Bump simplejson from 3.20.2 to 4.0.1

[dependabot]

Bumps simplejson from 3.20.2 to 4.0.1.

Release notes

Sourced from simplejson's releases.

v4.0.1

What's Changed

• Exclude Pyodide wheels from PyPI uploads by @​etrepum in simplejson/simplejson#375

Full Changelog: simplejson/simplejson@v4.0.0...v4.0.1

v4.0.0

What's Changed

Version 4.0.0 released 2026-04-18

• simplejson 4 requires Python 2.7 or Python 3.8+. Older Python versions (2.5, 2.6, 3.0-3.7) are no longer supported. pip will not install simplejson 4 on unsupported versions.

• The C extension now uses heap types and per-module state instead of static types and global state. This is required for free-threading support and sub-interpreter isolation. The Python-level API is unchanged.

• Full support for Python 3.13+ free-threading (PEP 703). The C extension is now safe to use with the GIL disabled (python3.14t):

  • Converted all static types to heap types with per-module state
  • Added per-object critical sections to scanner and encoder
  • Added free-threading-safe dict operations for Python 3.13+
  • Unified per-module state management and templated parser simplejson/simplejson#363 simplejson/simplejson#364 simplejson/simplejson#365 simplejson/simplejson#367 simplejson/simplejson#369

• Numerous C extension memory safety fixes:

  • Fix use-after-free and leak in encoder ident handling
  • Fix NULL dereferences on OOM in module init and static string init
  • Fix reference leaks in dict encoder (skipkeys item, variable shadowing)
  • Fix member table copy-paste, exception clobbering, missing Py_VISIT
  • Fix error-as-truthy bugs in maybe_quote_bigint and is_raw_json
  • Fix iterable_as_array swallowing MemoryError and KeyboardInterrupt
  • Fix for_json and _asdict swallowing MemoryError, KeyboardInterrupt, and other non-AttributeError exceptions raised by user getattr simplejson/simplejson#355 simplejson/simplejson#356 simplejson/simplejson#357 simplejson/simplejson#358 simplejson/simplejson#359 simplejson/simplejson#360 simplejson/simplejson#373

... (truncated)

Changelog

Sourced from simplejson's changelog.

Version 4.0.1 released 2026-04-18

• Skip uploading Pyodide/wasm wheels to PyPI, which rejects them with "unsupported platform tag 'pyodide_2024_0_wasm32'". The wheels are still built in CI and preserved as workflow artifacts. simplejson/simplejson#375

Version 4.0.0 released 2026-04-18

• simplejson 4 requires Python 2.7 or Python 3.8+. Older Python versions (2.5, 2.6, 3.0-3.7) are no longer supported. pip will not install simplejson 4 on unsupported versions.

• The C extension now uses heap types and per-module state instead of static types and global state. This is required for free-threading support and sub-interpreter isolation. The Python-level API is unchanged.

• Full support for Python 3.13+ free-threading (PEP 703). The C extension is now safe to use with the GIL disabled (python3.14t):

  • Converted all static types to heap types with per-module state
  • Added per-object critical sections to scanner and encoder
  • Added free-threading-safe dict operations for Python 3.13+
  • Unified per-module state management and templated parser simplejson/simplejson#363 simplejson/simplejson#364 simplejson/simplejson#365 simplejson/simplejson#367 simplejson/simplejson#369

• Numerous C extension memory safety fixes:

  • Fix use-after-free and leak in encoder ident handling
  • Fix NULL dereferences on OOM in module init and static string init
  • Fix reference leaks in dict encoder (skipkeys item, variable shadowing)
  • Fix member table copy-paste, exception clobbering, missing Py_VISIT
  • Fix error-as-truthy bugs in maybe_quote_bigint and is_raw_json
  • Fix iterable_as_array swallowing MemoryError and KeyboardInterrupt
  • Fix for_json and _asdict swallowing MemoryError, KeyboardInterrupt, and other non-AttributeError exceptions raised by user getattr simplejson/simplejson#355 simplejson/simplejson#356 simplejson/simplejson#357 simplejson/simplejson#358 simplejson/simplejson#359 simplejson/simplejson#360 simplejson/simplejson#373

• C/Python parity fixes:

  • Fix C scanstring off-by-one bounds checks that caused truncated or boundary \uXXXX escapes to raise "Invalid \uXXXX escape

... (truncated)

Commits

• 19b5f94 Exclude Pyodide wheels from PyPI uploads (#375)
• 1608c05 Use JSONDecodeError for out-of-range end indices in C scanstring (#374)
• 3bba179 Encoder parity fixes (for_json/_asdict) and TSan stress CI job (#373)
• 7b22d65 Error parity for the C and Python scanstring in surrogate and truncated strin...
• 825100a Release version 4.0.0: free-threading, CPython json parity, Python 2.7 fixes ...
• 0dbb9d8 C extension: dead code cleanup, fast paths for dict/list/string encoding, cor...
• e2e5f0b Add Python 3.13+ free-threading support to dict operations (#369)
• e817370 Fix free-threading (3.14t) crashes: heap types, unified per-module state, tem...
• 6397302 Add per-object critical sections to scanner and encoder (free-threading safet...
• e127d3d Replace PyDict_GetItem with PyDict_GetItemWithError (#364)
• Additional commits viewable in compare view

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 82.67%. Comparing base (0871f37) to head (ffeb4aa).
⚠️ Report is 1 commits behind head on master.

Additional details and impacted files

@@           Coverage Diff            @@
##           master    #9427    +/-   ##
========================================
  Coverage   82.67%   82.67%            
========================================
  Files         600      600            
  Lines       34534    34534            
  Branches     3131     3074    -57     
========================================
  Hits        28552    28552            
- Misses       5652     5862   +210     
+ Partials      330      120   -210     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[dependabot]

Superseded by #9449.