length));
@@ -147,6 +147,7 @@ class output_string_adapter : public output_adapter_protocol<CharType>
         str.push_back(c);
     }
 
+    JSON_HEDLEY_NON_NULL(2)
     void write_characters(const CharType* s, std::size_t length) override
     {
         str.append(s, length);

include/nlohmann/detail/output/serializer.hpp

@@ -3,23 +3,24 @@
 // |  |  |__   |  |  | | | |  version 3.12.0
 // |_____|_____|_____|_|___|  https://github.com/nlohmann/json
 //
+// SPDX-FileCopyrightText: 2008, 2009 Björn Hoehrmann <bjoern@hoehrmann.de>
 // SPDX-FileCopyrightText: 2013-2026 Niels Lohmann <https://nlohmann.me>
 // SPDX-License-Identifier: MIT
 
 #pragma once
 
-#include <algorithm> // remove, fill, find, none_of, min
+#include <algorithm> // reverse, remove, fill, find, none_of, min
 #include <array> // array
 #include <clocale> // localeconv, lconv
-#include <cmath> // isfinite
+#include <cmath> // labs, isfinite, isnan, signbit
 #include <cstddef> // size_t, ptrdiff_t
 #include <cstdint> // uint8_t
 #include <cstdio> // snprintf
 #include <cstring> // memcpy, memset
-#include <iterator> // next
 #include <limits> // numeric_limits
 #include <string> // string, char_traits
 #include <type_traits> // is_same
+#include <utility> // move
 #include <vector> // vector
 
 #include <nlohmann/detail/conversions/to_chars.hpp>
@@ -27,6 +28,7 @@
 #include <nlohmann/detail/input/string_scan.hpp>
 #include <nlohmann/detail/macro_scope.hpp>
 #include <nlohmann/detail/meta/cpp_future.hpp>
+#include <nlohmann/detail/output/binary_writer.hpp>
 #include <nlohmann/detail/output/output_adapters.hpp>
 #include <nlohmann/detail/recursion_depth_limit.hpp>
 #include <nlohmann/detail/string_concat.hpp>
@@ -81,6 +83,7 @@ class serializer
                const std::size_t indent_step_ = 0,
                error_handler_t error_handler_ = error_handler_t::strict)
         : o(&s)
+        , locale(std::localeconv())
         , indent_char(ichar)
         , pretty_print(pretty_print_)
         , ensure_ascii(ensure_ascii_)
@@ -103,10 +106,9 @@ class serializer
     additional parameter. Arrays and objects are serialized without recursion,
     however deeply they are nested.
 
-    - strings and object keys are escaped using @ref dump_escaped
-    - integer numbers are converted using a digit-pair lookup table (@ref dump_integer)
-    - floating-point numbers are converted to a string using @ref dump_float, which
-      uses `to_chars` for IEEE-754 types and `snprintf` otherwise
+    - strings and object keys are escaped using `escape_string()`
+    - integer numbers are converted implicitly via `operator<<`
+    - floating-point numbers are converted to a string using `"%g"` format
     - binary values are serialized as objects containing the subtype and the
       byte array
 
@@ -281,16 +283,127 @@ class serializer
             }
 
             case value_t::string:
-            case value_t::binary:
-            case value_t::boolean:
-            case value_t::number_integer:
-            case value_t::number_unsigned:
-            case value_t::number_float:
-            case value_t::discarded:
-            case value_t::null:
-            default:
-                dump_scalar(val, current_indent);
+            {
+                put_char('"');
+                dump_escaped(*val.m_data.m_value.string);
+                put_char('"');
                 return;
+            }
+
+            case value_t::binary:
+            {
+                if (pretty_print)
+                {
+                    put_literal("{\n");
+
+                    // variable to hold indentation for recursive calls
+                    const auto new_indent = next_indent(current_indent, indent_step);
+
+                    put_indent(new_indent);
+
+                    put_literal("\"bytes\": [");
+
+                    if (!val.m_data.m_value.binary->empty())
+                    {
+                        for (auto i = val.m_data.m_value.binary->cbegin();
+                                i != val.m_data.m_value.binary->cend() - 1; ++i)
+                        {
+                            dump_byte(*i);
+                            put_literal(", ");
+                        }
+                        dump_byte(val.m_data.m_value.binary->back());
+                    }
+
+                    put_literal("],\n");
+                    put_indent(new_indent);
+
+                    put_literal("\"subtype\": ");
+                    if (val.m_data.m_value.binary->has_subtype())
+                    {
+                        dump_integer(val.m_data.m_value.binary->subtype());
+                    }
+                    else
+                    {
+                        put_literal("null");
+                    }
+                    put_char('\n');
+                    put_indent(current_indent);
+                    put_char('}');
+                }
+                else
+                {
+                    put_literal("{\"bytes\":[");
+
+                    if (!val.m_data.m_value.binary->empty())
+                    {
+                        for (auto i = val.m_data.m_value.binary->cbegin();
+                                i != val.m_data.m_value.binary->cend() - 1; ++i)
+                        {
+                            dump_byte(*i);
+                            put_char(',');
+                        }
+                        dump_byte(val.m_data.m_value.binary->back());
+                    }
+
+                    put_literal("],\"subtype\":");
+                    if (val.m_data.m_value.binary->has_subtype())
+                    {
+                        dump_integer(val.m_data.m_value.binary->subtype());
+                        put_char('}');
+                    }
+                    else
+                    {
+                        put_literal("null}");
+                    }
+                }
+                return;
+            }
+
+            case value_t::boolean:
+            {
+                if (val.m_data.m_value.boolean)
+                {
+                    put_literal("true");
+                }
+                else
+                {
+                    put_literal("false");
+                }
+                return;
+            }
+
+            case value_t::number_integer:
+            {
+                dump_integer(val.m_data.m_value.number_integer);
+                return;
+            }
+
+            case value_t::number_unsigned:
+            {
+                dump_integer(val.m_data.m_value.number_unsigned);
+                return;
+            }
+
+            case value_t::number_float:
+            {
+                dump_float(val.m_data.m_value.number_float);
+                return;
+            }
+
+            case value_t::discarded:
+            {
+                put_literal("<discarded>");
+                return;
+            }
+
+            case value_t::null:
+            {
+                put_literal("null");
+                return;
+            }
+
+            default:            // LCOV_EXCL_LINE
+                JSON_ASSERT(false); // NOLINT(cert-dcl03-c,hicpp-static-assert,misc-static-assert) LCOV_EXCL_LINE
         }
     }
 
