Bump oj from 3.17.3 to 3.17.6

[dependabot]

Bumps oj from 3.17.3 to 3.17.6.

Release notes

Sourced from oj's releases.

v3.17.6

What's Changed

• Fix an options hash Oj knows no key of detaching a Rails encoder by @​Watson1978 in ohler55/oj#1093

Full Changelog: ohler55/oj@v3.17.5...v3.17.6

v3.17.5

What's Changed

Most of this release comes out of a security review of the C extension. There are no API changes.

Memory safety

• Fix hash flooding by seeding the key hash per process by @​Watson1978 in ohler55/oj#1053
• Fix a one byte buffer over-read on a trailing backslash by @​Watson1978 in ohler55/oj#1054
• Fix two length underflows that cause an unbounded buffer over-read by @​Watson1978 in ohler55/oj#1055
• Fix a SEGV from type confusion in class path resolution by @​Watson1978 in ohler55/oj#1056
• Fix uninitialized stack memory leaking into the class name error by @​Watson1978 in ohler55/oj#1057
• Fix output buffer overflows when writing indentation by @​Watson1978 in ohler55/oj#1058
• Fix doc path limit by @​ohler55 in ohler55/oj#1061
• Fix the use-after-free of a key when the value stack grows by @​Watson1978 in ohler55/oj#1062
• Fix the buffer over-read when a document ends where a key belongs by @​Watson1978 in ohler55/oj#1063
• Fix the id from a circular reference being used unchecked by @​Watson1978 in ohler55/oj#1064
• Fix the SEGV dumping an exception that was never raised by @​Watson1978 in ohler55/oj#1068
• Fix the stack buffer overflow writing the error location by @​Watson1978 in ohler55/oj#1071
• Fix the read error in Oj::Parser#file being taken as a huge read by @​Watson1978 in ohler55/oj#1072
• Fix the truncated float format copying stack bytes into the output by @​Watson1978 in ohler55/oj#1073
• Fix the double free of the default create_id when a call passes nil by @​Watson1978 in ohler55/oj#1074
• Fix the buffer over-read of an odd attribute name and the leak of its args by @​Watson1978 in ohler55/oj#1075
• Fix the SEGV reading a truncated document with Oj::Parser#file and the descriptor it leaks by @​Watson1978 in ohler55/oj#1076
• Fix the SEGV from a malformed number in Oj::Doc by @​Watson1978 in ohler55/oj#1077
• Fix the stack overflow from a long key with :only or :except by @​Watson1978 in ohler55/oj#1078
• Fix the odd module match being decided by uninitialized memory by @​Watson1978 in ohler55/oj#1079
• Fix :float_format taking directives it has no argument for by @​Watson1978 in ohler55/oj#1083

Memory leaks

• Fix the leak of an escaped hash key in the streaming parser by @​Watson1978 in ohler55/oj#1067
• Fix memory leak of the parser create_id when it is set again by @​Watson1978 in ohler55/oj#1085
• Fix memory leak of the parser when Oj::Parser.new or .safe raises by @​Watson1978 in ohler55/oj#1086

Parsing and dumping

• Fix a safe parser limit of 4 being ignored by @​Watson1978 in ohler55/oj#1065
• Fix the exponent bound being checked after it is narrowed by @​Watson1978 in ohler55/oj#1066
• Fix a long first token being rejected and the grown reader buffer leaking by @​Watson1978 in ohler55/oj#1069
• Fix the safe parser limits being dropped when an option is set by @​Watson1978 in ohler55/oj#1070
• Fix the custom mode dump of an unraised exception opening with "{," by @​Watson1978 in ohler55/oj#1082
• Fix the wab mode time load being an offset out on Windows by @​Watson1978 in ohler55/oj#1088
• Fix Oj::Doc dropping the exponent of a number with no decimal point by @​Watson1978 in ohler55/oj#1089

... (truncated)

Changelog

Sourced from oj's changelog.

3.17.6 - 2026-08-10

• Fixed issue #1092, where the encoder ActiveSupport 8.1 caches with escape: false froze the options as they stood before set_encoder wrote time_precision into them, so to_json(escape: false) emitted 9 fractional digits. An options hash that names no option Oj knows no longer detaches an encoder from the defaults. (#1093)

3.17.5 - 2026-07-31

Most of this release comes out of a security review of the C extension. There are no API changes.

