build: bump com.alibaba.fastjson2:fastjson2 from 2.0.62 to 2.0.63

[dependabot]

Bumps com.alibaba.fastjson2:fastjson2 from 2.0.62 to 2.0.63.

Release notes

Sourced from com.alibaba.fastjson2:fastjson2's releases.

fastjson 2.0.63版本发布

FASTJSON 2.0.63 Release Notes

Release Date: 29 Jul 2026 Tag: 2.0.63 (82eda3e)

Overview

This is a security fix release. It hardens AutoType deserialization and fixes several parser robustness issues (OOM / DoS) that can be triggered by crafted input. All users are strongly recommended to upgrade, especially applications parsing untrusted JSON or JSONB data.

Users who cannot upgrade immediately can mitigate the AutoType issue with -Dfastjson2.parser.safeMode=true (applications not using a custom AutoTypeBeforeHandler).

fastjson 1.x users: the same AutoType hardening is available in fastjson 1.2.84.

Security Fixes

1. Strengthened AutoType type name validation and whitelist verification: type names containing URL-special characters are rejected before reaching the class loader; the accept name text is verified after a whitelist hash match so a hash collision alone cannot whitelist a type; an accept prefix no longer covers ClassLoader/DataSource/RowSet gadget base types — only an accept entry naming the type in full is treated as an explicit opt-in #7703
2. Limited number literal digits to prevent BigInteger O(n²) DoS with crafted long number literals #7668 #7694
3. Fixed JSONB BC_BIGINT declared-length OOM from crafted payloads declaring a huge length #7669 #7696
4. Fixed JSONB BC_BINARY declared-length OOM #7669 #7705

Changes & Bug Fixes

5. Fixed missing reference detection for Collection elements (e.g. HashSet), duplicate elements now serialize as $ref when ReferenceDetection is on #7678 #7701
6. Fixed Metaspace leak caused by ObjectWriter created in the switch block of getObjectWriterInternal #7626 #7627
7. Fixed performance: hoisted getInt/setInt out of lambda to avoid per-call spin #7677 #7693
8. Added support for JSONCompiled records #7665
9. Added warning when a Kotlin class loses field values due to missing kotlin-reflect #7675

Maven Dependency Configuration

Standard Version

<dependency>
    <groupId>com.alibaba.fastjson2</groupId>
    <artifactId>fastjson2</artifactId>
    <version>2.0.63</version>
</dependency>

Android 5 Optimized Version

<dependency>
    <groupId>com.alibaba.fastjson2</groupId>
    <artifactId>fastjson2</artifactId>
    <version>2.0.63.android5</version>
</dependency>

Android 8 Optimized Version

... (truncated)

Commits

• 82eda3e 2.0.63 release (#7710)
• 01eab36 fix: detect references for Collection elements (e.g. HashSet) (#7678) (#7701)
• 373cbe7 fix: JSONB BC_BINARY declared-length OOM (#7669) (#7705)
• ec47e24 fix: strengthen autoType type name validation and whitelist verification (#7703)
• 33be4ad fix: hoist getInt/setInt out of lambda to avoid per-call spin (#7677) (#7693)
• 1357fdc fix: JSONB BC_BIGINT declared-length OOM (#7669) (#7696)
• d6f7de3 docs: 修正兼容模式升级说明中的中文错别字 (#7689)
• d7ad403 fix: limit number literal digits to prevent BigInteger O(n²) DoS (#7668) (#7694)
• f68fd88 fix: warn when Kotlin class loses field values due to missing kotlin-reflect ...
• 0679959 fix: cache ObjectWriter created in switch block of getObjectWriterInternal to...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

Test Results

747 tests  ±0   747 ✅ ±0   2m 57s ⏱️ -8s
107 suites ±0     0 💤 ±0 
107 files   ±0     0 ❌ ±0 

Results for commit 99a8a27. ± Comparison against base commit 50a6b5b.

♻️ This comment has been updated with latest results.

[delei]

Patch version upgrade, can be merged.