@@ -447,9 +560,9 @@ class serializer
     @brief serialize the value @a val, but not the elements of a container
 
     An object or array with elements is opened and pushed onto @a stack for
-    @ref dump_iteratively to walk; everything else - including a binary value,
+    @ref dump_internal to walk; everything else - including a binary value,
     which looks like an object but has no elements to descend into - is written
-    out in full by @ref dump_scalar.
+    out here in full.
     */
     void dump_value(const BasicJsonType& val,
                     const std::size_t current_indent,
@@ -507,35 +620,6 @@ class serializer
                 return;
             }
 
-            case value_t::string:
-            case value_t::binary:
-            case value_t::boolean:
-            case value_t::number_integer:
-            case value_t::number_unsigned:
-            case value_t::number_float:
-            case value_t::discarded:
-            case value_t::null:
-            default:
-                dump_scalar(val, current_indent);
-                return;
-        }
-    }
-
-    /*!
-    @brief serialize the value @a val, which is neither an object nor an array
-
-    Shared by @ref dump_internal and @ref dump_value, so that a value is written
-    the same way however deeply it is nested. A binary value is written out here
-    in full: it looks like an object, but has no elements to descend into.
-
-    @param[in] val             value to serialize; not an object or array
-    @param[in] current_indent  the indentation of @a val, used for a
-                               pretty-printed binary value
-    */
-    void dump_scalar(const BasicJsonType& val, const std::size_t current_indent)
-    {
-        switch (val.m_data.m_type)
-        {
             case value_t::string:
             {
                 put_char('"');
@@ -656,8 +740,6 @@ class serializer
                 return;
             }
 
-            case value_t::object: // LCOV_EXCL_LINE
-            case value_t::array:  // LCOV_EXCL_LINE
             default:            // LCOV_EXCL_LINE
                 JSON_ASSERT(false); // NOLINT(cert-dcl03-c,hicpp-static-assert,misc-static-assert) LCOV_EXCL_LINE
         }
@@ -686,7 +768,7 @@ class serializer
     Escape a string by replacing certain special characters by a sequence of an
     escape character (backslash) and another character and other control
     characters by a sequence of "\u" followed by a four-digit hex
-    representation. The escaped string is appended to @ref write_buffer.
+    representation. The escaped string is written to output stream @a o.
 
     @param[in] s  the string to escape
 
@@ -880,7 +962,7 @@ class serializer
                     {
                         case error_handler_t::strict:
                         {
-                            JSON_THROW(type_error::create(316, concat("invalid UTF-8 byte at index ", std::to_string(i), ": 0x", detail::hex_byte(byte)), nullptr));
+                            JSON_THROW(type_error::create(316, concat("invalid UTF-8 byte at index ", std::to_string(i), ": 0x", hex_bytes(byte | 0)), nullptr));
                         }
 
                         case error_handler_t::ignore:
@@ -913,9 +995,9 @@ class serializer
                                 }
                                 else
                                 {
-                                    string_buffer[bytes++] = '\xEF';
-                                    string_buffer[bytes++] = '\xBF';
-                                    string_buffer[bytes++] = '\xBD';
+                                    string_buffer[bytes++] = detail::binary_writer<BasicJsonType, char>::to_char_type('\xEF');
+                                    string_buffer[bytes++] = detail::binary_writer<BasicJsonType, char>::to_char_type('\xBF');
+                                    string_buffer[bytes++] = detail::binary_writer<BasicJsonType, char>::to_char_type('\xBD');
                                 }
 