Memory safety

• Fixed hash flooding by seeding the key hash per process. The hash was decided entirely at compile time, so a document of colliding keys turned key interning into O(n^2) and left the process slow for every later parse. (#1053)
• Fixed a one byte buffer over-read on a document that ends with a backslash inside an unterminated string. (#1054)
• Fixed two length underflows that made an empty ^m value and a key of exactly 65,536 bytes read forward until they left mapped memory. (#1055)
• Fixed a SEGV from type confusion in class path resolution. A name segment that resolved to something other than a class or module was dereferenced as one. (#1056)
• Fixed uninitialized stack memory being read into the message of an unresolved class name error. (#1057)
• Fixed output buffer overflows when writing indentation, where several callers of fill_indent() had not assured the buffer first. (#1058)
• Fixed the Oj::Doc path depth limit being checked one level too late. (#1061)
• Fixed the use-after-free of a key when the value stack grows. (#1062)
• Fixed the buffer over-read when a document ends where a key belongs. (#1063)
• Fixed the id from a circular reference being used unchecked. (#1064)
• Fixed the SEGV dumping an exception that was never raised, where the missing backtrace was read as an Array. (#1068)
• Fixed the stack buffer overflow writing the error location. (#1071)
• Fixed a read error in Oj::Parser#file being taken as a read of SIZE_MAX bytes, which wrote in front of the buffer and then reparsed it forever without checking for interrupts. (#1072)
• Fixed a :float_format too long for the 64 byte buffer copying stack bytes past the end of it into the output. (#1073)
• Fixed the double free of the default create_id when a call passes :create_id => nil. (#1074)
• Fixed the buffer over-read of an odd attribute name and the leak of its arguments. (#1075)
• Fixed the SEGV reading a truncated document with Oj::Parser#file and the descriptor it leaked. (#1076)
• Fixed the SEGV from a malformed number in Oj::Doc. (#1077)
• Fixed the stack exhaustion from a long key with :only or :except. (#1078)
• Fixed the odd module match being decided by uninitialized memory. (#1079)
• Fixed :float_format accepting directives it has no argument for. (#1083)

Memory leaks

• Fixed the leak of an escaped hash key in the streaming parser. (#1067)
• Fixed the leak of the parser create_id when it is set a second time. (#1085)
• Fixed the leak of the parser when Oj::Parser.new or Oj::Parser.safe raises on an argument it does not take. (#1086)

Parsing and dumping

• Fixed a safe parser limit of 4 being ignored. (#1065)
• Fixed the exponent bound being checked after it is narrowed. (#1066)
• Fixed a document being rejected when it opens with a number of 4093 digits or more read through a file descriptor or an IO, and the reader buffer that leaked when it grew. (#1069)
• Fixed the safe parser limits being dropped when an option is set after the parser is built. (#1070)
• Fixed the :custom mode dump of an exception that was never raised opening with {,. (#1082)
• Fixed the :wab mode time load being an offset out on Windows, where mktime() stood in for timegm() and returned -1 for any time before the epoch. (#1088)
• Fixed Oj::Doc dropping the exponent of a number written without a decimal point, so 1e3 loaded as 1. (#1089)

Rails

... (truncated)

Commits

• 54bec6d Release prep
• b151341 Fix an options hash Oj knows no key of detaching a Rails encoder (#1093)
• 04d3084 Update changelog
• aae0079 Fix the 3.17.5 changelog entry saying only "Fixed multiple issues" (#1091)
• 6d04d30 Fix the pre-1970 time tests being skipped on Windows for a limit that no long...
• eaf0ad6 Fix Oj::Doc dropping the exponent of a number with no decimal point (#1089)
• 7f683cd Fix the wab mode time load being an offset out on Windows (#1088)
• c9bae55 Fix rake never running the test/test_*.rb suite (#1084)
• f5d4af6 Add a job timeout to the workflows (#1087)
• 2949015 Fix memory leak of the parser when Oj::Parser.new or .safe raises (#1086)
• Additional commits viewable in compare view

[jbirdjavi]

Closing under the security-only posture (ADL-32 ruling 2026-08-19). The bundler version lane is now at open-pull-requests-limit: 0, so this bump will not be re-proposed — closing it is the decision that it doesn't happen. Gems on this repo now move on a security advisory or a deliberate hand-run bump. The github-actions lane is unaffected and stays at limit 10.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.