[PR #345] [MERGED] chore(deps): bump github.com/buger/jsonparser from 1.3.0 to 1.6.1 #339

New issue

Closed

opened 2026-09-29 13:01:27 +00:00 by slurdge · 0 comments

slurdge commented 2026-09-29 13:01:27 +00:00

Owner

Copy link

📋 Pull Request Information

Original PR: https://github.com/slurdge/goeland/pull/345
Author: @dependabot[bot]
Created: 8/11/2026
Status: ✅ Merged
Merged: 8/30/2026
Merged by: @slurdge

Base: master ← Head: dependabot/go_modules/github.com/buger/jsonparser-1.6.1

---

📝 Commits (1)

• e25bea5 chore(deps): bump github.com/buger/jsonparser from 1.3.0 to 1.6.1

📊 Changes

2 files changed (+3 additions, -3 deletions)

View changed files

📝 go.mod (+1 -1)
📝 go.sum (+2 -2)

📄 Description

Bumps github.com/buger/jsonparser from 1.3.0 to 1.6.1.

Release notes

Sourced from github.com/buger/jsonparser's releases.

v1.6.1 — Fastest across all payload sizes (now benchmarks vs gjson + sonic)

🔒 Covered by ReqProof — L3 Assurance (123 requirements, 0 errors, 0 warnings)

Performance — gjson-style fast-skip

Ported gjson's >'\\' single-comparison fast-skip to three hot loops. The trick skips all non-structural bytes (those > 0x5C) in one unsigned comparison per byte, reducing branch overhead.

Payload	Before	After	Change
Small (190B)	382 ns	339 ns	-11.3%
Medium (2.4kB)	3,899 ns	3,141 ns	-19.4%
Large (24kB)	20,788 ns	20,114 ns	-3.2%

Now benchmarks against gjson and sonic

Added tidwall/gjson (15.5k⭐) and bytedance/sonic (9.6k⭐) to the benchmark suite.

Large payload — the definitive ranking:

Library	time/op	allocs
jsonparser	20,114 ns	0
gjson	22,756 ns	2
easyjson	33,771 ns	134
sonic	41,053 ns	71
ffjson	59,063 ns	144
encoding/json	130,565 ns	147

jsonparser is the fastest across ALL payload sizes and the only zero-allocation parser.

Full changelog: CHANGELOG.md

v1.6.0 — Append function + zero open known issues

🔒 Covered by ReqProof — L3 Assurance (123 requirements, 0 errors, 0 warnings, 0 open known issues)

New API: Append

// Append to an array without knowing its length
data, _ = jsonparser.Append(data, []byte(`"new_item"`), "items")

Append(data, value, keys...) ([]byte, error) — clean array-append API. Works on top-level and nested arrays. Auto-creates missing paths as single-element arrays. No need for [N] path syntax.

Bug fixes — all known issues resolved

KI	Fix
KI-2	ParseInt("-") now returns MalformedValueError (was returning 0, nil)
KI-3	Disposition corrected to fixed (auto-coerce was implemented in v1.3.0)

... (truncated)

Changelog

Sourced from github.com/buger/jsonparser's changelog.

[v1.6.1] — 2026-07-29

Covered by ReqProof — L3 Assurance (123 requirements, 0 errors, 0 warnings)

Performance — gjson-style fast-skip in hot loops

Ported gjson's >'\\' fast-skip trick to three inner loops in parser.go: stringEndConfig tail, blockEndConfig, and searchKeysConfig. The trick uses a single unsigned comparison (byte > 0x5C) to skip all non-structural bytes in bulk, reducing per-byte branch overhead.

Payload	Before	After	Improvement
Small (190B)	382 ns	339 ns	-11.3%
Medium (2.4kB)	3,899 ns	3,141 ns	-19.4%
Large (24kB)	20,788 ns	20,114 ns	-3.2%

Zero allocations maintained on all paths.

Benchmarks — now includes gjson and sonic

Added tidwall/gjson (15.5k⭐, path-based parser like jsonparser) and bytedance/sonic (9.6k⭐, SIMD-accelerated deserializer) to the benchmark suite.

Final leaderboard (large payload):

Library	time/op	bytes/op	allocs/op
buger/jsonparser	20,114	0	0
tidwall/gjson	22,756	28,672	2
mailru/easyjson	33,771	4,016	134
bytedance/sonic	41,053	31,368	71
pquerna/ffjson	59,063	4,822	144
encoding/json	130,565	4,432	147

jsonparser is the fastest across all payload sizes and the only zero-allocation parser.

