Bump github.com/buger/jsonparser from 1.2.0 to 1.5.0

[dependabot]

Bumps github.com/buger/jsonparser from 1.2.0 to 1.5.0.

Release notes

Sourced from github.com/buger/jsonparser's releases.

v1.5.0 — Config (lenient parsing), streaming ReaderParser, name aliases

🔒 Covered by ReqProof — L3 Assurance (123 requirements, 0 errors, 0 warnings)

Config struct — opt-in lenient parsing (#160, #115)

var Lenient = jsonparser.Config{AllowSingleQuotes: true, AllowUnknownEscapes: true}
Lenient.Get(data, "key")  // parses {'key':'value'} and unknown escapes

Single-quote support and lenient escape handling via an opt-in Config. Default stays strict (RFC 8259).

Streaming ReaderParser (#132, #257)

rp := jsonparser.NewReaderParser(file)  // any io.Reader
rp.Get("users", "[0]", "name")          // path-based access from a stream

Path-based JSON access from an io.Reader — parse 10GB+ files without loading into memory. Buffers in 64KB chunks; memory bounded by the largest value.

Name aliases (#66)

EachArray, EachObject, EachArrayErr, EachArrayWildcard — canonical EachXxx pattern. Old XxxEach names kept for backward compatibility.

Proof coverage

• 2 new SYS-REQs (115: Config/lenient, 116: streaming)
• 123 requirements, 0 errors, 0 warnings, 279/279 functions traced

Full changelog: CHANGELOG.md

v1.4.0 — 9 new APIs, 20 issues resolved

New APIs (all backward-compatible)

Iteration with error/break control

• ArrayEachErr — like ArrayEach but the callback returns error. Return io.EOF for graceful stop, any other error to abort. Resolves #53, #129, #176, #230, #255, #262.
• EachKeyErr — same pattern for EachKey.

Safe string handling

• Escape(s string) []byte — RFC 8259 string escaping (inverse of Unescape). Produces a quoted JSON string literal.
• SetString(data, val, keys...) — Set with auto-quoted value. No more invalid JSON from forgetting quotes. Resolves #144, #158, #218, #270.

Container accessors

• GetArrayLen(data, keys...) (int, error) — count array elements without a callback. Resolves #175, #261.
• GetObjectLen(data, keys...) (int, error) — count object key-value pairs.
• GetUint64(data, keys...) (uint64, error) — uint64 variant of GetInt. Resolves #271.

Delete found signal

• DeleteFound(data, keys...) ([]byte, bool) — returns whether the key was found. Resolves #229.

... (truncated)

Changelog

Sourced from github.com/buger/jsonparser's changelog.

[v1.5.0] — 2026-07-28

Covered by ReqProof — L3 Assurance

v1.5.0 extends the formal-verification coverage to 123 requirements (0 errors, 0 warnings) across all new APIs. Every new function is traced via source annotations, tested with MC/DC witnesses, and covered by the structure-aware fuzzer.

Config struct — opt-in lenient parsing (#160, #115)

var Lenient = jsonparser.Config{AllowSingleQuotes: true, AllowUnknownEscapes: true}
Lenient.Get(data, "key")  // parses {'key':'value'} and unknown escapes

• AllowSingleQuotes — accept 'key':'value' alongside "key":"value" (JavaScript/Python-style). The same escape rules apply inside single-quoted strings.
• AllowUnknownEscapes — pass through unknown escape sequences (\`, \x) literally instead of erroring.
• The default Config is strict (RFC 8259 only). Package-level functions are unchanged.
• Config methods mirror the full API: Get, GetString, Set, Delete, ArrayEach, ObjectEach.

Streaming ReaderParser (#132, #257)

rp := jsonparser.NewReaderParser(file)  // any io.Reader
rp.Get("users", "[0]", "name")          // path-based access from a stream

• Path-based access to JSON data from an io.Reader — no need to load the entire document into memory.
• Buffers data incrementally in 64KB chunks; memory is bounded by the largest value, not the document size.
• Enables parsing 10GB+ JSON files without OOM.
• Methods: Get, GetString, ArrayEach.

Name aliases (#66)

Canonical EachXxx pattern added alongside existing XxxEach names:

New (canonical)	Old (kept for compat)
EachArray	ArrayEach
EachObject	ObjectEach
EachArrayErr	ArrayEachErr
EachArrayWildcard	ArrayEachWildcard

EachKey, EachKeyErr, EachKeyWildcard already matched the pattern. All old names remain functional.

Proof

• 2 new SYS-REQs: 115 (Config/lenient parsing), 116 (streaming ReaderParser)
• 123 requirements, 0 errors, 0 warnings, 279/279 functions traced

---

... (truncated)

Commits

• dfb33c1 docs: complete CHANGELOG with v1.3.0–v1.5.0 entries, all mentioning ReqProof ...
• 6955fbe v1.5.0: Config (single quotes + lenient escapes), streaming ReaderParser, nam...
• ebb4a3a fix: remove duplicate fmt import (#263), update Dockerfile to Go 1.25 (#268)
• f6ddf26 v1.4.0: ArrayEachErr, Escape/SetString, wildcards, JSONPath, GetArrayLen, Get...
• eb9c252 v1.3.1: fix Set aliasing (#209/#141), EachKey array-index (#232), benchmark f...
• a9004e7 docs: add proof coverage to README + CHANGELOG for v1.3.0
• 1723912 Merge pull request #287 from buger/fix-oss-fuzz-delete-leading-comma
• 858e2cd Merge PR #285 parseInt fast-path + align SYS-REQ-061/062 surrogate FRETish
• f0958b5 proof: L3 strict review — hazard sweeps, structure-aware fuzzer, 6 bug fixes,...
• f26958f Merge pull request #283 from buger/fix-oss-fuzz-delete-leading-comma
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)