Bump com.cedarsoftware:json-io from 4.62.0 to 4.63.0

[dependabot]

Bumps com.cedarsoftware:json-io from 4.62.0 to 4.63.0.

Changelog

Sourced from com.cedarsoftware:json-io's changelog.

4.63.0 - 2025-11-07

• DEPENDENCY: Updated java-util to version 4.3.0 for new DataGeneratorInputStream utility and other enhancements.
• PERFORMANCE: Optimized Injector.inject() hot path for ~12% read performance improvement:
  • Removed redundant declaringClass.isInstance(object) check - Native call eliminated from every field injection
  • Cached system class check as boolean field (computed once at construction vs per-injection)
  • Cached field metadata (fieldType, fieldName, displayName) to avoid repeated method calls
  • Impact: Read performance improved from 365ms to 322ms on benchmark suite (~12% faster)
• PERFORMANCE: Optimized EnumFieldFilter to avoid unnecessary field.getName() call:
  • Moved field name computation after isEnum() check for early exit on non-enum fields (99% of fields)
  • Minor cold path optimization during class metadata setup
• FIX: Fixed bug in ArrayTest.testEmptySubArray() test:
  • Changed JsonIo.toObjects() to JsonIo.toJava() for correct API usage
  • Fixed variable references from outer[] array to outerList.get() for proper type handling
• FIX: Fixed 2 disabled security tests in JsonReaderSecurityLimitsTest:
  • testObjectReferencesLimit_ShouldUseConfiguredLimit - Added .asClass() to trigger parsing and reference tracking
  • testReferenceChainDepthLimit_ShouldUseConfiguredLimit - Created proper 4-level reference chain and added .asClass() to trigger resolution
  • Both tests now properly validate DoS attack prevention mechanisms
• CLEANUP: Removed 3 stale TODO comments:
  • Removed outdated TODO in MultiKeyMapTest about nested Set support (already implemented and tested)
  • Removed 2 misleading TODOs in TestGraphComparator and TestGraphComparatorList about IP address performance (no IP lookup exists, static init is fast)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)