chore(deps): update dependency orjson to v3.11.6 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
orjson (changelog)	==3.8.10 → ==3.11.6

---

orjson does not limit recursion for deeply nested JSON documents

CVE-2024-27454 / GHSA-pwr2-4v36-6qpr

More information

Details

orjson.loads in orjson before 3.9.15 does not limit recursion for deeply nested JSON documents.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://nvd.nist.gov/vuln/detail/CVE-2024-27454
• https://github.com/ijl/orjson/issues/458
• https://github.com/ijl/orjson/commit/b0e4d2c06ce06c6e63981bf0276e4b7c74e5845e
• https://github.com/ijl/orjson/blob/master/CHANGELOG.md#3915
• https://monicz.dev/CVE-2024-27454
• https://github.com/pypa/advisory-database/tree/main/vulns/orjson/PYSEC-2024-40.yaml
• https://github.com/advisories/GHSA-pwr2-4v36-6qpr

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

orjson does not limit recursion for deeply nested JSON documents

CVE-2025-67221 / GHSA-hx9q-6w63-j58v

More information

Details

The orjson.dumps function in orjson before 3.11.6 does not limit recursion for deeply nested JSON documents.

Severity

• CVSS Score: 7.7 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-67221
• https://github.com/ijl/orjson
• https://github.com/kpatsakis/orjson_vulnerability
• https://github.com/ijl/orjson/issues/620
• https://github.com/kpatsakis/CVE-2025-67221/issues/1
• https://github.com/ijl/orjson/commit/62bb185b70785ded49c79c26f8c9781f1e6fe370
• https://github.com/pypa/advisory-database/tree/main/vulns/orjson/PYSEC-2026-107.yaml
• https://github.com/advisories/GHSA-hx9q-6w63-j58v

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

ijl/orjson (orjson)

v3.11.6

Compare Source

Changed

• orjson now includes code licensed under the Mozilla Public License 2.0 (MPL-2.0).
• Drop support for Python 3.9.
• ABI compatibility with CPython 3.15 alpha 5.
• Build now depends on Rust 1.89 or later instead of 1.85.

Fixed

• Fix sporadic crash serializing deeply nested list of dict.

v3.11.5

Compare Source

Changed

• Show simple error message instead of traceback when attempting to
  build on unsupported Python versions.

v3.11.4

Compare Source

Changed

• ABI compatibility with CPython 3.15 alpha 1.
• Publish PyPI wheels for 3.14 and manylinux i686, manylinux arm7,
  manylinux ppc64le, manylinux s390x.
• Build now requires a C compiler.

v3.11.3

Compare Source

Fixed

• Fix PyPI project metadata when using maturin 1.9.2 or later.

v3.11.2

Compare Source

Fixed

• Fix build using Rust 1.89 on amd64.

Changed

• Build now depends on Rust 1.85 or later instead of 1.82.

v3.11.1

Compare Source

Changed

• Publish PyPI wheels for CPython 3.14.

Fixed

• Fix str on big-endian architectures. This was introduced in 3.11.0.

v3.11.0

Compare Source

Changed

• Use a deserialization buffer allocated per request instead of a shared
  buffer allocated on import.
• ABI compatibility with CPython 3.14 beta 4.

v3.10.18

Compare Source

Fixed

• Fix incorrect escaping of the vertical tabulation character. This was
  introduced in 3.10.17.

v3.10.17

Compare Source

Changed

• Publish PyPI Windows aarch64/arm64 wheels.
• ABI compatibility with CPython 3.14 alpha 7.
• Fix incompatibility running on Python 3.13 using WASM.

v3.10.16

Compare Source

Changed

• Improve performance of serialization on amd64 machines with AVX-512.
• ABI compatibility with CPython 3.14 alpha 6.
• Drop support for Python 3.8.
• Publish additional PyPI wheels for macOS that target only aarch64, macOS 15,
  and recent Python.

v3.10.15

Compare Source

Changed

• Publish PyPI manylinux aarch64 wheels built and tested on aarch64.
• Publish PyPI musllinux aarch64 and arm7l wheels built and tested on aarch64.
• Publish PyPI manylinux Python 3.13 wheels for i686, arm7l, ppc64le, and s390x.

v3.10.14

Compare Source

Changed

• Specify build system dependency on maturin>=1,<2 again.
• Allocate memory using PyMem_Malloc() and similar APIs for integration
  with pymalloc, mimalloc, and tracemalloc.
• Source distribution does not ship compressed test documents and relevant
  tests skip if fixtures are not present.
• Build now depends on Rust 1.82 or later instead of 1.72.

v3.10.13

Compare Source

Changed

• Fix compatibility with maturin introducing a breaking change in 1.8.0 and
  specify a fixed version of maturin. Projects relying on any previous version
  being buildable from source by end users (via PEP 517) must upgrade to at
  least this version.

v3.10.12

Compare Source

Changed

• Publish PyPI manylinux i686 wheels.
• Publish PyPI musllinux i686 and arm7l wheels.
• Publish PyPI macOS wheels for Python 3.10 or later built on macOS 15.
• Publish PyPI Windows wheels using trusted publishing.

v3.10.11

Compare Source

Changed

• Improve performance of UUIDs.
• Publish PyPI wheels with trusted publishing and PEP 740 attestations.
• Include text of licenses for vendored dependencies.

v3.10.10

Compare Source

Fixed

• Fix int serialization on s390x. This was introduced in 3.10.8.