---

[v1.6.0] — 2026-07-29

Covered by ReqProof — L3 Assurance (123 requirements, 0 errors, 0 warnings)

New API — Append

// Append to an array without knowing its length
data, _ = jsonparser.Append(data, []byte(`"new_item"`), "items")

... (truncated)

Commits

• 5663ba4 v1.6.1: gjson-style fast-skip optimization + benchmarks vs gjson/sonic
• caa05b0 perf: gjson-style fast-skip in hot loops + benchmarks vs gjson/sonic
• f1c83ac docs: remove anniversary article from repo (private draft)
• 6c82735 docs: ten-year anniversary article with personal backstory and transitive deps
• 3005d5b v1.6.0: Append function + all KI fixes (zero open known issues)
• a55c29b v1.5.1: 6.1x large-payload speedup + fresh benchmarks
• 09dbcf6 perf: SWAR string scan in stringEndConfig (8% large-payload speedup)
• df5ae5b perf: bound stringEnd backslash scan to string body (5.8x large-payload speedup)
• ae21251 Add MC/DC witnesses for SYS-REQ-115 (Config) and SYS-REQ-116 (ReaderParser)
• dfb33c1 docs: complete CHANGELOG with v1.3.0–v1.5.0 entries, all mentioning ReqProof ...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/slurdge/goeland/pull/345 **Author:** [@dependabot[bot]](https://github.com/apps/dependabot) **Created:** 8/11/2026 **Status:** ✅ Merged **Merged:** 8/30/2026 **Merged by:** [@slurdge](https://github.com/slurdge) **Base:** `master` ← **Head:** `dependabot/go_modules/github.com/buger/jsonparser-1.6.1` --- ### 📝 Commits (1) - [`e25bea5`](https://github.com/slurdge/goeland/commit/e25bea57b9055d93ac8c798244187238eed8d4f8) chore(deps): bump github.com/buger/jsonparser from 1.3.0 to 1.6.1 ### 📊 Changes **2 files changed** (+3 additions, -3 deletions) <details> <summary>View changed files</summary> 📝 `go.mod` (+1 -1) 📝 `go.sum` (+2 -2) </details> ### 📄 Description Bumps [github.com/buger/jsonparser](https://github.com/buger/jsonparser) from 1.3.0 to 1.6.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/buger/jsonparser/releases">github.com/buger/jsonparser's releases</a>.</em></p> <blockquote> <h2>v1.6.1 — Fastest across all payload sizes (now benchmarks vs gjson + sonic)</h2> <h2>🔒 Covered by <a href="https://reqproof.com">ReqProof</a> — L3 Assurance (123 requirements, 0 errors, 0 warnings)</h2> <h2>Performance — gjson-style fast-skip</h2> <p>Ported gjson's <code>&gt;'\\'</code> single-comparison fast-skip to three hot loops. The trick skips all non-structural bytes (those &gt; 0x5C) in one unsigned comparison per byte, reducing branch overhead.</p> <table> <thead> <tr> <th>Payload</th> <th>Before</th> <th>After</th> <th>Change</th> </tr> </thead> <tbody> <tr> <td>Small (190B)</td> <td>382 ns</td> <td><strong>339 ns</strong></td> <td>-11.3%</td> </tr> <tr> <td>Medium (2.4kB)</td> <td>3,899 ns</td> <td><strong>3,141 ns</strong></td> <td>-19.4%</td> </tr> <tr> <td>Large (24kB)</td> <td>20,788 ns</td> <td><strong>20,114 ns</strong></td> <td>-3.2%</td> </tr> </tbody> </table> <h2>Now benchmarks against gjson and sonic</h2> <p>Added <a href="https://github.com/tidwall/gjson">tidwall/gjson</a> (15.5k⭐) and <a href="https://github.com/bytedance/sonic">bytedance/sonic</a> (9.6k⭐) to the benchmark suite.</p> <p><strong>Large payload — the definitive ranking:</strong></p> <table> <thead> <tr> <th>Library</th> <th>time/op</th> <th>allocs</th> </tr> </thead> <tbody> <tr> <td><strong>jsonparser</strong></td> <td><strong>20,114 ns</strong></td> <td><strong>0</strong></td> </tr> <tr> <td>gjson</td> <td>22,756 ns</td> <td>2</td> </tr> <tr> <td>easyjson</td> <td>33,771 ns</td> <td>134</td> </tr> <tr> <td>sonic</td> <td>41,053 ns</td> <td>71</td> </tr> <tr> <td>ffjson</td> <td>59,063 ns</td> <td>144</td> </tr> <tr> <td>encoding/json</td> <td>130,565 ns</td> <td>147</td> </tr> </tbody> </table> <p><strong>jsonparser is the fastest across ALL payload sizes</strong> and the <strong>only zero-allocation</strong> parser.</p> <p><strong>Full changelog:</strong> <a href="https://github.com/buger/jsonparser/blob/master/CHANGELOG.md">CHANGELOG.md</a></p> <h2>v1.6.0 — Append function + zero open known issues</h2> <h2>🔒 Covered by <a href="https://reqproof.com">ReqProof</a> — L3 Assurance (123 requirements, 0 errors, 0 warnings, <strong>0 open known issues</strong>)</h2> <h2>New API: <code>Append</code></h2> <pre lang="go"><code>// Append to an array without knowing its length data, _ = jsonparser.Append(data, []byte(`&quot;new_item&quot;`), &quot;items&quot;) </code></pre> <p><code>Append(data, value, keys...) ([]byte, error)</code> — clean array-append API. Works on top-level and nested arrays. Auto-creates missing paths as single-element arrays. No need for <code>[N]</code> path syntax.</p> <h2>Bug fixes — all known issues resolved</h2> <table> <thead> <tr> <th>KI</th> <th>Fix</th> </tr> </thead> <tbody> <tr> <td><strong>KI-2</strong></td> <td><code>ParseInt(&quot;-&quot;)</code> now returns <code>MalformedValueError</code> (was returning <code>0, nil</code>)</td> </tr> <tr> <td><strong>KI-3</strong></td> <td>Disposition corrected to <code>fixed</code> (auto-coerce was implemented in v1.3.0)</td> </tr> </tbody> </table> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/buger/jsonparser/blob/master/CHANGELOG.md">github.com/buger/jsonparser's changelog</a>.