fix(deps): bump: bump com.cedarsoftware:json-io from 4.93.0 to 4.102.0

[dependabot]

Bumps com.cedarsoftware:json-io from 4.93.0 to 4.102.0.

Release notes

Sourced from com.cedarsoftware:json-io's releases.

4.101.0

json-io 4.101.0

Maven Central: com.cedarsoftware:json-io:4.101.0 (requires java-util 4.101.0+)

Highlights

New APIs

• WriteOptionsBuilder.standardJson() — one-call convenience setting showTypeInfoNever(), showRootTypeInfo(false), cycleSupport(false), stringifyMapKeys(true), useMetaPrefixDollar(), and ISO-8601 date formatting. Produces Jackson-compatible JSON for normal POJO/List/Map cases. Chainable. Will become the default in 5.0.0.
• WriteOptionsBuilder.namingStrategy(IoNaming.Strategy) — global naming strategy applied to all classes without a per-class @IoNaming/@JsonNaming. Priority: per-field @IoProperty/@JsonProperty > per-class annotation > global strategy > field name as-is. Two new enum values: UPPER_SNAKE_CASE and LOWER_CASE (full set: SNAKE_CASE, UPPER_SNAKE_CASE, KEBAB_CASE, UPPER_CAMEL_CASE, LOWER_DOT_CASE, LOWER_CASE).
• WriteOptionsBuilder.stringifyMapKeys(boolean) — non-String map keys with bidirectional String conversion (Long, UUID, Enum, Date, etc.) written as plain JSON object keys instead of @keys/@items parallel-array form. Default false for JSON (backward-compat), true for JSON5.
• WriteOptionsBuilder.preserveLeafContainerIdentity(boolean) — when false (the new default), traceReferences skips containers holding only non-referenceable leaves (List<String>, Map<UUID, Date>, String[], etc.), matching Jackson's default identity semantics.
• WriteOptionsBuilder.writeOptionalAsObject(boolean) — set to true for legacy {"present":true,"value":X} form; default false writes Optionals as bare primitive values.
• 1-arg convenience overloads: JsonIo.toJson(obj), toToon(obj), toJava(json), toJava(stream), fromToon(toon), fromToon(stream).

Performance

• Full-suite performance pass — all 8 Read/Write ratios under 2.0x vs Jackson on a warm JVM (best 1.32x JsonIo Read toMaps, worst ~1.97x Toon Read toJava).
• Switched all hot-path ClassValueMap/ClassValueSet lookups to the new getByClass(Class) / containsClass(Class) fast-path APIs (added in java-util 4.101.0).
• AnnotationResolver.getMetadata — split into trivially-inlineable fast path + scanAndCache cold path. Fast-path self-time dropped ~50%.
• ObjectResolver.traverseFields — hoisted per-object AnnotationResolver.getMetadata call out of the per-field loop (~20% of Resolver-phase samples).
• ReadOptions.isNonReferenceableClass / isNotCustomReaderClass — memoized via per-instance ClassValue<Boolean> caches (mirrors WriteOptions.nonRefCache).
• JsonWriter.traceReferences — filters non-referenceable leaves at push site (save deque push+pop per leaf). JsonIo Write cycle=true toJava −5.8%, toMaps −7.5%.
• ToonWriter — precomputed key-quoting decision at WriteFieldPlan build time (eliminates per-field ConcurrentHashMap.get — 11.7% of ToonWriter samples). Toon Write cycle=false toJava −5.0%.
• JsonWriter.writeField / ToonWriter.writeFieldEntry — primitive+String fast paths bypass full dispatch for the most common field-value types.
• ToonWriter.writeMap — skips hasComplexKeys iteration when the enclosing field's declared Map key type is Converter-stringifiable.
• JsonWriter.writeCollectionElement — POJO short-circuit for cycleSupport=false collapses 4-level dispatch to 2 levels.

