Skip to content

2.0.0

Latest

Choose a tag to compare

@JohannesErnst JohannesErnst released this 16 Oct 09:07

Fix unsafe type resolution during JSON deserialization

This security patch contains the following updates and API changes:

  • Add class and type allowlists to restrict deserialization targets
  • Disable unrestricted type resolution by default
  • Add an opt-in compatibility flag for trusted JSON data
  • Update decoder documentation and README with security guidance

Miscellaneous

  • Removed old files
  • Updated README.md