</em></p> <blockquote> <h2>[v1.6.1] — 2026-07-29</h2> <h3>Covered by <a href="https://reqproof.com">ReqProof</a> — L3 Assurance (123 requirements, 0 errors, 0 warnings)</h3> <h3>Performance — gjson-style fast-skip in hot loops</h3> <p>Ported gjson's <code>&gt;'\\'</code> fast-skip trick to three inner loops in parser.go: <code>stringEndConfig</code> tail, <code>blockEndConfig</code>, and <code>searchKeysConfig</code>. The trick uses a single unsigned comparison (<code>byte &gt; 0x5C</code>) to skip all non-structural bytes in bulk, reducing per-byte branch overhead.</p> <table> <thead> <tr> <th>Payload</th> <th>Before</th> <th>After</th> <th>Improvement</th> </tr> </thead> <tbody> <tr> <td>Small (190B)</td> <td>382 ns</td> <td><strong>339 ns</strong></td> <td>-11.3%</td> </tr> <tr> <td>Medium (2.4kB)</td> <td>3,899 ns</td> <td><strong>3,141 ns</strong></td> <td>-19.4%</td> </tr> <tr> <td>Large (24kB)</td> <td>20,788 ns</td> <td><strong>20,114 ns</strong></td> <td>-3.2%</td> </tr> </tbody> </table> <p>Zero allocations maintained on all paths.</p> <h3>Benchmarks — now includes gjson and sonic</h3> <p>Added <a href="https://github.com/tidwall/gjson">tidwall/gjson</a> (15.5k⭐, path-based parser like jsonparser) and <a href="https://github.com/bytedance/sonic">bytedance/sonic</a> (9.6k⭐, SIMD-accelerated deserializer) to the benchmark suite.</p> <p><strong>Final leaderboard (large payload):</strong></p> <table> <thead> <tr> <th>Library</th> <th>time/op</th> <th>bytes/op</th> <th>allocs/op</th> </tr> </thead> <tbody> <tr> <td><strong>buger/jsonparser</strong></td> <td><strong>20,114</strong></td> <td><strong>0</strong></td> <td><strong>0</strong></td> </tr> <tr> <td>tidwall/gjson</td> <td>22,756</td> <td>28,672</td> <td>2</td> </tr> <tr> <td>mailru/easyjson</td> <td>33,771</td> <td>4,016</td> <td>134</td> </tr> <tr> <td>bytedance/sonic</td> <td>41,053</td> <td>31,368</td> <td>71</td> </tr> <tr> <td>pquerna/ffjson</td> <td>59,063</td> <td>4,822</td> <td>144</td> </tr> <tr> <td>encoding/json</td> <td>130,565</td> <td>4,432</td> <td>147</td> </tr> </tbody> </table> <p>jsonparser is <strong>the fastest across all payload sizes</strong> and the <strong>only zero-allocation</strong> parser.</p> <hr /> <h2>[v1.6.0] — 2026-07-29</h2> <h3>Covered by <a href="https://reqproof.com">ReqProof</a> — L3 Assurance (123 requirements, 0 errors, 0 warnings)</h3> <h3>New API — <code>Append</code></h3> <pre lang="go"><code>// Append to an array without knowing its length data, _ = jsonparser.Append(data, []byte(`&quot;new_item&quot;`), &quot;items&quot;) </code></pre> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/buger/jsonparser/commit/5663ba4b4f9836695ac8a47d213dd3052583abf9"><code>5663ba4</code></a> v1.6.1: gjson-style fast-skip optimization + benchmarks vs gjson/sonic</li> <li><a href="https://github.com/buger/jsonparser/commit/caa05b0567137647ca800a5ffc06c913bb05f42c"><code>caa05b0</code></a> perf: gjson-style fast-skip in hot loops + benchmarks vs gjson/sonic</li> <li><a href="https://github.com/buger/jsonparser/commit/f1c83acd07bbbfac69029dd42f71c41f7de19a36"><code>f1c83ac</code></a> docs: remove anniversary article from repo (private draft)</li> <li><a href="https://github.com/buger/jsonparser/commit/6c827359596f991ceb55d6f6dec188a42f04af51"><code>6c82735</code></a> docs: ten-year anniversary article with personal backstory and transitive deps</li> <li><a href="https://github.com/buger/jsonparser/commit/3005d5bc2717f808d39e03e86a9f59f39de7b7a0"><code>3005d5b</code></a> v1.6.0: Append function + all KI fixes (zero open known issues)</li> <li><a href="https://github.com/buger/jsonparser/commit/a55c29b45b8aa7818eeb9fd0cd7cc140f218bdfb"><code>a55c29b</code></a> v1.5.1: 6.1x large-payload speedup + fresh benchmarks</li> <li><a href="https://github.com/buger/jsonparser/commit/09dbcf6136af4cc9ef22972a5b8da0c1f1bf01cf"><code>09dbcf6</code></a> perf: SWAR string scan in stringEndConfig (8% large-payload speedup)</li> <li><a href="https://github.com/buger/jsonparser/commit/df5ae5b62a13367fcc0e900c26f4f6b10dc94c0b"><code>df5ae5b</code></a> perf: bound stringEnd backslash scan to string body (5.8x large-payload speedup)</li> <li><a href="https://github.com/buger/jsonparser/commit/ae21251eac63367a45286570eeb796daf79cdf8e"><code>ae21251</code></a> Add MC/DC witnesses for SYS-REQ-115 (Config) and SYS-REQ-116 (ReaderParser)</li> <li><a href="https://github.com/buger/jsonparser/commit/dfb33c140ea251df4824d47ffdeec828ae839a8c"><code>dfb33c1</code></a> docs: complete CHANGELOG with v1.3.0–v1.5.0 entries, all mentioning ReqProof ...</li> <li>Additional commits viewable in <a href="https://github.com/buger/jsonparser/compare/v1.3.0...v1.6.1">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> --- _{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