Bug fixes

• Optional, OptionalInt, OptionalLong, OptionalDouble — all four now write Jackson/Gson-compatible primitive form by default (Optional.empty() → null, Optional.of(X) → X). Prior behavior emitted invalid JSON for Optional ({null} or {"hello"}) and broken POJO form for the three primitive Optionals. Field-type-aware coercion wraps bare scalars into the appropriate Optional variant on read. Reader accepts both new and legacy object form for backward compatibility. Reported by Jim Ronan (*/dxg Health).
• JsonWriter.writeLongDirect() — inner digit-extraction loop used int q which silently truncated Long.MIN_VALUE (rendered as -206158430208 instead of -9223372036854775808). Fixed by using long q.

Jackson-alignment (opt-in)

• WriteOptionsBuilder.standardJson() and json5() now also configure ISO-8601 date formatting for java.util.Date / java.sql.Date. Matches Spring Boot's default Jackson configuration (WRITE_DATES_AS_TIMESTAMPS=false).

Full changelog: https://github.com/jdereg/json-io/blob/master/changelog.md

4.100.0 - 2026-04-10

Bug Fixes

• Fixed deadlock from circular static initialization between ReadOptionsBuilder and WriteOptionsBuilder. When two threads concurrently triggered class loading (e.g., one calling JsonIo.toJson() and another calling JsonIo.toJava()), the JVM's class initialization locks would deadlock. Broke the cycle by having each builder load its configuration independently and by removing the circular dependency through MetaUtils bootstrap methods.

Dependency Updates

• java-util 4.100.0 (includes fix for unbounded Converter.FULL_CONVERSION_CACHE memory leak)
• JUnit 5.14.2 → 5.14.3
• Jackson 2.21.1 → 2.21.2

4.99.0 - 2026-03-28

... (truncated)

Changelog

Sourced from com.cedarsoftware:json-io's changelog.

4.102.0 - (Unreleased)

