fast-json-stringify - npm Package Compare versions

Comparing version 7.0.0 to 7.0.1

.github/dependabot.yml

@@ -5,4 +5,13 @@ version: 2
     directory: "/"
+    commit-message:
+      # Prefix all commit messages with "chore: "
+      prefix: "chore"
     schedule:
-      interval: "monthly"
+      interval: "weekly"
+    cooldown:
+      default-days: 7
+    allow:
+      - dependency-name: "*"
+        update-types:
+          - "version-update:semver-major"
     open-pull-requests-limit: 10
@@ -12,4 +21,35 @@
     directory: "/"
+    commit-message:
+      # Prefix all commit messages with "chore: "
+      prefix: "chore"
     schedule:
-      interval: "monthly"
+      interval: "weekly"
+    cooldown:
+      default-days: 7
+    versioning-strategy: "increase-if-necessary"
+    allow:
+      - dependency-name: "*"
+        update-types:
+          - "version-update:semver-major"
+    ignore:
+      # TODO: remove ignore until neostandard support ESLint 10
+      - dependency-name: "eslint"
+      - dependency-name: "neostandard"
+      - dependency-name: "@stylistic/*"
     open-pull-requests-limit: 10
+    groups:
+      # Production dependencies with breaking changes
+      dependencies:
+        dependency-type: "production"
+      # ESLint related dependencies
+      dev-dependencies-eslint:
+        patterns:
+          - "eslint"
+          - "neostandard"
+          - "@stylistic/*"
+      # TypeScript related dependencies
+      dev-dependencies-typescript:
+        patterns:
+          - "@types/*"
+          - "tstyche"
+          - "typescript"

index.js

@@ -13,4 +13,2 @@ 'use strict'
 
-const SINGLE_TICK = /'/g
-
 let largeArraySize = 2e4
@@ -386,6 +384,5 @@ let largeArrayMechanism = 'default'
 
-  if (requiredProperties.length > 0) {
-    // If we have required properties, we know that at least one property will be serialized.
-    // We can avoid the runtime check for the comma.
-
+  // propertiesKeys is sorted required-first; the guard checks [0] is required because
+  // otherwise additionalProperties/patternProperties would emit a stray `{ ,"k":v }`.
+  if (propertiesKeys.length > 0 && requiredProperties.includes(propertiesKeys[0])) {
     // The first property is required, so we don't need a comma.
@@ -1079,3 +1076,3 @@ // For the subsequent properties, we can blindly add a comma.
 
-  code += `json += '${JSON.stringify(schema.const).replace(SINGLE_TICK, "\\'")}'`
+  code += `json += ${JSON.stringify(JSON.stringify(schema.const))}`
 
@@ -1082,0 +1079,0 @@ if (hasNullType) {

package.json

 {
   "name": "fast-json-stringify",
-  "version": "7.0.0",
+  "version": "7.0.1",
   "description": "Stringify your JSON at max speed",
@@ -33,3 +33,3 @@ "main": "index.js",
       "name": "Tomas Della Vedova",
-      "url": "http://delved.org"
+      "url": "https://delvedor.dev"
     },
@@ -85,3 +85,3 @@ {
     "ajv-formats": "^3.0.1",
-    "fast-uri": "^3.0.0",
+    "fast-uri": "^4.0.0",
     "json-schema-ref-resolver": "^3.0.0",
@@ -88,0 +88,0 @@ "rfdc": "^1.2.0"

README.md

@@ -14,3 +14,3 @@ # fast-json-stringify
 
-fast-json-stringify requires a [JSON Schema Draft 7](https://json-schema.org/specification-links.html#draft-7) input to generate a fast `stringify` function.
+fast-json-stringify requires a [JSON Schema Draft 7](https://json-schema.org/specification-links#draft-7) input to generate a fast `stringify` function.
 
@@ -141,3 +141,3 @@ ##### Benchmarks
 
-Build a `stringify()` function based on [jsonschema draft 7 spec](https://json-schema.org/specification-links.html#draft-7).
+Build a `stringify()` function based on [jsonschema draft 7 spec](https://json-schema.org/specification-links#draft-7).
 
@@ -165,3 +165,3 @@ Supported types:
 
-[JSON Schema built-in formats](https://json-schema.org/understanding-json-schema/reference/string.html#built-in-formats) for dates are supported and will be serialized as:
+[JSON Schema built-in formats](https://json-schema.org/draft/2020-12/draft-bhutton-json-schema-validation-00#rfc.section.7.3.1) for dates are supported and will be serialized as:
 
@@ -442,3 +442,3 @@ | Format      | Serialized format example  |
 If you want to reuse a definition of a value, you can use the property `$ref`.
-The value of `$ref` must be a string in [JSON Pointer](https://tools.ietf.org/html/rfc6901) format.
+The value of `$ref` must be a string in [JSON Pointer](https://datatracker.ietf.org/doc/html/rfc6901) format.
 Example:
@@ -568,3 +568,3 @@ ```javascript
 
-According to the [Open API 3.0 specification](https://swagger.io/docs/specification/data-models/data-types/#null), a value that can be null must be declared `nullable`.
+According to the [Open API 3.0 specification](https://swagger.io/docs/specification/v3_0/data-models/data-types/#null), a value that can be null must be declared `nullable`.
 