                                 // write buffer and reset index; there must be 13 bytes
@@ -972,7 +1054,7 @@ class serializer
             {
                 case error_handler_t::strict:
                 {
-                    JSON_THROW(type_error::create(316, concat("incomplete UTF-8 string; last byte: 0x", detail::hex_byte(static_cast<std::uint8_t>(s[s.size() - 1]))), nullptr));
+                    JSON_THROW(type_error::create(316, concat("incomplete UTF-8 string; last byte: 0x", hex_bytes(static_cast<std::uint8_t>(s[s.size() - 1] | 0))), nullptr));
                 }
 
                 case error_handler_t::ignore:
@@ -1193,6 +1275,20 @@ class serializer
         }
     }
 
+    /*!
+     * @brief convert a byte to a uppercase hex representation
+     * @param[in] byte byte to represent
+     * @return representation ("00".."FF")
+     */
+    static std::string hex_bytes(std::uint8_t byte)
+    {
+        std::string result = "FF";
+        constexpr const char* nibble_to_hex = "0123456789ABCDEF";
+        result[0] = nibble_to_hex[byte / 16];
+        result[1] = nibble_to_hex[byte % 16];
+        return result;
+    }
+
     /*!
      * @brief write a lowercase "\uXXXX" escape sequence into @a string_buffer
      *
@@ -1306,7 +1402,7 @@ class serializer
     /*!
     @brief dump an integer
 
-    Dump a given integer, appending it to @ref write_buffer. Works internally with
+    Dump a given integer to output stream @a o. Works internally with
     @a number_buffer.
 
     @param[in] x  integer number (signed or unsigned) to dump
@@ -1343,7 +1439,7 @@ class serializer
         }
 
         // use a pointer to fill the buffer
-        auto buffer_ptr = number_buffer.begin(); // NOLINT(llvm-qualified-auto,readability-qualified-auto)
+        auto buffer_ptr = number_buffer.begin(); // NOLINT(llvm-qualified-auto,readability-qualified-auto,cppcoreguidelines-pro-type-vararg,hicpp-vararg)
 
         number_unsigned_t abs_value;
 
@@ -1397,7 +1493,7 @@ class serializer
     /*!
     @brief dump a floating-point number
 
-    Dump a given floating-point number, appending it to @ref write_buffer. Works internally
+    Dump a given floating-point number to output stream @a o. Works internally
     with @a number_buffer.
 
     @param[in] x  floating-point number to dump
@@ -1458,28 +1554,21 @@ class serializer
         // check if the buffer was large enough
         JSON_ASSERT(static_cast<std::size_t>(len) < number_buffer.size());
 
-        // look up the locale's thousands separator and decimal point now,
-        // matching what snprintf_float() just used (see lexer::get_decimal_point())
-        const auto* loc = std::localeconv();
-        JSON_ASSERT(loc != nullptr);
-        const char thousands_sep = (loc->thousands_sep == nullptr) ? '\0' : *loc->thousands_sep;
-        const char decimal_point = (loc->decimal_point == nullptr) ? '\0' : *loc->decimal_point;
-
         // erase thousands separators
-        if (thousands_sep != '\0')
+        if (locale.thousands_sep != '\0')
         {
             // NOLINTNEXTLINE(readability-qualified-auto,llvm-qualified-auto): std::remove returns an iterator, see https://github.com/nlohmann/json/issues/3081
-            const auto end = std::remove(number_buffer.begin(), number_buffer.begin() + len, thousands_sep);
+            const auto end = std::remove(number_buffer.begin(), number_buffer.begin() + len, locale.thousands_sep);
             std::fill(end, number_buffer.end(), '\0');
             JSON_ASSERT((end - number_buffer.begin()) <= len);
             len = (end - number_buffer.begin());
         }
 
         // convert decimal point to '.'
-        if (decimal_point != '\0' && decimal_point != '.')
+        if (locale.decimal_point != '\0' && locale.decimal_point != '.')
         {
             // NOLINTNEXTLINE(readability-qualified-auto,llvm-qualified-auto): std::find returns an iterator, see https://github.com/nlohmann/json/issues/3081
-            const auto dec_pos = std::find(number_buffer.begin(), number_buffer.end(), decimal_point);
+            const auto dec_pos = std::find(number_buffer.begin(), number_buffer.end(), locale.decimal_point);
             if (dec_pos != number_buffer.end())
             {
                 *dec_pos = '.';
@@ -1524,17 +1613,34 @@ class serializer
      */
     number_unsigned_t remove_sign(number_integer_t x) noexcept
     {
-        JSON_ASSERT(x < 0);
+        JSON_ASSERT(x < 0 && x < (std::numeric_limits<number_integer_t>::max)()); // NOLINT(misc-redundant-expression)
         return static_cast<number_unsigned_t>(-(x + 1)) + 1;
     }
 
   private:
+    /// the locale's thousand separator and decimal point characters
+    struct locale_chars
+    {
+        explicit locale_chars(const std::lconv* loc) noexcept
+            : thousands_sep(loc->thousands_sep == nullptr ? '\0' : std::char_traits<char>::to_char_type(* (loc->thousands_sep)))
+            , decimal_point(loc->decimal_point == nullptr ? '\0' : std::char_traits<char>::to_char_type(* (loc->decimal_point)))
+        {}
+
+        const char thousands_sep;
+        const char decimal_point;
+    };
+
     /// the output of the serializer (non-owning; the adapter lives at the call site)
     output_adapter_protocol<char>* o = nullptr;
 
