dependabot[bot] opened a new pull request, #26439: URL: https://github.com/apache/camel/pull/26439
Bumps [com.alibaba:fastjson](https://github.com/alibaba/fastjson2) from 2.0.64 to 2.0.65. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/alibaba/fastjson2/releases";>com.alibaba:fastjson's releases</a>.</em></p> <blockquote> <h2>fastjson 2.0.65版本发布</h2> <h1>FASTJSON 2.0.65 Release Notes</h1> <p><strong>Release Date:</strong> 2 Sep 2026 <strong>Tag:</strong> 2.0.65 (879183e94)</p> <h2>Overview</h2> <p>This is a security fix release. It closes an AutoType authorization bypass reachable when <code>JSONReader.Feature.SupportAutoType</code> is enabled, and includes parser/writer robustness fixes. <strong>All users are strongly recommended to upgrade</strong>, especially applications that parse untrusted JSON or JSONB with AutoType enabled.</p> <p>This release also restores <code>fastjson2-extension-spring6</code> on Maven Central. It was missing for 2.0.62–2.0.64 because those releases were deployed with a JDK that did not activate the <code>enable-for-17+</code> build profile, so the module never entered the build reactor <a href="https://redirect.github.com/alibaba/fastjson2/issues/7840";>#7840</a>.</p> <p>The Android variants <code>2.0.65.android5</code> and <code>2.0.65.android8</code> carry the same AutoType security fix <a href="https://redirect.github.com/alibaba/fastjson2/issues/7843";>#7843</a> <a href="https://redirect.github.com/alibaba/fastjson2/issues/7844";>#7844</a>.</p> <h2>Security Fixes</h2> <ol> <li>Unified AutoType authorization on the real type name: a reader-cache hit on the FNV-1a-64 hash of <code>@type</code> is no longer treated as authorization. All untrusted-input paths (JSON and JSONB readers, and the object readers for beans, interfaces, exceptions, adapters, typed maps, arrays, collections and no-default-constructor types) now resolve <code>@type</code> through the full provider security checks — SafeMode, deny lists, type-name validation, and any user-supplied <code>AutoTypeBeforeHandler</code>. Compatibility is preserved for explicit local mappings declared with <code>@JSONType(seeAlso = ...)</code> and for readers annotated with <code>@JSONType(... SupportAutoType)</code> <a href="https://redirect.github.com/alibaba/fastjson2/issues/7753";>#7753</a></li> </ol> <h2>Bug Fixes</h2> <ol start="2"> <li>Fixed <code>ArrayIndexOutOfBoundsException</code> in <code>JSONReaderASCII</code> field-name decoding, triggered by a field name that combines an escape sequence with latin1 bytes >= 0x80 <a href="https://redirect.github.com/alibaba/fastjson2/issues/7808";>#7808</a> <a href="https://redirect.github.com/alibaba/fastjson2/issues/7836";>#7836</a></li> <li>Fixed getter methods being silently discarded when serializing <code>char</code>/<code>Character</code> fields, which caused NPEs or lost field values <a href="https://redirect.github.com/alibaba/fastjson2/issues/7719";>#7719</a></li> <li>(kotlin) Fixed <code>NullPointerException</code> when serializing a Kotlin class without <code>kotlin-reflect</code> on the classpath <a href="https://redirect.github.com/alibaba/fastjson2/issues/7835";>#7835</a></li> </ol> <h2>Documentation</h2> <ol start="5"> <li>Switched the star-history charts to star-history.dera.page <a href="https://redirect.github.com/alibaba/fastjson2/issues/7780";>#7780</a></li> </ol> <h2>Maven Dependency Configuration</h2> <h3>Standard Version</h3> <pre lang="xml"><code><dependency> <groupId>com.alibaba.fastjson2</groupId> <artifactId>fastjson2</artifactId> <version>2.0.65</version> </dependency> </code></pre> <h3>Spring 6 Extension</h3> <pre lang="xml"><code><dependency> <groupId>com.alibaba.fastjson2</groupId> <artifactId>fastjson2-extension-spring6</artifactId> <version>2.0.65</version> </dependency> </code></pre> <h3>Android 5 Optimized Version</h3> <pre lang="xml"><code></tr></table> </code></pre> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/alibaba/fastjson2/commit/879183e944e8c08a57c14b071cea189631c469b8";><code>879183e</code></a> Merge pull request <a href="https://redirect.github.com/alibaba/fastjson2/issues/7841";>#7841</a> from alibaba/release/2.0.65</li> <li><a href="https://github.com/alibaba/fastjson2/commit/abbcc7ef32c61d0ceff3181c25e3311237fcf175";><code>abbcc7e</code></a> 2.0.65 release</li> <li><a href="https://github.com/alibaba/fastjson2/commit/141dbe9992a3ff263d46263669a1760accf9a0b5";><code>141dbe9</code></a> Merge pull request <a href="https://redirect.github.com/alibaba/fastjson2/issues/7836";>#7836</a> from adityaanikam/fix-jsonreaderascii-fieldname-oob-...</li> <li><a href="https://github.com/alibaba/fastjson2/commit/86a8c1a2820753ec1ed49305dec9fdd984b9c6cb";><code>86a8c1a</code></a> Merge pull request <a href="https://redirect.github.com/alibaba/fastjson2/issues/7835";>#7835</a> from obabichevjb/obabichev/fix-kotlin-npe-missing-re...</li> <li><a href="https://github.com/alibaba/fastjson2/commit/f11c2ee25c6dc67ac819944ac81f66d57f796d86";><code>f11c2ee</code></a> fix: ArrayIndexOutOfBoundsException in JSONReaderASCII field-name decoding, f...</li> <li><a href="https://github.com/alibaba/fastjson2/commit/36bc80a790c8351857f4b38c061fc6bff687c3aa";><code>36bc80a</code></a> fix: guard against null paramNames when kotlin-reflect is not on classpath</li> <li><a href="https://github.com/alibaba/fastjson2/commit/30dd009d196687d23e1bb718a6649dac3b356bda";><code>30dd009</code></a> Merge pull request <a href="https://redirect.github.com/alibaba/fastjson2/issues/7719";>#7719</a> from TigerZCoder/discard-getter-when-writing-charact...</li> <li><a href="https://github.com/alibaba/fastjson2/commit/ae13900f650afcfe70c6656f0ffc2685fc63f9a2";><code>ae13900</code></a> Merge pull request <a href="https://redirect.github.com/alibaba/fastjson2/issues/7780";>#7780</a> from SimonFoobar648/fix/star-history-chart</li> <li><a href="https://github.com/alibaba/fastjson2/commit/54394631cb717a313441ffb49a6aa559c54a2f3b";><code>5439463</code></a> fix: use star-history.dera.page for star history charts</li> <li><a href="https://github.com/alibaba/fastjson2/commit/af56f06ee38b854a912c17c7d61487de43648fee";><code>af56f06</code></a> Merge pull request <a href="https://redirect.github.com/alibaba/fastjson2/issues/7753";>#7753</a> from alibaba/fix/autotype-hash-cache-unified</li> <li>Additional commits viewable in <a href="https://github.com/alibaba/fastjson2/compare/2.0.64...2.0.65";>compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
