pypi / ujson
ujson
What changed in ujson 5 to 6, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-24.
4 breaking4 security2 behavior and defaults2 tooling3 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli initujson 64 changes
Breaking changes 2
Bytes-like support is limited to bytes and bytearray, so other bytes-like types are no longer supported.
UTF-8 validation is tighter when loading strings from bytes.
Behavior and default changes 1
The default handler can now handle bytes.
Fixes and other changes 1
Fixes a memory leak when the default handler returns non-serialisable objects until its recursion limit is hit.
ujson 511 changes
Breaking changes 2
UTF-8 validation is stricter when dumping bytes with reject_bytes=False.
Pre-built wheels for GraalPy on macOS are omitted from this release due to infrastructure issues building them.
Security 4
UltraJSON: Malformed/Truncated UTF-8 Accepted and Silently Rewritten in ujson.dumps()
UltraJSON has a Memory Leak in ujson.dump() on Write Failure
UltraJSON has a Memory Leak parsing large integers allows DoS
UltraJSON has an integer overflow handling large indent leads to buffer overflow or infinite loop
Behavior and default changes 1
The global interpreter lock is disabled for freethreading.
Tooling 2
Building GraalPy wheels on macOS arm64 is enabled again.
Wheels are now created for manylinux2014, expanding the available Linux wheel builds.
Fixes and other changes 2
ujson now supports Python 3.15.
Fixed an encoding reference leak involving non-English characters.