• BUILD: Test-scope dependency bumps — gson 2.13.2 → 2.14.0, jackson-databind 2.21.2 → 2.21.3. No runtime impact; both used only for benchmark-comparison tests.
• BUG FIX: Borrowed FastReader.BufferSlice content is now materialized or released at safe points, preventing buffer-overwrite edge cases during JSON string and TOON line parsing.
• DOCUMENTATION: Refreshed README performance ratios from median run-mode benchmark results.
• PERFORMANCE: JsonWriter.writeJsonUtf8String() — bulk-copies the input string into a per-thread char[] via SIMD-intrinsic StringUtilities.getChars(), then walks buf[i] instead of s.charAt(i) (eliminates per-character StringLatin1/UTF16 dispatch). Slice writes route through output.write(buf, off, len) → sb.append(char[]) instead of sb.append(String, off, off+len). JsonIo Write cycleSupport=false toJava -2.14%, toMaps -2.40%; collateral on cycleSupport=true toJava -3.84%, toMaps -3.08%.
• PERFORMANCE: JsonIo.toJson() / JsonIo.toToon() — initial StringBuilder capacity raised from 8192 to 32768 chars, skipping several early ensureCapacityInternal doublings on typical payloads. TOON Write cycleSupport=false toJava -2.09%, toMaps -2.76%; collateral on cycleSupport=true toJava -3.38%, toMaps -3.12%.
• PERFORMANCE: ToonWriter — replaced 21 out.write(": ") and 46 out.write(NEW_LINE) (where NEW_LINE = "\n" is hardcoded per TOON spec) with single-char writes (out.write(':'), out.write(' '), out.write('\n')). Each String-overload of StringBuilder.append triggers String.getBytes + ensureCapacityInternal; single-char append takes a tighter putCharsAt path. TOON Write cycleSupport=false toJava -4.13%, toMaps -3.82%.
• PERFORMANCE: ToonReader.STRING_CACHE_MASK raised from 2047 to 4095 — grew the per-thread string cache from 2048 to 4096 slots, trading ~16 KB extra per thread for fewer eviction collisions on high-cardinality field-value strings. TOON Read toMaps -2.16%; Full Java essentially flat (typed primitives bypass the cache).
• PERFORMANCE: ToonReader parses tabular rows directly from the borrowed line buffer, avoiding per-row String materialization on the common unquoted path and precomputing tabular metadata columns once per array instead of probing metadata keys for every cell.
• PERFORMANCE: JsonParser trims additional pushback() calls from number continuation, negative-number fallback, and block-comment scanning while preserving token-boundary semantics; number parsing also drops redundant exponent digit bookkeeping after the first exponent digit is validated inline.
• PERFORMANCE: JsonParser.readArray peeks for ] up front, so the empty-array case never reaches readValue and never has to pushback ] + return an EMPTY_ARRAY sentinel. Removed the static EMPTY_ARRAY field, the case ']' branch in readValue, and the per-iteration value != EMPTY_ARRAY check in readArray. One more pushback eliminated; cleaner control flow.
• PERFORMANCE: JsonParser.readArray and readJsonObject now hand the already-read first character of the next value/field straight to readValue(int, Type) and a new readFieldName(int) overload, instead of pushing it back into FastReader and re-reading it. Eliminates 3 read-then-pushback round-trips per non-trailing array element / object field — ~17M getfield/putfield operations on pushback state per benchmark run. toJava Read -2.3% (1.86x → 1.85x Jackson), toMaps Read -4.9% (1.25x → 1.20x Jackson). maxDepth check moved into the new overload so all entry points enforce it uniformly.