slurdge 2026-09-29 13:01:27 +00:00

• closed this issue
• added the
  pull-request
  label

Sign in to join this conversation.

No Branch/Tag specified

Branches Tags

master

dependabot/github_actions/codeql-073aea62d7

dependabot/go_modules/github.com/xhit/go-simple-mail/v2-2.17.0

dependabot/go_modules/github.com/spf13/pflag-1.1.0

release-please--branches--master

dependabot/github_actions/actions/setup-python-7.1.0

dependabot/go_modules/github.com/tdewolff/minify/v2-2.24.24

dependabot/github_actions/docker/login-action-4.7.0

dependabot/go_modules/golang.org/x/text-0.43.0

dependabot/github_actions/actions/upload-artifact-7.0.2

dependabot/go_modules/github.com/vanng822/go-premailer-1.37.0

dependabot/github_actions/codeql-9b5af80777

fix-codeql-1

fix-namebar-in-workflow

fix-platforms

meta-info-docker

allow_insecure_feeds

fix_cycles_in_merge

fix-lint

css

v0.29.2

v0.29.1

v0.29.0

v0.28.0

v0.27.0

v0.26.0

v0.25.0

v0.24.0

v0.23.0

v0.22.1

v0.22.0

v0.21.0

v0.20.1

v0.20.0

v0.19.0

v0.18.3

v0.18.2

v0.18.1

v0.18.0

v0.17.0

v0.16.0

v0.15.0

v0.14.0

v0.13.0

v0.12.3

v0.12.2

v0.12.1

v0.12.0

v0.11.0

v0.10.3

v0.10.2

v0.10.1

v0.10.0

v0.9.0

v0.8.1

v0.8.0

v0.7.0

v0.6.1

v0.6.0

v0.5.3

v0.5.2

v0.5.1

v0.5.0

v0.4.4

v0.4.3

v0.4.2

v0.4.1

v0.4.0

v0.3.2

v0.3.1

v0.3.0

v0.2.0

v0.1.4

untagged-ce5ec77ff456ab7a0739

v0.1.3

Labels

Clear labels   

bug

  

duplicate

  

enhancement

  

go

  

good first issue

  

hacktoberfest

  

pull-request

Mirrored from GitHub Pull Request

No labels

bug

duplicate

enhancement

go

good first issue

hacktoberfest

pull-request

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: slurdge/goeland#339

No description provided.