Skip to content

yyjson dependency review

This note records the dependency review for yyjson.

Decision

yyjson is accepted as the strict JSON parser dependency behind the merovingian::canonicaljson adapter. Project C++ sources must include the project-owned adapter instead of including yyjson.h directly.

Why it is needed

Matrix event IDs, hashes, and signatures depend on deterministic JSON handling. Using yyjson avoids a project-local parser while still allowing Merovingian to copy parsed values into project-owned canonical JSON value types.

Security boundary

  • yyjson documents are freed through the C adapter before data leaves the parser implementation.
  • Parsed values are copied into Merovingian value objects before higher-level event, federation, or homeserver code sees them.
  • The adapter maps yyjson parse errors into stable project parse errors.
  • The pinned wrap exposes third-party headers as system includes to keep warning-as-error focused on project code.

Maintenance and platform posture

subprojects/yyjson.wrap pins yyjson 0.13.0. The build wrappers use Meson's forcefallback mode, so they always build the pinned wrap; a plain meson setup first tries a system yyjson and accepts it only at >=0.13.0, the pinned release. The floor moves with the pin because 0.13.0 fixes an uninitialised read and an integer truncation in number parsing, both reachable from untrusted canonical JSON input. The wrap is intentionally isolated to the canonical JSON module.

yyjson's own nesting limit (YYJSON_READER_DEPTH_LIMIT, new in 0.13.0) is left at its default of 0, which disables it; the adapter maps the matching YYJSON_READ_ERROR_DEPTH code to a parse error anyway. Nesting depth is enforced by the canonical JSON parser, which refuses a value nested more than 64 levels deep while copying it out of the yyjson document.

The extracted subprojects/yyjson/ checkout is generated by Meson from subprojects/yyjson.wrap and must not be committed as a gitlink or vendored tree. The committed package file under subprojects/packagefiles/yyjson/ provides the Meson build definition applied to the downloaded source.

License

yyjson is released under the MIT license (SPDX: MIT). It is compatible with Merovingian's GPL-3.0-or-later distribution and is built from the pinned Meson wrap.

Current limitations

  • Full Matrix conformance fixtures still need to expand around canonical JSON edge cases.