• PERFORMANCE: Float/double/BigDecimal/BigInteger parsing now backed by the Eisel-Lemire algorithm via java-util 4.102.0's vendored Randelshofer FastDoubleParser. JsonParser/ToonReader/ObjectResolver route through new MathUtilities.parseDouble/parseFloat/parseBigDecimal/parseBigInteger entry points; output is bit-identical to JDK reference parsers (parity test in java-util). toMaps Read ratio 1.317x → 1.276x Jackson (-3.1%); toJava Read essentially flat on this benchmark (few floats). Real-world payloads with more doubles will see proportionally larger wins.
• PERFORMANCE: JSON string caching now uses sampled slot hashing with full content verification, reducing cache-probe work for short strings.
• PERFORMANCE: JSON object parsing now resolves field generic types only for nested object/array values, avoiding unnecessary scalar field lookups.
• PERFORMANCE: Read-side injector planning now caches field assignment metadata used by JsonParser and ObjectResolver, reducing repeated type checks while preserving field-level type overrides.
• PERFORMANCE: ObjectResolver.traverseFields — adaptive shape cache: after 2 consecutive same-shape calls, builds a position-indexed FieldAssignmentPlan[] and skips the per-field assignmentPlansByName.get(key) HashMap lookup on subsequent same-shape objects (parser-interned field-name Strings make identity comparison safe). java-json-benchmark USERS DATABIND deser ratio vs Jackson: 10KB 5.28x → 4.51x, 100KB 5.68x → 4.72x, 1MB 5.83x → 4.85x. JsonPerformanceTest Read -1.8% (1.80x → 1.78x).
• PERFORMANCE: TOON uniform-POJO tabular detection skips primitive field reads during the prepass; row writing still uses primitive Accessor getters.
• PERFORMANCE: Accessor now supports primitive getters for all eight Java primitive types, and JSON/TOON writers use them to avoid boxing primitive POJO fields.
• PERFORMANCE: JsonParser.readString() and ToonReader.readLineRaw() use borrowed FastReader slices on contiguous-buffer fast paths, avoiding copies when safe.
• PERFORMANCE: JsonIo.BufferRecycler now tracks reader and pushback buffers independently, allowing pushback buffers to be reused on JSON/TOON String input paths.
• REFACTOR: JsonObject split into a shape-cut hierarchy — lite JsonObject (POJO / String-keyed map — public API) plus package-private JsonObjectArray (@items-shaped) and JsonObjectMap (complex-keyed @keys/@items). Lite JsonObject shed the Object[] itemsRef field and byte storageMode (with MODE_* constants and valueArray() indirection) — heap savings on every lite instance, the common deserialized-graph case. JsonParser/ToonReader peek through metadata to allocate the right subclass up front; promoteToArray()/promoteToMap() lazy-promote when shape determiners arrive late. Public API unchanged. New JsonObjectFamilyTest (20 tests) pins cross-shape contracts. JsonPerformanceTest deltas within run-to-run noise (≤ ±3.5% across 16 tracked metrics).
• REFACTOR: JsonObjectMap — removed duplicate mapKeyType field that shadowed the parent JsonObject.mapKeyType. Latent bug: code reading the parent's lite-stored field via a post-promotion JsonObjectMap reference would see null from the empty subclass field. Removed both getMapKeyType()/setMapKeyType() overrides and the redundant mapKeyType = null line in JsonObjectMap.clear() (parent's clear() already handles it).
• TESTING: Added sampled string-cache collision coverage for JSON parsing.

