build(deps): Bump com.alibaba.fastjson2:fastjson2 from 2.0.64.android8 to 2.0.65.android8

[dependabot]

Bumps com.alibaba.fastjson2:fastjson2 from 2.0.64.android8 to 2.0.65.android8.

Release notes

Sourced from com.alibaba.fastjson2:fastjson2's releases.

fastjson 2.0.65版本发布

FASTJSON 2.0.65 Release Notes

Release Date: 2 Sep 2026 Tag: 2.0.65 (879183e94)

Overview

This is a security fix release. It closes an AutoType authorization bypass reachable when JSONReader.Feature.SupportAutoType is enabled, and includes parser/writer robustness fixes. All users are strongly recommended to upgrade, especially applications that parse untrusted JSON or JSONB with AutoType enabled.

This release also restores fastjson2-extension-spring6 on Maven Central. It was missing for 2.0.62–2.0.64 because those releases were deployed with a JDK that did not activate the enable-for-17+ build profile, so the module never entered the build reactor #7840.

The Android variants 2.0.65.android5 and 2.0.65.android8 carry the same AutoType security fix #7843 #7844.

Security Fixes

1. Unified AutoType authorization on the real type name: a reader-cache hit on the FNV-1a-64 hash of @type is no longer treated as authorization. All untrusted-input paths (JSON and JSONB readers, and the object readers for beans, interfaces, exceptions, adapters, typed maps, arrays, collections and no-default-constructor types) now resolve @type through the full provider security checks — SafeMode, deny lists, type-name validation, and any user-supplied AutoTypeBeforeHandler. Compatibility is preserved for explicit local mappings declared with @JSONType(seeAlso = ...) and for readers annotated with @JSONType(... SupportAutoType) #7753

Bug Fixes

2. Fixed ArrayIndexOutOfBoundsException in JSONReaderASCII field-name decoding, triggered by a field name that combines an escape sequence with latin1 bytes >= 0x80 #7808 #7836
3. Fixed getter methods being silently discarded when serializing char/Character fields, which caused NPEs or lost field values #7719
4. (kotlin) Fixed NullPointerException when serializing a Kotlin class without kotlin-reflect on the classpath #7835

Documentation

5. Switched the star-history charts to star-history.dera.page #7780

Maven Dependency Configuration

Standard Version

<dependency>
    <groupId>com.alibaba.fastjson2</groupId>
    <artifactId>fastjson2</artifactId>
    <version>2.0.65</version>
</dependency>

Spring 6 Extension

<dependency>
    <groupId>com.alibaba.fastjson2</groupId>
    <artifactId>fastjson2-extension-spring6</artifactId>
    <version>2.0.65</version>
</dependency>

Android 5 Optimized Version

</tr></table> 

... (truncated)

Commits

• 8355a57 Merge pull request #7843 from alibaba/port/2.0.65.android8
• c742225 2.0.65.android8: port fixes from main
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)