@@ -571,0 +571,0 @@ ##### Nullable object

test/additionalProperties.test.js

@@ -333,1 +333,48 @@ 'use strict'
 })
+
+test('required + additionalProperties without declared properties produces valid JSON', (t) => {
+  // Regression: when `required` is non-empty but `properties` is absent
+  // (e.g. a record-style schema with only `additionalProperties`), the
+  // serializer used to emit a stray leading comma:
+  //   {"obj":{,"a":1,"b":2}}
+  // because the "skip first comma" optimization assumed a declared
+  // property would anchor it. With no `properties`, the additionalProperties
+  // branch would write the separator before its first entry.
+  t.plan(2)
+  const stringify = build({
+    type: 'object',
+    properties: {
+      obj: {
+        type: 'object',
+        propertyNames: { type: 'string', enum: ['a', 'b'] },
+        additionalProperties: { type: 'number' },
+        required: ['a', 'b']
+      }
+    }
+  })
+
+  const out = stringify({ obj: { a: 1, b: 2 } })
+  t.assert.equal(out, '{"obj":{"a":1,"b":2}}')
+  t.assert.deepStrictEqual(JSON.parse(out), { obj: { a: 1, b: 2 } })
+})
+
+test('required key not in properties + additionalProperties produces valid JSON', (t) => {
+  // Regression: declared `properties` is non-empty but `required` only lists
+  // keys that are not in `properties`. After sorting, propertiesKeys[0] is
+  // not required, so the "first declared property anchors the comma" premise
+  // does not hold. The serializer used to emit '{,"str":"x"}' for input
+  // missing the (non-required) declared `num`.
+  t.plan(2)
+  const stringify = build({
+    type: 'object',
+    properties: {
+      num: { type: 'number' }
+    },
+    additionalProperties: true,
+    required: ['str']
+  })
+
+  const out = stringify({ str: 'x' })
+  t.assert.equal(out, '{"str":"x"}')
+  t.assert.deepStrictEqual(JSON.parse(out), { str: 'x' })
+})

test/const.test.js

@@ -27,2 +27,22 @@ 'use strict'
 
+test('schema with const string containing characters that need escaping', (t) => {
+  const values = ['back\\slash', 'tab\there', 'quote"here', 'new\nline', "tick's"]
+  t.plan(values.length * 2)
+
+  for (const value of values) {
+    const schema = {
+      type: 'object',
+      properties: {
+        foo: { const: value }
+      }
+    }
+
+    const stringify = build(schema)
+    const output = stringify({ foo: value })
+
+    t.assert.equal(output, JSON.stringify({ foo: value }))
+    t.assert.deepStrictEqual(JSON.parse(output), { foo: value })
+  }
+})
+
 test('schema with const string and different input', (t) => {
@@ -29,0 +49,0 @@ t.plan(2)

test/patternProperties.test.js

@@ -169,1 +169,25 @@ 'use strict'
 })
+
+test('required key not in properties + patternProperties produces valid JSON', (t) => {
+  // Regression: symmetric case to the additionalProperties variant. `required`
+  // names a key not in `properties`, so after sorting propertiesKeys[0] is not
+  // required and the "first declared property anchors the comma" premise does
+  // not hold. The patternProperties branch shares the same code path, so the
+  // same stray-leading-comma bug would surface here without the tightened
+  // guard in `index.js`.
+  t.plan(2)
+  const stringify = build({
+    type: 'object',
+    properties: {
+      num: { type: 'number' }
+    },
+    patternProperties: {
+      '^s_': { type: 'string' }
+    },
+    required: ['s_x']
+  })
+
+  const out = stringify({ s_x: 'x' })
+  t.assert.equal(out, '{"s_x":"x"}')
+  t.assert.deepStrictEqual(JSON.parse(out), { s_x: 'x' })
+})

New alerts

Uses eval

Supply chain risk

Package uses dynamic code execution (e.g., eval()), which is a dangerous practice. This can prevent the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Fixed alerts

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Improved metrics

Total package byte prevSize

405699

1.08%

Lines of code

14740

0.55%

Worsened metrics

Number of medium supply chain risk alerts

4

33.33%

Dependency changes

• + Added

  fast-uri@4.1.1
  (transitive)

• Updated

  fast-uri@^4.0.0