Merge c048ec9faf4bfe02da004dce69471897933c3617 into e650904788e5ffd14118d7b78140df8fa2794687

3rd/msgpack/src/bindings.c

@@ -104,7 +104,9 @@ static bool mpack_write_dict_kv(py_Ref k, py_Ref v, void* ctx) {
     if(k->type != tp_str) return TypeError("msgpack: key must be strings");
     c11_sv sv = py_tosv(k);
     mpack_write_str(writer, sv.data, (size_t)sv.size);
-    return py_to_mpack(v, writer);
+    bool ok = py_to_mpack(v, writer);
+    if(!ok) mpack_write_nil(writer);
+    return ok;
 }
 
 static bool py_to_mpack(py_Ref object, mpack_writer_t* writer) {

docs/modules/json.md

@@ -5,6 +5,16 @@ label: json
 
 JSON serialization and deserialization module.
 
+This module is not safe. You may not want to use it with untrusted data.
+If you need a safe alternative, consider a 3rd-party library like `cjson`.
+
+You can override the json functions with:
+```c
+py_GlobalRef mod = py_getmodule("json");
+py_bindfunc(mod, "loads", _safe_json_loads);
+py_bindfunc(mod, "dumps", _safe_json_dumps);
+```
+
 #### Source code
 
 :::code source="../../include/typings/json.pyi" :::