Skip to content

fastjson 2.0.65版本发布

Choose a tag to compare

View all tags
@wenshao wenshao released this 02 Sep 14:31
· 155 commits to main since this release
2.0.65
879183e
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

FASTJSON 2.0.65 Release Notes

Release Date: 2 Sep 2026
Tag: 2.0.65 (879183e)

Overview

This is a security fix release. It closes an AutoType authorization bypass reachable when JSONReader.Feature.SupportAutoType is enabled, and includes parser/writer robustness fixes. All users are strongly recommended to upgrade, especially applications that parse untrusted JSON or JSONB with AutoType enabled.

This release also restores fastjson2-extension-spring6 on Maven Central. It was missing for 2.0.62–2.0.64 because those releases were deployed with a JDK that did not activate the enable-for-17+ build profile, so the module never entered the build reactor #7840.

The Android variants 2.0.65.android5 and 2.0.65.android8 carry the same AutoType security fix #7843 #7844.

Security Fixes

  1. Unified AutoType authorization on the real type name: a reader-cache hit on the FNV-1a-64 hash of @type is no longer treated as authorization. All untrusted-input paths (JSON and JSONB readers, and the object readers for beans, interfaces, exceptions, adapters, typed maps, arrays, collections and no-default-constructor types) now resolve @type through the full provider security checks — SafeMode, deny lists, type-name validation, and any user-supplied AutoTypeBeforeHandler. Compatibility is preserved for explicit local mappings declared with @JSONType(seeAlso = ...) and for readers annotated with @JSONType(... SupportAutoType) #7753

Bug Fixes

  1. Fixed ArrayIndexOutOfBoundsException in JSONReaderASCII field-name decoding, triggered by a field name that combines an escape sequence with latin1 bytes >= 0x80 #7808 #7836
  2. Fixed getter methods being silently discarded when serializing char/Character fields, which caused NPEs or lost field values #7719
  3. (kotlin) Fixed NullPointerException when serializing a Kotlin class without kotlin-reflect on the classpath #7835

Documentation

  1. Switched the star-history charts to star-history.dera.page #7780

Maven Dependency Configuration

Standard Version

<dependency>
    <groupId>com.alibaba.fastjson2</groupId>
    <artifactId>fastjson2</artifactId>
    <version>2.0.65</version>
</dependency>

Spring 6 Extension

<dependency>
    <groupId>com.alibaba.fastjson2</groupId>
    <artifactId>fastjson2-extension-spring6</artifactId>
    <version>2.0.65</version>
</dependency>

Android 5 Optimized Version

<dependency>
    <groupId>com.alibaba.fastjson2</groupId>
    <artifactId>fastjson2</artifactId>
    <version>2.0.65.android5</version>
</dependency>

Android 8 Optimized Version

<dependency>
    <groupId>com.alibaba.fastjson2</groupId>
    <artifactId>fastjson2</artifactId>
    <version>2.0.65.android8</version>
</dependency>
中文版本

概述

本版本为安全修复版本，修复了在开启 JSONReader.Feature.SupportAutoType 时可触达的 AutoType 授权绕过问题，并包含解析/序列化的健壮性修复。强烈建议所有用户升级，尤其是解析不可信 JSON / JSONB 且开启了 AutoType 的应用。

本版本同时恢复了 Maven Central 上的 fastjson2-extension-spring6。2.0.62～2.0.64 缺失该模块，原因是这几个版本发布时使用的 JDK 未激活 enable-for-17+ 构建 profile，模块没有进入构建 reactor #7840。

Android 变体 2.0.65.android5 与 2.0.65.android8 已同步 port 该 AutoType 安全修复 #7843 #7844。

安全修复

  1. 将 AutoType 授权统一到真实类型名：@type 的 FNV-1a-64 哈希命中 reader 缓存不再被视为授权。所有不可信输入路径（JSON 与 JSONB reader，以及 bean、接口、异常、adapter、typed map、数组、集合、无默认构造类型的 object reader）现在都会让 @type 经过 provider 的完整安全检查——SafeMode、deny 列表、类型名校验，以及用户提供的 AutoTypeBeforeHandler。同时保留兼容行为：@JSONType(seeAlso = ...) 声明的显式局部映射，以及标注了 @JSONType(... SupportAutoType) 的 reader #7753

问题修复

  1. 修复 JSONReaderASCII 字段名解码的 ArrayIndexOutOfBoundsException——当字段名同时包含转义序列和 >= 0x80 的 latin1 字节时触发 #7808 #7836
  2. 修复序列化 char/Character 字段时 getter 方法被静默丢弃，导致空指针异常或字段值丢失的问题 #7719
  3. （kotlin）修复 classpath 上没有 kotlin-reflect 时序列化 Kotlin 类抛出 NullPointerException 的问题 #7835

文档

  1. star-history 图表切换到 star-history.dera.page #7780

Maven 依赖配置

标准版本

<dependency>
    <groupId>com.alibaba.fastjson2</groupId>
    <artifactId>fastjson2</artifactId>
    <version>2.0.65</version>
</dependency>

Spring 6 扩展

<dependency>
    <groupId>com.alibaba.fastjson2</groupId>
    <artifactId>fastjson2-extension-spring6</artifactId>
    <version>2.0.65</version>
</dependency>

Android 5 优化版本

<dependency>
    <groupId>com.alibaba.fastjson2</groupId>
    <artifactId>fastjson2</artifactId>
    <version>2.0.65.android5</version>
</dependency>

Android 8 优化版本

<dependency>
    <groupId>com.alibaba.fastjson2</groupId>
    <artifactId>fastjson2</artifactId>
    <version>2.0.65.android8</version>
</dependency>
Assets 2
Loading