     /// a (hopefully) large enough character buffer
     std::array<char, 64> number_buffer{{}};
 
+    /// computed once from std::localeconv() at construction; @ref
+    /// locale_chars keeps std::localeconv()'s pointer from having to be held
+    /// past the constructor, while still letting these stay const
+    const locale_chars locale;
+
     /// string buffer
     std::array<char, 512> string_buffer{{}};
 

include/nlohmann/detail/string_utils.hpp

@@ -3,7 +3,6 @@
 // |  |  |__   |  |  | | | |  version 3.12.0
 // |_____|_____|_____|_|___|  https://github.com/nlohmann/json
 //
-// SPDX-FileCopyrightText: 2008, 2009 Björn Hoehrmann <bjoern@hoehrmann.de>
 // SPDX-FileCopyrightText: 2013-2026 Niels Lohmann <https://nlohmann.me>
 // SPDX-License-Identifier: MIT
 
@@ -37,16 +36,6 @@ StringType to_string(std::size_t value)
     return result;
 }
 
-/// @return a byte as two uppercase hexadecimal digits
-inline std::string hex_byte(const std::uint8_t byte)
-{
-    std::string result = "00";
-    constexpr const char* nibble_to_hex = "0123456789ABCDEF";
-    result[0] = nibble_to_hex[byte / 16];
-    result[1] = nibble_to_hex[byte % 16];
-    return result;
-}
-
 ///////////////////
 // UTF-8 decoding //
 ///////////////////

single_include/nlohmann/json.hpp

@@ -6199,7 +6199,6 @@ NLOHMANN_JSON_NAMESPACE_END
 // |  |  |__   |  |  | | | |  version 3.12.0
 // |_____|_____|_____|_|___|  https://github.com/nlohmann/json
 //
-// SPDX-FileCopyrightText: 2008, 2009 Björn Hoehrmann <bjoern@hoehrmann.de>
 // SPDX-FileCopyrightText: 2013-2026 Niels Lohmann <https://nlohmann.me>
 // SPDX-License-Identifier: MIT
 
@@ -6235,16 +6234,6 @@ StringType to_string(std::size_t value)
     return result;
 }
 
-/// @return a byte as two uppercase hexadecimal digits
-inline std::string hex_byte(const std::uint8_t byte)
-{
-    std::string result = "00";
-    constexpr const char* nibble_to_hex = "0123456789ABCDEF";
-    result[0] = nibble_to_hex[byte / 16];
-    result[1] = nibble_to_hex[byte % 16];
-    return result;
-}
-
 ///////////////////
 // UTF-8 decoding //
 ///////////////////
@@ -20157,7 +20146,9 @@ NLOHMANN_JSON_NAMESPACE_END
 
 
 
+#include <algorithm> // copy
 #include <cstddef> // size_t
+#include <iterator> // back_inserter
 #include <memory> // shared_ptr, make_shared
 #include <string> // basic_string
 #include <utility> // move
@@ -20179,10 +20170,6 @@ namespace detail
 template<typename CharType> struct output_adapter_protocol
 {
     virtual void write_character(CharType c) = 0;
-    /// @param[in] s      pointer to the characters to write; binary_writer legitimately
-    ///                   passes a null pointer together with length 0 for an empty
-    ///                   string or binary value, so implementations must tolerate that
-    /// @param[in] length number of characters at @a s
     virtual void write_characters(const CharType* s, std::size_t length) = 0;
     virtual ~output_adapter_protocol() = default;
 
@@ -20249,6 +20236,7 @@ class output_vector_adapter : public output_adapter_protocol<CharType>
         sink.write_character(c);
     }
 
+    JSON_HEDLEY_NON_NULL(2)
     void write_characters(const CharType* s, std::size_t length) override
     {
         sink.write_characters(s, length);
@@ -20273,6 +20261,7 @@ class output_stream_adapter : public output_adapter_protocol<CharType>
         stream.put(c);
     }
 
+    JSON_HEDLEY_NON_NULL(2)
     void write_characters(const CharType* s, std::size_t length) override
     {
         stream.write(s, static_cast<std::streamsize>(length));
@@ -20297,6 +20286,7 @@ class output_string_adapter : public output_adapter_protocol<CharType>
         str.push_back(c);
     }
 
+    JSON_HEDLEY_NON_NULL(2)
     void write_characters(const CharType* s, std::size_t length) override
     {
         str.append(s, length);
@@ -20369,8 +20359,6 @@ NLOHMANN_JSON_NAMESPACE_END
 
 // #include <nlohmann/detail/string_concat.hpp>
 
-// #include <nlohmann/detail/string_utils.hpp>
-
 
 NLOHMANN_JSON_NAMESPACE_BEGIN
 namespace detail
@@ -22620,10 +22608,20 @@ class binary_writer
         const std::size_t valid = valid_utf8_prefix(data, s.size());
         if (JSON_HEDLEY_UNLIKELY(valid != s.size()))
         {
-            JSON_THROW(type_error::create(316, concat("invalid UTF-8 byte at index ", std::to_string(valid), ": 0x", detail::hex_byte(data[valid])), &context));
+            JSON_THROW(type_error::create(316, concat("invalid UTF-8 byte at index ", std::to_string(valid), ": 0x", hex_byte(data[valid])), &context));
         }
     }
 