Changed

• Publish aarch64 manylinux_2_17 wheel for 3.13 to PyPI.

v3.10.9

Compare Source

Fixed

• Fix int serialization on 32-bit Python 3.8, 3.9, 3.10. This was
  introduced in 3.10.8.

v3.10.8

Compare Source

Changed

• int serialization no longer chains OverflowError to the
  the __cause__ attribute of orjson.JSONEncodeError when range exceeded.
• Compatibility with CPython 3.14 alpha 1.
• Improve performance.

v3.10.7

Compare Source

Changed

• Improve performance of stable Rust amd64 builds.

v3.10.6

Compare Source

Changed

• Improve performance.

v3.10.5

Compare Source

Changed

• Improve performance.

v3.10.4

Compare Source

Changed

• Improve performance.

v3.10.3

Compare Source

Changed

• manylinux amd64 builds include runtime-detected AVX-512 str
  implementation.
• Tests now compatible with numpy v2.

v3.10.2

Compare Source

Fixed

• Fix crash serializing str introduced in 3.10.1.

Changed

• Improve performance.
• Drop support for arm7.

v3.10.1

Compare Source

Fixed

• Fix incorrect escaping of the vertical tabulation character. This was
  introduced in 3.10.17.

v3.10.0

Compare Source

Changed

• Support serializing numpy.float16 (numpy.half).
• sdist uses metadata 2.3 instead of 2.1.
• Improve Windows PyPI builds.

v3.9.15

Compare Source

Fixed

• Implement recursion limit of 1024 on orjson.loads().
• Use byte-exact read on str formatting SIMD path to avoid crash.

v3.9.14

Compare Source

Fixed

• Fix crash serializing str introduced in 3.9.11.

Changed

• Build now depends on Rust 1.72 or later.

v3.9.13

Compare Source

Fixed

• Serialization str escape uses only 128-bit SIMD.
• Fix compatibility with CPython 3.13 alpha 3.

Changed

• Publish musllinux_1_2 instead of musllinux_1_1 wheels.
• Serialization uses small integer optimization in CPython 3.12 or later.

v3.9.12

Compare Source

Changed

• Update benchmarks in README.

Fixed

• Minimal musllinux_1_1 build due to sporadic CI failure.

v3.9.11

Compare Source

Changed

• Improve performance of serializing. str is significantly faster. Documents
  using dict, list, and tuple are somewhat faster.

v3.9.10

Compare Source

Fixed

• Fix debug assert failure on 3.12 --profile=dev build.

v3.9.9

Compare Source

Changed

• orjson module metadata explicitly marks subinterpreters as not supported.

v3.9.8

Compare Source

Changed

• Improve performance.
• Drop support for Python 3.7.

v3.9.7

Compare Source

Fixed

• Fix crash in orjson.loads() due to non-reentrant handling of persistent
  buffer. This was introduced in 3.9.3.
• Handle some FFI removals in CPython 3.13.

v3.9.6

Compare Source

Fixed

• Fix numpy reference leak on unsupported array dtype.
• Fix numpy.datetime64 reference handling.

Changed

• Minor performance improvements.

v3.9.5

Compare Source

Fixed

• Remove futex from module import and initialization path.

v3.9.4

Compare Source

Fixed

• Fix hash builder using default values.
• Fix non-release builds of orjson copying large deserialization buffer
  from stack to heap. This was introduced in 3.9.3.

v3.9.3

Compare Source

Fixed

• Fix compatibility with CPython 3.12.

Changed

• Support i686/x86 32-bit Python installs on Windows.

v3.9.2

Compare Source

Fixed

• Fix the __cause__ exception on orjson.JSONEncodeError possibly being
  denormalized, i.e., of type str instead of Exception.

v3.9.1

Compare Source

Fixed

• Implement recursion limit of 1024 on orjson.loads().
• Use byte-exact read on str formatting SIMD path to avoid crash.

v3.9.0

Compare Source

Added

• orjson.Fragment includes already-serialized JSON in a document.

v3.8.14

Compare Source

Changed

• PyPI manylinux wheels are compiled for x86-64 instead of x86-64-v2.

v3.8.13

Compare Source

Changed

• Source distribution contains all source code required for an offline build.
• PyPI macOS wheels use a MACOSX_DEPLOYMENT_TARGET of 10.15 instead of 11.
• Build uses maturin v1.

v3.8.12

Compare Source

Changed

• Exceptions raised in default are now chained as the __cause__ attribute
  on orjson.JSONEncodeError.

v3.8.11

Compare Source

Changed

• orjson.loads() on an empty document has a specific error message.
• PyPI manylinux_2_28_x86_64 wheels are compiled for x86-64-v2.
• PyPI macOS wheels are only universal2 and compiled for
  x86-64-v2 and apple-m1.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.