20260719 prep for next release

README.md

@@ -11,7 +11,7 @@ JSON in Java [package org.json]
 [![CodeQL](https://github.com/stleary/JSON-java/actions/workflows/codeql-analysis.yml/badge.svg)](https://github.com/stleary/JSON-java/actions/workflows/codeql-analysis.yml)
 [![javadoc](https://javadoc.io/badge2/org.json/json/javadoc.svg)](https://javadoc.io/doc/org.json/json)
 
-**[Click here if you just want the latest release jar file.](https://search.maven.org/remotecontent?filepath=org/json/json/20260522/json-20260522.jar)**
+**[Click here if you just want the latest release jar file.](https://search.maven.org/remotecontent?filepath=org/json/json/202607119/json-20260719.jar)**
 
 
 # Overview

build.gradle

@@ -42,7 +42,7 @@ subprojects {
 }
 
 group = 'org.json'
-version = 'v20260522-SNAPSHOT'
+version = 'v20260719-SNAPSHOT'
 description = 'JSON in Java'
 sourceCompatibility = '1.8'
 

docs/RELEASES.md

@@ -5,6 +5,8 @@ and artifactId "json". For example:
 [https://search.maven.org/search?q=g:org.json%20AND%20a:json&core=gav](https://search.maven.org/search?q=g:org.json%20AND%20a:json&core=gav)
 
 ~~~
+20260719    Fixes CVE-2026-59171 very large BigInteger, BigDecimal
+
 20260522    Publish key data, recent commits for minor fixes
 
 20251224    Records, fromJson(), and recent commits

pom.xml

@@ -3,7 +3,7 @@
 
     <groupId>org.json</groupId>
     <artifactId>json</artifactId>
-    <version>20260522</version>
+    <version>20260719</version>
     <packaging>bundle</packaging>
 
     <name>JSON in Java</name>

src/test/java/org/json/junit/JSONObjectTest.java

@@ -3885,6 +3885,7 @@ public void jsonObjectParseFromJson_9() {
 
 	@Test
 	public void testMaxNumberLength() {
+		JSONParserConfiguration jsonParserConfiguration = new JSONParserConfiguration();
 		StringBuilder sb = new StringBuilder();
 		for (int i = 0; i < 100; ++i) {
 			sb.append("9999999999");
@@ -3896,23 +3897,29 @@ public void testMaxNumberLength() {
 		// JSONArray with number just under the max length limit
 		checkJSONArrayMaxLen(sb.toString(), true, null);
 
-		// JSONObject with number just over the max length limit
-		checkJSONObjectMaxLen(sb + "9", false, null);
+		// numbers without quotes are not allowed in strict mode
+		if (!jsonParserConfiguration.isStrictMode()) {
+			// JSONObject with number just over the max length limit
+			checkJSONObjectMaxLen(sb + "9", false, null);
 
-		// JSONArray with number just over the max length limit
-		checkJSONArrayMaxLen(sb + "9", false, null);
+			// JSONArray with number just over the max length limit
+			checkJSONArrayMaxLen(sb + "9", false, null);
+		}
 
 		// JSONObject with number at config max length limit
 		checkJSONObjectMaxLen(sb.toString() + sb.toString(), true, new JSONParserConfiguration().withMaxNumberLength(2000));
 
 		// JSONArray with number at config max length limit
 		checkJSONArrayMaxLen((sb.toString() + sb), true, new JSONParserConfiguration().withMaxNumberLength(2000));
 
-		// JSONObject with number just over config max length limit
-		checkJSONObjectMaxLen(sb.toString() + sb.toString() + "9", false, new JSONParserConfiguration().withMaxNumberLength(2000));
+		// numbers without quotes are not allowed in strict mode
+		if (!jsonParserConfiguration.isStrictMode()) {
+			// JSONObject with number just over config max length limit
+			checkJSONObjectMaxLen(sb.toString() + sb.toString() + "9", false, new JSONParserConfiguration().withMaxNumberLength(2000));
 
-		// JSONArray with number just over config max length limit
-		checkJSONArrayMaxLen((sb.toString() + sb + "9"), false, new JSONParserConfiguration().withMaxNumberLength(2000));
+			// JSONArray with number just over config max length limit
+			checkJSONArrayMaxLen((sb.toString() + sb + "9"), false, new JSONParserConfiguration().withMaxNumberLength(2000));
+		}
 
 		// JSONObject with large number, no checks
 		checkJSONObjectMaxLen(sb.toString() + sb.toString() + "9", true,
@@ -3975,6 +3982,8 @@ private static void checkJSONArrayMaxLen(String s, boolean isValid, JSONParserCo
 	 */
 	@Test
 	public void testMaxNumberLengthNegativeInteger() {
+		JSONParserConfiguration jsonParserConfiguration = new JSONParserConfiguration();