+    /// @return a byte as two uppercase hexadecimal digits
+    static std::string hex_byte(const std::uint8_t byte)
+    {
+        std::string result = "00";
+        constexpr const char* nibble_to_hex = "0123456789ABCDEF";
+        result[0] = nibble_to_hex[byte / 16];
+        result[1] = nibble_to_hex[byte % 16];
+        return result;
+    }
+
     /*!
     @brief write an integer in the shortest encoding
 
@@ -22956,23 +22954,24 @@ NLOHMANN_JSON_NAMESPACE_END
 // |  |  |__   |  |  | | | |  version 3.12.0
 // |_____|_____|_____|_|___|  https://github.com/nlohmann/json
 //
+// SPDX-FileCopyrightText: 2008, 2009 Björn Hoehrmann <bjoern@hoehrmann.de>
 // SPDX-FileCopyrightText: 2013-2026 Niels Lohmann <https://nlohmann.me>
 // SPDX-License-Identifier: MIT
 
 
 
-#include <algorithm> // remove, fill, find, none_of, min
+#include <algorithm> // reverse, remove, fill, find, none_of, min
 #include <array> // array
 #include <clocale> // localeconv, lconv
-#include <cmath> // isfinite
+#include <cmath> // labs, isfinite, isnan, signbit
 #include <cstddef> // size_t, ptrdiff_t
 #include <cstdint> // uint8_t
 #include <cstdio> // snprintf
 #include <cstring> // memcpy, memset
-#include <iterator> // next
 #include <limits> // numeric_limits
 #include <string> // string, char_traits
 #include <type_traits> // is_same
+#include <utility> // move
 #include <vector> // vector
 
 // #include <nlohmann/detail/conversions/to_chars.hpp>
@@ -24104,6 +24103,8 @@ NLOHMANN_JSON_NAMESPACE_END
 
 // #include <nlohmann/detail/meta/cpp_future.hpp>
 
+// #include <nlohmann/detail/output/binary_writer.hpp>
+
 // #include <nlohmann/detail/output/output_adapters.hpp>
 
 // #include <nlohmann/detail/recursion_depth_limit.hpp>
@@ -24163,6 +24164,7 @@ class serializer
                const std::size_t indent_step_ = 0,
                error_handler_t error_handler_ = error_handler_t::strict)
         : o(&s)
+        , locale(std::localeconv())
         , indent_char(ichar)
         , pretty_print(pretty_print_)
         , ensure_ascii(ensure_ascii_)
@@ -24185,10 +24187,9 @@ class serializer
     additional parameter. Arrays and objects are serialized without recursion,
     however deeply they are nested.
 
-    - strings and object keys are escaped using @ref dump_escaped
-    - integer numbers are converted using a digit-pair lookup table (@ref dump_integer)
-    - floating-point numbers are converted to a string using @ref dump_float, which
-      uses `to_chars` for IEEE-754 types and `snprintf` otherwise
+    - strings and object keys are escaped using `escape_string()`
+    - integer numbers are converted implicitly via `operator<<`
+    - floating-point numbers are converted to a string using `"%g"` format
     - binary values are serialized as objects containing the subtype and the
       byte array
 
@@ -24363,16 +24364,127 @@ class serializer
             }
 
             case value_t::string:
-            case value_t::binary:
-            case value_t::boolean:
-            case value_t::number_integer:
-            case value_t::number_unsigned:
-            case value_t::number_float:
-            case value_t::discarded:
-            case value_t::null:
-            default:
-                dump_scalar(val, current_indent);
+            {
+                put_char('"');
+                dump_escaped(*val.m_data.m_value.string);
+                put_char('"');
                 return;
+            }
+
+            case value_t::binary:
+            {
+                if (pretty_print)
+                {
+                    put_literal("{\n");
+
+                    // variable to hold indentation for recursive calls
+                    const auto new_indent = next_indent(current_indent, indent_step);
+
+                    put_indent(new_indent);
+
+                    put_literal("\"bytes\": [");
+
+                    if (!val.m_data.m_value.binary->empty())
+                    {
+                        for (auto i = val.m_data.m_value.binary->cbegin();
+                                i != val.m_data.m_value.binary->cend() - 1; ++i)
+                        {
+                            dump_byte(*i);
+                            put_literal(", ");
+                        }
+                        dump_byte(val.m_data.m_value.binary->back());
+                    }
+
+                    put_literal("],\n");
+                    put_indent(new_indent);
+
+                    put_literal("\"subtype\": ");
+                    if (val.m_data.m_value.binary->has_subtype())
+                    {
+                        dump_integer(val.m_data.m_value.binary->subtype());
+                    }
+                    else
+                    {
+                        put_literal("null");
+                    }
+                    put_char('\n');
+                    put_indent(current_indent);
+                    put_char('}');
+                }
+                else
+                {
+                    put_literal("{\"bytes\":[");
+
+                    if (!val.m_data.m_value.binary->empty())
+                    {
+                        for (auto i = val.m_data.m_value.binary->cbegin();
+                                i != val.m_data.m_value.binary->cend() - 1; ++i)
+                        {
+                            dump_byte(*i);
+                            put_char(',');
+                        }
+                        dump_byte(val.m_data.m_value.binary->back());
+                    }
+
+                    put_literal("],\"subtype\":");
+                    if (val.m_data.m_value.binary->has_subtype())
+                    {
+                        dump_integer(val.m_data.m_value.binary->subtype());
+                        put_char('}');
+                    }
+                    else
+                    {
+                        put_literal("null}");
+                    }
+                }
+                return;
+            }
+
+            case value_t::boolean:
+            {
+                if (val.m_data.m_value.boolean)
+                {
+                    put_literal("true");
+                }
+                else
+                {
+                    put_literal("false");
+                }
+                return;
+            }
+
+            case value_t::number_integer:
+            {
+                dump_integer(val.m_data.m_value.number_integer);
+                return;
+            }
+
+            case value_t::number_unsigned:
+            {
+                dump_integer(val.m_data.m_value.number_unsigned);
+                return;
+            }
+
+            case value_t::number_float:
+            {
+                dump_float(val.m_data.m_value.number_float);
+                return;
+            }
+
+            case value_t::discarded:
+            {
+                put_literal("<discarded>");
+                return;
+            }
+
+            case value_t::null:
+            {
+                put_literal("null");
+                return;
+            }
+
+            default:            // LCOV_EXCL_LINE
+                JSON_ASSERT(false); // NOLINT(cert-dcl03-c,hicpp-static-assert,misc-static-assert) LCOV_EXCL_LINE
         }
     }
 
