0.6.0

Fixed

• Fixed a use-after-free encoding an array that a nested JsonSerializable mutates through an aliasing &-reference; the array is now copied before encoding, as ext/json does.
• JsonSerializable::jsonSerialize() returning $this encodes the object's public properties, matching ext/json, instead of a false JSON_ERROR_RECURSION.
• JsonSerializable no longer charges its serialize call an extra nesting level: a jsonSerialize() returning an M-deep value needs $depth >= M, as in ext/json.
• fastjson_decode() and fastjson_validate() reject raw control characters in strings under JSON_INVALID_UTF8_IGNORE/SUBSTITUTE, which relax UTF-8 validity only, matching ext/json.
• fastjson_pointer_set() fails with JSON_ERROR_INF_OR_NAN instead of emitting invalid Infinity when the document carries a non-finite number (an untouched 1e309 decoded to INF).
• fastjson_pointer_set() counts the pointer path against the replacement's depth budget, so its output always re-decodes at the same $depth.
• fastjson_pointer_set() guards its array-index parser against 32-bit size_t overflow, keeping get/set in agreement.
• fastjson_pointer_set() and fastjson_merge_patch() reject stack-exhausting nesting with JSON_ERROR_DEPTH up front, closing a crash on adversarial deep input.
• fastjson_pointer_set()/_get() apply their encode/decode flags and $depth to the selected value, handle RFC 6901 escapes, and report non-settable paths through the error state.
• fastjson_file_decode() fails a truncated stream read instead of decoding the partial bytes.

Changed

• Clarified the file helper error contract: I/O failures still use FASTJSON_ERROR_SYNTAX to stay inside the JSON_ERROR_* range, and callers should distinguish them with fastjson_last_error_msg().
• Corrected the file helper docs: a missing or unreadable file fails silently, but an open_basedir denial warns like file_get_contents()/file_put_contents() (behavior unchanged).

Performance

• fastjson_pointer_set() root replacement and fastjson_merge_patch() with a non-object patch skip the target depth prewalk, since those paths discard the target after parsing.

Build

• Pinned the PIE smoke job and local smoke script to explicit PIE and Composer PHAR versions instead of moving latest artifacts.
• Hardened CI failure detection so a broken build or a non-loading module can no longer pass as green: pipefail on the Linux build, an extension-load guard in the test steps, and runner-status plus leak/bork checks under ASAN.
• scripts/pie-smoke.sh exits non-zero when PIE itself fails to install, instead of printing PASSED after the manual phpize fallback.
• Vendored yyjson carries a new local patch (P-004) that rejects control characters in strings regardless of ALLOW_INVALID_UNICODE; re-apply on upgrade (see vendor/yyjson/PATCHES.md).