+
 		// Build a negative number string of exactly 1000 chars: "-" + 999 digits
 		StringBuilder sb = new StringBuilder("-");
 		for (int i = 0; i < 999; ++i) {
@@ -3985,17 +3994,22 @@ public void testMaxNumberLengthNegativeInteger() {
 		// at max length: parsed as number
 		checkJSONObjectMaxLen(sb.toString(), true, null);
 
-		// over max length: returned as string
-		sb.append("1");
-		assertEquals(1001, sb.length());
-		checkJSONObjectMaxLen(sb.toString(), false, null);
+		// numbers without quotes are not allowed in strict mode
+		if (!jsonParserConfiguration.isStrictMode()) {
+			// over max length: returned as string
+			sb.append("1");
+			assertEquals(1001, sb.length());
+			checkJSONObjectMaxLen(sb.toString(), false, null);
+		}
 	}
 
 	/**
 	 * Test max number length for decimal notation strings via stringToValue.
 	 */
 	@Test
 	public void testMaxNumberLengthDecimal() {
+		JSONParserConfiguration jsonParserConfiguration = new JSONParserConfiguration();
+
 		// Build a decimal number string of exactly 1000 chars: 499 digits + "." + 500
 		// digits
 		StringBuilder sb = new StringBuilder();
@@ -4011,17 +4025,22 @@ public void testMaxNumberLengthDecimal() {
 		// at max length: parsed as number (BigDecimal)
 		checkJSONObjectMaxLen(sb.toString(), true, null);
 
-		// over max length: returned as string
-		sb.append("3");
-		assertEquals(1001, sb.length());
-		checkJSONObjectMaxLen(sb.toString(), false, null);
+		// numbers without quotes are not allowed in strict mode
+		if (!jsonParserConfiguration.isStrictMode()) {
+			// over max length: returned as string
+			sb.append("3");
+			assertEquals(1001, sb.length());
+			checkJSONObjectMaxLen(sb.toString(), false, null);
+		}
 	}
 
 	/**
 	 * Test max number length with scientific notation via stringToValue.
 	 */
 	@Test
 	public void testMaxNumberLengthScientificNotation() {
+		JSONParserConfiguration jsonParserConfiguration = new JSONParserConfiguration();
+
 		// Build a scientific notation string of exactly 1000 chars
 		StringBuilder sb = new StringBuilder("1.");
 		for (int i = 0; i < 994; ++i) {
@@ -4038,9 +4057,13 @@ public void testMaxNumberLengthScientificNotation() {
 		for (int i = 0; i < 995; ++i) {
 			sb.append("0");
 		}
-		sb.append("e100");
-		assertEquals(1001, sb.length());
-		checkJSONObjectMaxLen(sb.toString(), false, null);
+
+		// numbers without quotes are not allowed in strict mode
+		if (!jsonParserConfiguration.isStrictMode()) {
+			sb.append("e100");
+			assertEquals(1001, sb.length());
+			checkJSONObjectMaxLen(sb.toString(), false, null);
+		}
 	}
 
 	/**
@@ -4297,17 +4320,21 @@ public void testStringToValueViaJSONObject() {
 	 */
 	@Test
 	public void testStringToNumberInvalidFormats() {
-		// Leading zero followed by digit → treated as string (not octal)
-		JSONObject jo = new JSONObject("{\"a\": 01}");
-		// JSONTokener with strict mode would reject, but default mode stores as string
-		// since stringToNumber throws NumberFormatException for "01"
-		Object val = jo.get("a");
-		assertTrue("01 should be stored as string, got " + val.getClass(), val instanceof String);
-
-		// Negative with leading zero → "-01"
-		jo = new JSONObject("{\"a\": -01}");
-		val = jo.get("a");
-		assertTrue("-01 should be stored as string, got " + val.getClass(), val instanceof String);
+		// this test should only run in non-strict mode, otherwise it will throw an exception
+		JSONParserConfiguration jsonParserConfiguration = new JSONParserConfiguration();
+		if (!jsonParserConfiguration.isStrictMode()) {
+			// Leading zero followed by digit → treated as string (not octal)
+			JSONObject jo = new JSONObject("{\"a\": 01}");
+			// JSONTokener with strict mode would reject, but default mode stores as string
+			// since stringToNumber throws NumberFormatException for "01"
+			Object val = jo.get("a");
+			assertTrue("01 should be stored as string, got " + val.getClass(), val instanceof String);
+
+			// Negative with leading zero → "-01"
+			jo = new JSONObject("{\"a\": -01}");
+			val = jo.get("a");
+			assertTrue("-01 should be stored as string, got " + val.getClass(), val instanceof String);
+		}
 	}
 
 }