@@ -24529,9 +24641,9 @@ class serializer
     @brief serialize the value @a val, but not the elements of a container
 
     An object or array with elements is opened and pushed onto @a stack for
-    @ref dump_iteratively to walk; everything else - including a binary value,
+    @ref dump_internal to walk; everything else - including a binary value,
     which looks like an object but has no elements to descend into - is written
-    out in full by @ref dump_scalar.
+    out here in full.
     */
     void dump_value(const BasicJsonType& val,
                     const std::size_t current_indent,
@@ -24589,35 +24701,6 @@ class serializer
                 return;
             }
 
-            case value_t::string:
-            case value_t::binary:
-            case value_t::boolean:
-            case value_t::number_integer:
-            case value_t::number_unsigned:
-            case value_t::number_float:
-            case value_t::discarded:
-            case value_t::null:
-            default:
-                dump_scalar(val, current_indent);
-                return;
-        }
-    }
-
-    /*!
-    @brief serialize the value @a val, which is neither an object nor an array
-
-    Shared by @ref dump_internal and @ref dump_value, so that a value is written
-    the same way however deeply it is nested. A binary value is written out here
-    in full: it looks like an object, but has no elements to descend into.
-
-    @param[in] val             value to serialize; not an object or array
-    @param[in] current_indent  the indentation of @a val, used for a
-                               pretty-printed binary value
-    */
-    void dump_scalar(const BasicJsonType& val, const std::size_t current_indent)
-    {
-        switch (val.m_data.m_type)
-        {
             case value_t::string:
             {
                 put_char('"');
@@ -24738,8 +24821,6 @@ class serializer
                 return;
             }
 
-            case value_t::object: // LCOV_EXCL_LINE
-            case value_t::array:  // LCOV_EXCL_LINE
             default:            // LCOV_EXCL_LINE
                 JSON_ASSERT(false); // NOLINT(cert-dcl03-c,hicpp-static-assert,misc-static-assert) LCOV_EXCL_LINE
         }
@@ -24768,7 +24849,7 @@ class serializer
     Escape a string by replacing certain special characters by a sequence of an
     escape character (backslash) and another character and other control
     characters by a sequence of "\u" followed by a four-digit hex
-    representation. The escaped string is appended to @ref write_buffer.
+    representation. The escaped string is written to output stream @a o.
 
     @param[in] s  the string to escape
 
@@ -24962,7 +25043,7 @@ class serializer
                     {
                         case error_handler_t::strict:
                         {
-                            JSON_THROW(type_error::create(316, concat("invalid UTF-8 byte at index ", std::to_string(i), ": 0x", detail::hex_byte(byte)), nullptr));
+                            JSON_THROW(type_error::create(316, concat("invalid UTF-8 byte at index ", std::to_string(i), ": 0x", hex_bytes(byte | 0)), nullptr));
                         }
 
                         case error_handler_t::ignore:
@@ -24995,9 +25076,9 @@ class serializer
                                 }
                                 else
                                 {
-                                    string_buffer[bytes++] = '\xEF';
-                                    string_buffer[bytes++] = '\xBF';
-                                    string_buffer[bytes++] = '\xBD';
+                                    string_buffer[bytes++] = detail::binary_writer<BasicJsonType, char>::to_char_type('\xEF');
+                                    string_buffer[bytes++] = detail::binary_writer<BasicJsonType, char>::to_char_type('\xBF');
+                                    string_buffer[bytes++] = detail::binary_writer<BasicJsonType, char>::to_char_type('\xBD');
                                 }
 
