# What changed in ujson

> 15 changes in ujson 5 to 6 from its official release notes, upgrade guides and advisories: 4 breaking, 4 security. Each one cited. Sources checked 2026-10-24. HTML: https://unstale.sh/pypi/ujson/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## ujson 6

### Breaking changes

- Bytes-like support is limited to bytes and bytearray, so other bytes-like types are no longer supported. (6.0.0) — [release notes](https://github.com/ultrajson/ultrajson/releases/tag/6.0.0)
- UTF-8 validation is tighter when loading strings from bytes. (6.0.0) — [release notes](https://github.com/ultrajson/ultrajson/releases/tag/6.0.0)

### Behavior and default changes

- The default handler can now handle bytes. (6.0.0) — [release notes](https://github.com/ultrajson/ultrajson/releases/tag/6.0.0)

### Fixes and other changes

- Fixes a memory leak when the default handler returns non-serialisable objects until its recursion limit is hit. (6.0.0) — [release notes](https://github.com/ultrajson/ultrajson/releases/tag/6.0.0)

## ujson 5

### Breaking changes

- UTF-8 validation is stricter when dumping bytes with reject_bytes=False. (5.13.0) — [release notes](https://github.com/ultrajson/ultrajson/releases/tag/5.13.0)
- Pre-built wheels for GraalPy on macOS are omitted from this release due to infrastructure issues building them. (5.12.1) — [release notes](https://github.com/ultrajson/ultrajson/releases/tag/5.12.1)

### Security

- UltraJSON: Malformed/Truncated UTF-8 Accepted and Silently Rewritten in ujson.dumps() (5.13.0) — [security advisory](https://github.com/advisories/GHSA-3J69-69WJ-XQX2)
- UltraJSON has a Memory Leak in ujson.dump() on Write Failure (5.12.1) — [security advisory](https://github.com/advisories/GHSA-C38F-WX89-P2XG), [release notes](https://github.com/ultrajson/ultrajson/releases/tag/5.12.1)
- UltraJSON has a Memory Leak parsing large integers allows DoS (5.12.0) — [security advisory](https://github.com/advisories/GHSA-WGVC-GHV9-3PMM)
- UltraJSON has an integer overflow handling large indent leads to buffer overflow or infinite loop (5.12.0) — [security advisory](https://github.com/advisories/GHSA-C8RR-9GXC-JPRV)

### Behavior and default changes

- The global interpreter lock is disabled for freethreading. (5.13.0) — [release notes](https://github.com/ultrajson/ultrajson/releases/tag/5.13.0)

### Tooling

- Building GraalPy wheels on macOS arm64 is enabled again. (5.13.0) — [release notes](https://github.com/ultrajson/ultrajson/releases/tag/5.13.0)
- Wheels are now created for manylinux2014, expanding the available Linux wheel builds. (5.13.0) — [release notes](https://github.com/ultrajson/ultrajson/releases/tag/5.13.0)

### Fixes and other changes

- ujson now supports Python 3.15. (5.13.0) — [release notes](https://github.com/ultrajson/ultrajson/releases/tag/5.13.0)
- Fixed an encoding reference leak involving non-English characters. (5.12.1) — [release notes](https://github.com/ultrajson/ultrajson/releases/tag/5.12.1)