🔒 Formally verified by ReqProof

jsonparser v1.3.0 is the first Go library proven to L3 assurance by ReqProof — a git-native requirements-engineering and formal-verification platform. Every public API is traced to a formal requirement, every requirement is tested with 100% MC/DC coverage, and the entire parser is fuzzed by a custom structure-aware JSON fuzzer at 250k inputs/sec.

The proof review caught 7 real bugs that years of community use, OSS-Fuzz, and standard fuzzing had missed.

Read the root-cause analysis →

---

Security / bug fixes

• Fix Delete panic on malformed input with leading comma (OSS-Fuzz 4649128545288192)
• Fix empty-string key-component panics (8 sites) — reported by @c-tonneslan (#284)
• Fix Set data loss on scalar arrays (#267) — reported by @Solaris-star (#286)
• Fix Set malformed-JSON output on cross-type paths (auto-coerce)
• Fix Delete trailing-comma malformation
• Fix ArrayEach spurious callback on non-array root
• Fix lone-Unicode-surrogate mishandling in Unescape (now matches encoding/json)

Performance

• parseInt fast-path — 22–37% faster on short integers — @trevorprater (#285)
• stringEnd SIMD fast path — 12× faster on no-escape strings

Full changelog: CHANGELOG.md

Acknowledgments

Thank you to @c-tonneslan, @Solaris-star, @trevorprater, and OSS-Fuzz for the reports and contributions.