4.101.0 - 2026-04-19

• FEATURE: Added WriteOptionsBuilder.standardJson() convenience method. Sets showTypeInfoNever(), showRootTypeInfo(false), cycleSupport(false), stringifyMapKeys(true), useMetaPrefixDollar(), and ISO-8601 date formatting in one call — producing standard JSON output identical to Jackson for normal usage. Any remaining metadata uses $ prefix (e.g., $type). These will become the defaults in json-io 5.0.0. Chainable.
• FEATURE: New WriteOptionsBuilder.namingStrategy(IoNaming.Strategy) — a global naming strategy applied when classes/fields lack per-class @IoNaming/@JsonNaming or per-field @IoProperty/@JsonProperty annotations. Opt-in equivalent of Jackson's ObjectMapper.setPropertyNamingStrategy(...). Two new enum values (UPPER_SNAKE_CASE, LOWER_CASE) complete the Jackson-compatible set. Default is null (unchanged behavior). Also adds addPermanentNamingStrategy(...) and WriteOptions.getNamingStrategy(). 13 new tests.
• FEATURE: Added WriteOptionsBuilder.stringifyMapKeys(boolean). When enabled, non-String map keys with a bidirectional String conversion via Converter (Long, UUID, Date, Enum, etc.) are written as stringified keys in standard JSON object format (e.g., {"100": "value"}) instead of the proprietary @keys/@items parallel-array format. Complex POJO keys still fall back to @keys/@items. Default false for JSON, true for JSON5. Also adds addPermanentStringifyMapKeys(). 14 new tests.
• FEATURE: New WriteOptionsBuilder.preserveLeafContainerIdentity(boolean) (default false), with addPermanent... variant. traceReferences no longer visits containers whose declared element types are non-referenceable leaves (List<String>, Map<UUID, Date>, String[], byte[], etc.) — two fields pointing at the same leaf-only container now serialize as independent copies, matching Jackson. Containers with POJO elements still trace identity. Only affects cycleSupport=true. Write-ratio vs Jackson: JsonIo toMaps 2.26x → 1.70x (-25%), JsonIo toJava 2.00x → 1.71x (-15%), Toon toJava 2.05x → 1.84x (-10%). Three pre-existing tests updated to opt in.
• FEATURE: standardJson() and json5() now configure ISO-8601 date formatting for java.util.Date/java.sql.Date via isoDateFormat(), matching Jackson's default. Library-wide default remains epoch-millis for backward compatibility. java.time.* was already ISO-8601. Chainable: .standardJson().longDateFormat() reverts.
• FEATURE: Added 1-argument convenience overloads — JsonIo.toJson(srcObject), toToon(srcObject), toJava(json), toJava(inputStream), fromToon(toon), fromToon(inputStream) — each delegating to the 2-argument version with null options.
• BUG FIX: Optional, OptionalInt, OptionalLong, and OptionalDouble no longer produce invalid JSON. Previously Optional fields written with showTypeInfoNever() emitted illegal fragments like {null}, and the primitive variants had no custom writer/factory and serialized as broken POJOs. Now written in Jackson/Gson-compatible primitive form by default (Optional.empty() → null, Optional.of(X) → X) across JSON, JSON5, and TOON. New writeOptionalAsObject(boolean) toggle emits the legacy object form for pre-4.101.0 reader interop; readers accept both formats. Field-type-aware coercion wraps bare scalars into the declared Optional variant. 32 new tests. Reported by Jim Ronan (Divisional Software Architect, */dxg Health).
• BUG FIX: JsonWriter.writeLongDirect() — inner digit-extraction loop stored value / 100 in an int that silently truncated to 32 bits. Latent until the new writeImpl primitive-wrapper fast path exercised it with arbitrary Long values; Long.MIN_VALUE rendered as -206158430208. Fixed by using long q.
• PERFORMANCE: JsonIo.toJson(Object, WriteOptions) — swapped the byte-based output pipeline (FastWriter → OutputStreamWriter(UTF-8) → FastByteArrayOutputStream → new String(bytes, UTF-8)) for a direct char-based StringBuilderWriter → StringBuilder → sb.toString() pipeline. Roughly half of JSON write time was in the char→byte→char round-trip. New StringBuilderWriter helper. toJson(OutputStream, ...) unchanged. JsonIo Write cycleSupport=false toJava -10.3%; best ratio vs Jackson 2.05x → 1.84x.
• PERFORMANCE: JsonIo.toToon(Object, WriteOptions) — same byte → char pipeline swap as toJson. ~33% of ToonWriter samples were in UTF-8 encode/decode. toToon(OutputStream, ...) unchanged. Toon Write cycleSupport=true toJava -5.7%; best ratio 2.15x → 2.05x.
• PERFORMANCE: JsonWriter.writeImpl() — primitive-wrapper fast path for Integer/Long/Boolean when no type info or format pattern is active. Previously routed through writeUsingCustomWriter → writeCustom → PrimitiveValueWriter.writePrimitiveForm, which allocated obj.toString(). Now streams digits directly via writeIntDirect/writeLongDirect or cached SMALL_INT_STRINGS. cycleSupport=false toJava -8.5%; best ratio 1.84x → 1.68x.
• PERFORMANCE: JsonWriter.writeField() — primitive/String fast path that bypasses writeImpl()'s full dispatch chain (null/security checks, activePath, custom-writer lookup, try/finally) for String, Integer, Long, Boolean, Double field values when no @IoShowType, @IoFormat, or forceElementShowType is active. cycleSupport=false toJava -6.9%; best ratio 1.68x → 1.61x.