                                 // write buffer and reset index; there must be 13 bytes
@@ -25054,7 +25135,7 @@ class serializer
             {
                 case error_handler_t::strict:
                 {
-                    JSON_THROW(type_error::create(316, concat("incomplete UTF-8 string; last byte: 0x", detail::hex_byte(static_cast<std::uint8_t>(s[s.size() - 1]))), nullptr));
+                    JSON_THROW(type_error::create(316, concat("incomplete UTF-8 string; last byte: 0x", hex_bytes(static_cast<std::uint8_t>(s[s.size() - 1] | 0))), nullptr));
                 }
 
                 case error_handler_t::ignore:
@@ -25275,6 +25356,20 @@ class serializer
         }
     }
 
+    /*!
+     * @brief convert a byte to a uppercase hex representation
+     * @param[in] byte byte to represent
+     * @return representation ("00".."FF")
+     */
+    static std::string hex_bytes(std::uint8_t byte)
+    {
+        std::string result = "FF";
+        constexpr const char* nibble_to_hex = "0123456789ABCDEF";
+        result[0] = nibble_to_hex[byte / 16];
+        result[1] = nibble_to_hex[byte % 16];
+        return result;
+    }
+
     /*!
      * @brief write a lowercase "\uXXXX" escape sequence into @a string_buffer
      *
@@ -25388,7 +25483,7 @@ class serializer
     /*!
     @brief dump an integer
 
-    Dump a given integer, appending it to @ref write_buffer. Works internally with
+    Dump a given integer to output stream @a o. Works internally with
     @a number_buffer.
 
     @param[in] x  integer number (signed or unsigned) to dump
@@ -25425,7 +25520,7 @@ class serializer
         }
 
         // use a pointer to fill the buffer
-        auto buffer_ptr = number_buffer.begin(); // NOLINT(llvm-qualified-auto,readability-qualified-auto)
+        auto buffer_ptr = number_buffer.begin(); // NOLINT(llvm-qualified-auto,readability-qualified-auto,cppcoreguidelines-pro-type-vararg,hicpp-vararg)
 
         number_unsigned_t abs_value;
 
@@ -25479,7 +25574,7 @@ class serializer
     /*!
     @brief dump a floating-point number
 
-    Dump a given floating-point number, appending it to @ref write_buffer. Works internally
+    Dump a given floating-point number to output stream @a o. Works internally
     with @a number_buffer.
 
     @param[in] x  floating-point number to dump
@@ -25540,28 +25635,21 @@ class serializer
         // check if the buffer was large enough
         JSON_ASSERT(static_cast<std::size_t>(len) < number_buffer.size());
 
-        // look up the locale's thousands separator and decimal point now,
-        // matching what snprintf_float() just used (see lexer::get_decimal_point())
-        const auto* loc = std::localeconv();
-        JSON_ASSERT(loc != nullptr);
-        const char thousands_sep = (loc->thousands_sep == nullptr) ? '\0' : *loc->thousands_sep;
-        const char decimal_point = (loc->decimal_point == nullptr) ? '\0' : *loc->decimal_point;
-
         // erase thousands separators
-        if (thousands_sep != '\0')
+        if (locale.thousands_sep != '\0')
         {
             // NOLINTNEXTLINE(readability-qualified-auto,llvm-qualified-auto): std::remove returns an iterator, see https://github.com/nlohmann/json/issues/3081
-            const auto end = std::remove(number_buffer.begin(), number_buffer.begin() + len, thousands_sep);
+            const auto end = std::remove(number_buffer.begin(), number_buffer.begin() + len, locale.thousands_sep);
             std::fill(end, number_buffer.end(), '\0');
             JSON_ASSERT((end - number_buffer.begin()) <= len);
             len = (end - number_buffer.begin());
         }
 
         // convert decimal point to '.'
-        if (decimal_point != '\0' && decimal_point != '.')
+        if (locale.decimal_point != '\0' && locale.decimal_point != '.')
         {
             // NOLINTNEXTLINE(readability-qualified-auto,llvm-qualified-auto): std::find returns an iterator, see https://github.com/nlohmann/json/issues/3081
-            const auto dec_pos = std::find(number_buffer.begin(), number_buffer.end(), decimal_point);
+            const auto dec_pos = std::find(number_buffer.begin(), number_buffer.end(), locale.decimal_point);
             if (dec_pos != number_buffer.end())
             {
                 *dec_pos = '.';
@@ -25606,17 +25694,34 @@ class serializer
      */
     number_unsigned_t remove_sign(number_integer_t x) noexcept
     {
-        JSON_ASSERT(x < 0);
+        JSON_ASSERT(x < 0 && x < (std::numeric_limits<number_integer_t>::max)()); // NOLINT(misc-redundant-expression)
         return static_cast<number_unsigned_t>(-(x + 1)) + 1;
     }
 
   private:
+    /// the locale's thousand separator and decimal point characters
+    struct locale_chars
+    {
+        explicit locale_chars(const std::lconv* loc) noexcept
+            : thousands_sep(loc->thousands_sep == nullptr ? '\0' : std::char_traits<char>::to_char_type(* (loc->thousands_sep)))
+            , decimal_point(loc->decimal_point == nullptr ? '\0' : std::char_traits<char>::to_char_type(* (loc->decimal_point)))
+        {}
+
+        const char thousands_sep;
+        const char decimal_point;
+    };
+
     /// the output of the serializer (non-owning; the adapter lives at the call site)
     output_adapter_protocol<char>* o = nullptr;
 
