Fail-closed json/plain Oj deserialize (SECBUGS-174) - #359

Open

d2army wants to merge 6 commits into

transfers-masterfrom

ian-yap/secbugs-174-fail-closed-json-plain

Commits on Aug 27, 2026

Fail-closed json/plain deserialize against Oj object-mode gadgets.

d2army
and
cursoragent
committed
d53bd57
Pin protobuf 3 in CI and use docker compose v2.

d2army
and
cursoragent
committed
c0ac7e9
Wait for Temporal on 7233 before example namespace registration.

d2army
and
cursoragent
committed
ad7f477
Pin example Temporal images so CI can actually reach 7233.

d2army
and
cursoragent
committed
9f2d8f3
Allow Temporal library types and anonymous Structs through json/plain.

d2army
and
cursoragent
committed
9d4f61e
Allow Thread::Backtrace through json/plain so raised errors round-trip.

d2army
and
cursoragent
committed
441d590