• PERFORMANCE: JsonWriter.writeCollectionElement() — POJO short-circuit for cycleSupport=false skips writeImpl()'s null/security/primitive checks and try/finally for List<MyPojo>-style elements, giving the JIT better inlining budget. Custom writers / @IoValue still checked first.
• PERFORMANCE: JsonWriter.traceReferences — filter non-referenceable leaves (Strings, primitive wrappers, temporals, UUID, etc.) at the push site instead of after pop, matching ToonWriter.pushReferenceCandidate. DOS guardrails (maxObjectCount, maxObjectGraphDepth) still enforced. cycleSupport=true toJava -5.8%, toMaps -7.5%.
• PERFORMANCE: ToonWriter.writeFieldEntry() / writeFieldEntryInline() — primitive/String fast path for null, String, Integer, Long, Boolean, Double avoids 4+ container instanceof misses plus the isPrimitive() (4 more checks) and writeValue() dispatch. Toon Write cycleSupport=false toJava -6.3%; best ratio 2.00x → 1.85x.
• PERFORMANCE: ToonWriter.writeValue() / isPrimitive() — cheap instanceof fast paths for String/Number/Boolean/Character skip the per-call writeTypeCache.get() ClassValue lookup (~7-8% of ToonWriter samples). Toon Write cycleSupport=true toJava -6.1%; best ratio 2.05x → 1.89x.
• PERFORMANCE: ToonWriter.writeValue() / writeNumber() — Integer/Long direct-write fast path in writeValue skips writeNumber dispatch and its 6-wide instanceof chain. writeNumber itself reordered to check Integer/Long/Short/Byte first. Toon Write cycleSupport=true toJava -5.2%.
• PERFORMANCE: ToonWriter — precompute POJO field-key quoting decision at WriteFieldPlan build time. Previously needsQuoting(key) probed a shared ConcurrentHashMap on every field write (11.7% of ToonWriter samples). Now runs once per (WriteOptions, Class); runtime reads a precomputed boolean. Dynamic Map keys still use the cache. Toon Write cycleSupport=false toJava -5.0%; best ratio 1.79x → 1.70x.
• PERFORMANCE: ToonWriter.writeMap — skip the hasComplexKeys() iteration when the enclosing field's declared Map key type is known Converter-stringifiable (String, Long, UUID, Date, Instant, etc.). WriteFieldPlan computes the flag at plan-build time; non-plan paths still scan for correctness. Toon Write cycleSupport=true toMaps 2.03x → 1.89x (-7%) vs Jackson.
• PERFORMANCE: ToonReader.parseNumber() — isValidNumberToken() pre-validation guard rejects tokens like 2024-03-15 or 10:30:00Z (start with digit but aren't numbers) before parseToMinimalNumericType(), eliminating NumberFormatException + fillInStackTrace (the #1 TOON Read JFR leaf at 291 samples). Toon Read toJava -16.4% (ratio 2.69x → 2.15x), toMaps -22.9% (2.39x → 1.84x).
• PERFORMANCE: ToonReader.parseNumber(char[]) — digits-only positive-integer fast path bypasses the number cache entirely for tokens matching [0-9]+ that fit in a non-negative long. Skips cacheHash, miss-check loop, and key materialization; falls through for signed/decimal/exponent/BigInteger. Toon Read toJava -6.3% (2.84x → 2.71x), toMaps -5.6% (2.55x → 2.46x).
• PERFORMANCE: JsonParser.readString() — fast path for short strings (< 256 chars) without escapes bulk-reads into a reusable char[] via readUntil() and caches directly via new cacheStringFromChars(), bypassing StringBuilder. Escapes and long strings fall through. JsonIo Read ratio vs Jackson: toJava 2.37x → 2.25x, toMaps 1.48x → 1.35x.
• PERFORMANCE: JsonParser.readNumber() — fast path for simple positive integers (1-9 followed by digits) accumulates directly into a long from the stream, with no StringBuilder, no per-digit append, no readInteger() re-parse. Falls back for negatives/floats/hex/19+ digit integers. Combined with readString, toJava read ratio 2.33x → 2.17x.
• PERFORMANCE: JsonParser.readJsonObject() — skip substitutes.getOrDefault() HashMap lookup for field names that don't start with @ or $. SUBSTITUTES only holds short-form meta keys (@i/@t/@r/@e/@k) and JSON5 $-prefixed keys, so a single charAt(0) check eliminates the lookup for 99%+ of fields. Read ratio toJava 2.22x → 2.14x, toMaps 1.31x → 1.26x.

... (truncated)

Commits

• d4efd24 preflight-release.sh: untracked files don't block release
• b447dcb Pre-release prep for 4.102.0: dep bumps + release helper scripts
• e9b5161 Changelog: shorten 4.102.0 R-6 entry to match surrounding entry style
• efa87c3 Changelog: refine 4.102.0 R-6 entry with full publication-sweep numbers
• e28e7e0 Performance: harden SHAPE_CACHE_THRESHOLD to private static final
• 982f2f8 Performance: adaptive shape cache in ObjectResolver.traverseFields
• 6522fe3 README: tighten -parameters mention (drop "now retained" stale framing)
• 2abc629 README: update jar sizes for json-io 4.102.0 (~330K -> ~500K) and java-util (...
• 23ef6a7 Update writeJsonUtf8String for relocated CharBufScratch.getChars
• d5d2c60 Changelog: tidy 4.102.0 entries — sort by type and shorten verbose entries
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)