chore(deps): Bump oj from 3.17.4 to 3.17.5 in the bundler group by dependabot[bot] · Pull Request #123 · fluent/fluentd-aggregator-docker-image

dependabot · 2026-08-06T21:06:32Z

Bumps the bundler group with 1 update: oj.

Updates oj from 3.17.4 to 3.17.5

Release notes

v3.17.5

What's Changed

Most of this release comes out of a security review of the C extension. There are no API changes.

Memory safety

Fix hash flooding by seeding the key hash per process by @Watson1978 in ohler55/oj#1053

Fix a one byte buffer over-read on a trailing backslash by @Watson1978 in ohler55/oj#1054

Fix two length underflows that cause an unbounded buffer over-read by @Watson1978 in ohler55/oj#1055

Fix a SEGV from type confusion in class path resolution by @Watson1978 in ohler55/oj#1056

Fix uninitialized stack memory leaking into the class name error by @Watson1978 in ohler55/oj#1057

Fix output buffer overflows when writing indentation by @Watson1978 in ohler55/oj#1058

Fix doc path limit by @ohler55 in ohler55/oj#1061

Fix the use-after-free of a key when the value stack grows by @Watson1978 in ohler55/oj#1062

Fix the buffer over-read when a document ends where a key belongs by @Watson1978 in ohler55/oj#1063

Fix the id from a circular reference being used unchecked by @Watson1978 in ohler55/oj#1064

Fix the SEGV dumping an exception that was never raised by @Watson1978 in ohler55/oj#1068

Fix the stack buffer overflow writing the error location by @Watson1978 in ohler55/oj#1071

Fix the read error in Oj::Parser#file being taken as a huge read by @Watson1978 in ohler55/oj#1072

Fix the truncated float format copying stack bytes into the output by @Watson1978 in ohler55/oj#1073

Fix the double free of the default create_id when a call passes nil by @Watson1978 in ohler55/oj#1074

Fix the buffer over-read of an odd attribute name and the leak of its args by @Watson1978 in ohler55/oj#1075

Fix the SEGV reading a truncated document with Oj::Parser#file and the descriptor it leaks by @Watson1978 in ohler55/oj#1076

Fix the SEGV from a malformed number in Oj::Doc by @Watson1978 in ohler55/oj#1077

Fix the stack overflow from a long key with :only or :except by @Watson1978 in ohler55/oj#1078

Fix the odd module match being decided by uninitialized memory by @Watson1978 in ohler55/oj#1079

Fix :float_format taking directives it has no argument for by @Watson1978 in ohler55/oj#1083

Memory leaks

Fix the leak of an escaped hash key in the streaming parser by @Watson1978 in ohler55/oj#1067

Fix memory leak of the parser create_id when it is set again by @Watson1978 in ohler55/oj#1085

Fix memory leak of the parser when Oj::Parser.new or .safe raises by @Watson1978 in ohler55/oj#1086

Parsing and dumping

Fix a safe parser limit of 4 being ignored by @Watson1978 in ohler55/oj#1065

Fix the exponent bound being checked after it is narrowed by @Watson1978 in ohler55/oj#1066

Fix a long first token being rejected and the grown reader buffer leaking by @Watson1978 in ohler55/oj#1069

Fix the safe parser limits being dropped when an option is set by @Watson1978 in ohler55/oj#1070

Fix the custom mode dump of an unraised exception opening with "{," by @Watson1978 in ohler55/oj#1082

Fix the wab mode time load being an offset out on Windows by @Watson1978 in ohler55/oj#1088

Fix Oj::Doc dropping the exponent of a number with no decimal point by @Watson1978 in ohler55/oj#1089

Rails

Fix Rails to_json(only:/except:) dropping the include_root wrapper (#1020) and methods: keys (#1008) by @Watson1978 in ohler55/oj#1039

Pass the as_json options to every element of a container (#1008) by @Watson1978 in ohler55/oj#1040

Share the global rails state with an encoder instead of copying it per encoder by @Watson1978 in ohler55/oj#1049

Hand as_json a copy of the options instead of the encoder's own hash by @Watson1978 in ohler55/oj#1050

... (truncated)

Changelog

Sourced from oj's changelog.

3.17.5 - 2026-07-31

Most of this release comes out of a security review of the C extension. There are no API changes.

