fix(deps): update module github.com/buger/jsonparser to v1.5.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/buger/jsonparser	v1.3.0 → v1.5.0

---

Release Notes

buger/jsonparser (github.com/buger/jsonparser)

v1.5.0

Compare Source

Covered by ReqProof — L3 Assurance

v1.5.0 extends the formal-verification coverage to 123 requirements (0 errors, 0 warnings) across all new APIs. Every new function is traced via source annotations, tested with MC/DC witnesses, and covered by the structure-aware fuzzer.

Config struct — opt-in lenient parsing (#​160, #​115)

var Lenient = jsonparser.Config{AllowSingleQuotes: true, AllowUnknownEscapes: true}
Lenient.Get(data, "key")  // parses {'key':'value'} and unknown escapes

• AllowSingleQuotes — accept 'key':'value' alongside "key":"value" (JavaScript/Python-style). The same escape rules apply inside single-quoted strings.
• AllowUnknownEscapes — pass through unknown escape sequences (\`, \x) literally instead of erroring.
• The default Config is strict (RFC 8259 only). Package-level functions are unchanged.
• Config methods mirror the full API: Get, GetString, Set, Delete, ArrayEach, ObjectEach.

Streaming ReaderParser (#​132, #​257)

rp := jsonparser.NewReaderParser(file)  // any io.Reader
rp.Get("users", "[0]", "name")          // path-based access from a stream

• Path-based access to JSON data from an io.Reader — no need to load the entire document into memory.
• Buffers data incrementally in 64KB chunks; memory is bounded by the largest value, not the document size.
• Enables parsing 10GB+ JSON files without OOM.
• Methods: Get, GetString, ArrayEach.

Name aliases (#​66)

Canonical EachXxx pattern added alongside existing XxxEach names:

New (canonical)	Old (kept for compat)
EachArray	ArrayEach
EachObject	ObjectEach
EachArrayErr	ArrayEachErr
EachArrayWildcard	ArrayEachWildcard

EachKey, EachKeyErr, EachKeyWildcard already matched the pattern. All old names remain functional.

Proof

• 2 new SYS-REQs: 115 (Config/lenient parsing), 116 (streaming ReaderParser)
• 123 requirements, 0 errors, 0 warnings, 279/279 functions traced

---

v1.4.0: — 9 new APIs, 20 issues resolved

Compare Source

New APIs (all backward-compatible)

Iteration with error/break control

• ArrayEachErr — like ArrayEach but the callback returns error. Return io.EOF for graceful stop, any other error to abort. Resolves #​53, #​129, #​176, #​230, #​255, #​262.
• EachKeyErr — same pattern for EachKey.

Safe string handling

• Escape(s string) []byte — RFC 8259 string escaping (inverse of Unescape). Produces a quoted JSON string literal.
• SetString(data, val, keys...) — Set with auto-quoted value. No more invalid JSON from forgetting quotes. Resolves #​144, #​158, #​218, #​270.

Container accessors

• GetArrayLen(data, keys...) (int, error) — count array elements without a callback. Resolves #​175, #​261.
• GetObjectLen(data, keys...) (int, error) — count object key-value pairs.
• GetUint64(data, keys...) (uint64, error) — uint64 variant of GetInt. Resolves #​271.

Delete found signal

• DeleteFound(data, keys...) ([]byte, bool) — returns whether the key was found. Resolves #​229.

Wildcard paths

• EachKeyWildcard, ArrayEachWildcard, SetWildcard — [*] path component to iterate/set all elements. Resolves #​112.

  jsonparser.SetWildcard(data, []byte("true"), "users", "[*]", "active")

JSONPath compiled paths

• ParsePath("$.users[0].name") → []string{"users", "[0]", "name"}
• CompilePath + CompiledPath — pre-compile and reuse with Get/Set/Delete/etc. Resolves #​234, #​251.

  path, _ := jsonparser.CompilePath("$.person.name.fullName")
  name, _ := path.Get(data)  // reuse across calls

Fixes

• EachKey no longer panics with >64 key components (#​56)
• Set pre-allocates output buffer, reducing allocations from 6 to 1 (#​107)

Proof coverage

• 3 new SYS-REQs (112: container length, 113: wildcard paths, 114: compiled paths)
• 121 total requirements, 0 errors, 0 warnings, 384 MC/DC witness rows (0 uncovered)
• All new APIs traced via source-native annotations

Acknowledgments

Implemented by codex (gpt-5-codex) via codex exec. Proof coverage by ReqProof.

Full changelog: CHANGELOG.md

v1.3.1: — Bug fixes + proof strengthening

Compare Source

Bug fixes

• Fix Set/Delete input-buffer aliasing (#​209, #​141) — Set and Delete no longer corrupt the caller's input []byte when the slice has spare capacity. The append() call path was writing into the backing array beyond the returned slice. Now all mutation paths allocate a fresh buffer.

• Fix EachKey array-index inconsistency (#​232) — EachKey now descends into terminal array-index paths (e.g. "key", "[0]") consistently with Get. Previously EachKey returned empty where Get succeeded on the same path.

• Fix benchmark measuring ffjson, not encoding/json (#​126) — the benchmark payload types had ffjson-generated MarshalJSON/UnmarshalJSON methods, so the "10x faster than encoding/json" comparison was silently measuring ffjson. Now uses plain types with no generated methods.

Proof strengthening (how these bugs escaped, and the gates that prevent recurrence)

Bug	Proof gap	New gate
#​209/#​141 Set aliasing	No obligation said "Set must not mutate the input buffer"	New obligation no_input_mutation + assertInputUnchanged gate (snapshots input + backing-array capacity before every Set/Delete, verifies unchanged after)
#​232 EachKey ≠ Get	No obligation said "EachKey must resolve paths identically to Get"	New obligation api_consistency + TestApiConsistencyEachKeyMatchesGet gate (random JSON + paths, asserts EachKey result == Get result)
#​126 benchmark ffjson	Proof didn't cover the benchmark suite	Benchmark honesty lint: verifies no benchmark type implements json.Marshaler/json.Unmarshaler

Contributed by codex (gpt-5-codex) via codex exec.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

➡️ Go test coverage stayed the same at 83.0% compared to c9e2eac

No change in coverage for any package.

View coverage for all packages

# Package Name                       | Coverage
+ github.com/Depado/gin-auth-example |    83.0%