hermes-json 0.8.1.0 → 0.8.2.0

raw patch · 2 files changed

+10/−3 lines, 2 filesdep ~aesondep ~text-iso8601PVP ok

version bump matches the API change (PVP)

Dependency ranges changed: aeson, text-iso8601

API changes (from Hackage documentation)

Files

• CHANGELOG.md +7/−0
• hermes-json.cabal +3/−3

@@ -1,5 +1,12 @@ # Revision history for hermes-json +## 0.8.2.0 -- 2026-08-30++### Changed+* Require `text-iso8601 >= 0.2` to address HSEC-2026-0007, a denial of service+  via memory exhaustion. The test suite and benchmarks now also require+  `aeson >= 2.3.0.0`, which carries the fix for the same advisory.+ ## 0.8.1.0 -- 2026-08-30  ### Changed

@@ -1,6 +1,6 @@ cabal-version:      3.0 name:               hermes-json-version:            0.8.1.0+version:            0.8.2.0 category:           Text, Web, JSON, FFI synopsis:           Fast JSON decoding via simdjson C++ bindings description:@@ -67,7 +67,7 @@     primitive          >= 0.7.0 && < 0.10,     scientific         >= 0.3.6 && < 0.4,     text               >= 2.0 && < 2.2,-    text-iso8601       >= 0.1 && < 0.2,+    text-iso8601       >= 0.2 && < 0.3,     transformers       >= 0.5.6 && < 0.7,     time               >= 1.9.3 && < 1.16,     time-compat        >= 1.9.5 && < 1.10,@@ -123,7 +123,7 @@   main-is:          test.hs   ghc-options: -Wall   build-depends:-    aeson          >= 2.0.1 && < 2.3,+    aeson          >= 2.3.0.0 && < 2.4,     base,     bytestring,     containers     >= 0.6.2 && < 0.9,