Memory safety

Fixed hash flooding by seeding the key hash per process. The hash was decided entirely at compile time, so a document of colliding keys turned key interning into O(n^2) and left the process slow for every later parse. (#1053)

Fixed a one byte buffer over-read on a document that ends with a backslash inside an unterminated string. (#1054)

Fixed two length underflows that made an empty ^m value and a key of exactly 65,536 bytes read forward until they left mapped memory. (#1055)

Fixed a SEGV from type confusion in class path resolution. A name segment that resolved to something other than a class or module was dereferenced as one. (#1056)

Fixed uninitialized stack memory being read into the message of an unresolved class name error. (#1057)

Fixed output buffer overflows when writing indentation, where several callers of fill_indent() had not assured the buffer first. (#1058)

Fixed the Oj::Doc path depth limit being checked one level too late. (#1061)

Fixed the use-after-free of a key when the value stack grows. (#1062)

Fixed the buffer over-read when a document ends where a key belongs. (#1063)

Fixed the id from a circular reference being used unchecked. (#1064)

Fixed the SEGV dumping an exception that was never raised, where the missing backtrace was read as an Array. (#1068)

Fixed the stack buffer overflow writing the error location. (#1071)

Fixed a read error in Oj::Parser#file being taken as a read of SIZE_MAX bytes, which wrote in front of the buffer and then reparsed it forever without checking for interrupts. (#1072)

Fixed a :float_format too long for the 64 byte buffer copying stack bytes past the end of it into the output. (#1073)

Fixed the double free of the default create_id when a call passes :create_id => nil. (#1074)

Fixed the buffer over-read of an odd attribute name and the leak of its arguments. (#1075)

Fixed the SEGV reading a truncated document with Oj::Parser#file and the descriptor it leaked. (#1076)

Fixed the SEGV from a malformed number in Oj::Doc. (#1077)

Fixed the stack exhaustion from a long key with :only or :except. (#1078)

Fixed the odd module match being decided by uninitialized memory. (#1079)

Fixed :float_format accepting directives it has no argument for. (#1083)

Memory leaks

Fixed the leak of an escaped hash key in the streaming parser. (#1067)

Fixed the leak of the parser create_id when it is set a second time. (#1085)

Fixed the leak of the parser when Oj::Parser.new or Oj::Parser.safe raises on an argument it does not take. (#1086)

Parsing and dumping

Fixed a safe parser limit of 4 being ignored. (#1065)

Fixed the exponent bound being checked after it is narrowed. (#1066)

Fixed a document being rejected when it opens with a number of 4093 digits or more read through a file descriptor or an IO, and the reader buffer that leaked when it grew. (#1069)

Fixed the safe parser limits being dropped when an option is set after the parser is built. (#1070)

Fixed the :custom mode dump of an exception that was never raised opening with {,. (#1082)

Fixed the :wab mode time load being an offset out on Windows, where mktime() stood in for timegm() and returned -1 for any time before the epoch. (#1088)

Fixed Oj::Doc dropping the exponent of a number written without a decimal point, so 1e3 loaded as 1. (#1089)

Rails

Fixed a to_json(only:) or to_json(except:) dropping the include_root_in_json wrapper key and the keys added by :methods. (#1039)

Fixed the as_json options reaching only the first element of a container, so to_json(only:), to_json(methods:) and any custom as_json(opts) took effect on one row and nowhere else. (#1040)

An encoder now reads the global optimized class table and options instead of copying them, saving about 6.7KB of malloc per ActiveSupport::JSON.encode, and picks up later Oj.default_options and ActiveSupport::JSON::Encoding changes. (#1049)

Fixed as_json being handed the encoder's own options hash. ActiveSupport allows as_json to write into it, and ActiveSupport 8.1 caches one encoder per process, so a single such as_json could leave :only set for every later to_json. (#1050)

... (truncated)

Commits

04d3084 Update changelog
aae0079 Fix the 3.17.5 changelog entry saying only "Fixed multiple issues" (#1091)
6d04d30 Fix the pre-1970 time tests being skipped on Windows for a limit that no long...
eaf0ad6 Fix Oj::Doc dropping the exponent of a number with no decimal point (#1089)
7f683cd Fix the wab mode time load being an offset out on Windows (#1088)
c9bae55 Fix rake never running the test/test_*.rb suite (#1084)
f5d4af6 Add a job timeout to the workflows (#1087)
2949015 Fix memory leak of the parser when Oj::Parser.new or .safe raises (#1086)
c08a078 Fix memory leak of the parser create_id when it is set again (#1085)
d3df7d9 Fix the custom mode dump of an unraised exception opening with "{," (#1082)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the bundler group with 1 update: [oj](https://github.com/ohler55/oj). Updates `oj` from 3.17.4 to 3.17.5 - [Release notes](https://github.com/ohler55/oj/releases) - [Changelog](https://github.com/ohler55/oj/blob/develop/CHANGELOG.md) - [Commits](ohler55/oj@v3.17.4...v3.17.5) --- updated-dependencies: - dependency-name: oj dependency-version: 3.17.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: bundler ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file ruby Pull requests that update Ruby code labels Aug 6, 2026

Navigation Menu

Uh oh!

chore(deps): Bump oj from 3.17.4 to 3.17.5 in the bundler group - #123

chore(deps): Bump oj from 3.17.4 to 3.17.5 in the bundler group#123
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bundler/bundler-f9c5242105

dependabot Bot commented on behalf of github Aug 6, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Aug 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v3.17.5

What's Changed

Memory safety

Memory leaks

Parsing and dumping

Rails

3.17.5 - 2026-07-31

Memory safety

Memory leaks

Parsing and dumping

Rails

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Aug 6, 2026 •

edited

Loading