     /// a (hopefully) large enough character buffer
     std::array<char, 64> number_buffer{{}};
 
+    /// computed once from std::localeconv() at construction; @ref
+    /// locale_chars keeps std::localeconv()'s pointer from having to be held
+    /// past the constructor, while still letting these stay const
+    const locale_chars locale;
+
     /// string buffer
     std::array<char, 512> string_buffer{{}};
 

tests/src/unit-locale-cpp.cpp

@@ -14,10 +14,7 @@ using nlohmann::json;
 
 #include <array>
 #include <clocale>
-#include <limits>
 #include <map>
-#include <ostream>
-#include <streambuf>
 #include <string>
 #include <utility>
 #include <vector>
@@ -388,92 +385,3 @@ TEST_CASE("locale with a multi-byte decimal point")
 
     CHECK(std::setlocale(LC_NUMERIC, "C") != nullptr);
 }
-
-namespace
-{
-// a streambuf that switches LC_NUMERIC the first time anything is written to
-// it, so a dump() in progress can be made to change locale mid-flight: after
-// the serializer was constructed (and, before #5709 item 3, after it had
-// cached std::localeconv() for the whole call) but before a later float is
-// converted
-struct LocaleSwitchingStreambuf final : std::streambuf
-{
-    explicit LocaleSwitchingStreambuf(const char* switch_to)
-        : locale_after_first_write(switch_to)
-    {}
-
-    std::string data {}; // NOLINT(readability-redundant-member-init)
-    std::string locale_after_first_write;
-    bool switched = false;
-
-    std::streamsize xsputn(const char* s, std::streamsize n) override
-    {
-        if (!switched)
-        {
-            switched = std::setlocale(LC_NUMERIC, locale_after_first_write.c_str()) != nullptr;
-        }
-        data.append(s, static_cast<std::size_t>(n));
-        return n;
-    }
-};
-} // namespace
-
-TEST_CASE("locale changes during a single dump() (#5709 item 3)")
-{
-    // dump_float() only reads the locale on the snprintf path, taken for a
-    // number_float_t that is not an IEEE-754 single or double, i.e. not
-    // (is_iec559 && digits == 24 && max_exponent == 128) and not (is_iec559
-    // && digits == 53 && max_exponent == 1024) - see dump_float(). Checking
-    // is_iec559 alone is not enough: on x86_64, long double is a 64-bit
-    // (80-bit extended) format for which is_iec559 is also true, so it still
-    // takes the snprintf path this test means to exercise. Only a
-    // number_float_t whose digits/max_exponent match float or double (e.g.
-    // long double on 64-bit Arm, where it is IEEE-754 double) takes the
-    // locale-independent to_chars() path instead, and this test is a no-op
-    // there.
-    using long_double_json = nlohmann::basic_json<std::map, std::vector, std::string, bool, std::int64_t, std::uint64_t, long double>;
-    using ld_limits = std::numeric_limits<long_double_json::number_float_t>;
-    const bool is_ieee_single_or_double =
-        (ld_limits::is_iec559 && ld_limits::digits == 24 && ld_limits::max_exponent == 128) ||
-        (ld_limits::is_iec559 && ld_limits::digits == 53 && ld_limits::max_exponent == 1024);
-    if (is_ieee_single_or_double)
-    {
-        MESSAGE("long double is IEEE-754 single or double on this platform; dump_float()'s snprintf/locale path is not exercised here");
-    }
-
-    const char* de_DE_name = "de_DE.UTF-8";
-    if (std::setlocale(LC_NUMERIC, de_DE_name) == nullptr)
-    {
-        de_DE_name = "de_DE";
-        if (std::setlocale(LC_NUMERIC, de_DE_name) == nullptr)
-        {
-            MESSAGE("locale de_DE is not usable");
-            return;
-        }
-    }
-    const std::string decimal_point = std::localeconv()->decimal_point;
-    REQUIRE(std::setlocale(LC_NUMERIC, "C") != nullptr);
-    if (decimal_point != ",")
-    {
-        MESSAGE("de_DE's decimal point is not ',' on this platform, skipping");
-        return;
-    }
-
-    // a string long enough to overflow the serializer's internal write
-    // buffer, so that it is flushed to the output adapter - and the locale
-    // switched - before the number after it is converted
-    const std::string padding(5000, 'a');
-    const long_double_json j = { padding, 1234.5L };
-
-    LocaleSwitchingStreambuf buf(de_DE_name);
-    std::ostream os(&buf);
-    os << j;
-    CHECK(std::setlocale(LC_NUMERIC, "C") != nullptr);
-
-    REQUIRE(buf.switched);
-    // whatever locale was in effect when the float was actually converted,
-    // the output is normalized to use '.' as the decimal point: it must be
-    // looked up at conversion time, not once for the whole dump() - the same
-    // fix #5597 made on the parser side
-    CHECK(buf.data == "[\"" + padding + "\",1234.5]");
-}