Merge commit 'a28dbbf733e264fe214ac6167dd7c33d296e6474' into dev

2025-01-07 15:12:10 +00:00
parent f7fd10e9a0 a28dbbf733
commit ae3c060cc4
267 changed files with 8040 additions and 2294 deletions
--- a/external/json/.github/workflows/check_amalgamation.yml
+++ b/external/json/.github/workflows/check_amalgamation.yml
@@ -3,18 +3,24 @@ name: "Check amalgamation"
 on:
  pull_request:

-permissions: read-all
+permissions:
+  contents: read

 jobs:
  save:
    runs-on: ubuntu-latest
    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
+        with:
+          egress-policy: audit
+
      - name: Save PR number
        run: |
          mkdir -p ./pr
          echo ${{ github.event.number }} > ./pr/number
          echo ${{ github.event.pull_request.user.login }} > ./pr/author
-      - uses: actions/upload-artifact@v2
+      - uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
        with:
          name: pr
          path: pr/
@@ -25,29 +31,29 @@ jobs:
      MAIN_DIR: ${{ github.workspace }}/main
      INCLUDE_DIR: ${{ github.workspace }}/main/single_include/nlohmann
      TOOL_DIR: ${{ github.workspace }}/tools/tools/amalgamate
-      ASTYLE_FLAGS: >
-        --style=allman --indent=spaces=4 --indent-modifiers --indent-switches --indent-preproc-block
-        --indent-preproc-define --indent-col1-comments --pad-oper --pad-header --align-pointer=type
-        --align-reference=type --add-brackets --convert-tabs --close-templates --lineend=linux --preserve-date
-        --formatted

    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
+        with:
+          egress-policy: audit
+
      - name: Checkout pull request
-        uses: actions/checkout@v3
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          path: main
          ref: ${{ github.event.pull_request.head.sha }}

      - name: Checkout tools
-        uses: actions/checkout@v3
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          path: tools
          ref: develop

      - name: Install astyle
        run: |
-          sudo apt-get update
-          sudo apt-get install astyle
+          python3 -mvenv venv
+          venv/bin/pip3 install -r $MAIN_DIR/tools/astyle/requirements.txt

      - name: Check amalgamation
        run: |
@@ -60,11 +66,11 @@ jobs:
          python3 $TOOL_DIR/amalgamate.py -c $TOOL_DIR/config_json.json -s .
          python3 $TOOL_DIR/amalgamate.py -c $TOOL_DIR/config_json_fwd.json -s .
          echo "Format (1)"
-          astyle $ASTYLE_FLAGS --suffix=none --quiet $INCLUDE_DIR/json.hpp $INCLUDE_DIR/json_fwd.hpp
+          ${{ github.workspace }}/venv/bin/astyle --project=tools/astyle/.astylerc --suffix=none --quiet $INCLUDE_DIR/json.hpp $INCLUDE_DIR/json_fwd.hpp

          diff $INCLUDE_DIR/json.hpp~ $INCLUDE_DIR/json.hpp
          diff $INCLUDE_DIR/json_fwd.hpp~ $INCLUDE_DIR/json_fwd.hpp

-          astyle $ASTYLE_FLAGS $(find docs/examples include tests -type f \( -name '*.hpp' -o -name '*.cpp' -o -name '*.cu' \) -not -path 'tests/thirdparty/*' -not -path 'tests/abi/include/nlohmann/*' | sort)
+          ${{ github.workspace }}/venv/bin/astyle --project=tools/astyle/.astylerc --suffix=orig $(find docs/examples include tests -type f \( -name '*.hpp' -o -name '*.cpp' -o -name '*.cu' \) -not -path 'tests/thirdparty/*' -not -path 'tests/abi/include/nlohmann/*' | sort)
          echo Check
          find $MAIN_DIR -name '*.orig' -exec false {} \+
--- a/external/json/.github/workflows/cifuzz.yml
+++ b/external/json/.github/workflows/cifuzz.yml
@@ -8,22 +8,27 @@ jobs:
  Fuzzing:
    runs-on: ubuntu-latest
    steps:
+    - name: Harden Runner
+      uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
+      with:
+        egress-policy: audit
+
    - name: Build Fuzzers
      id: build
-      uses: google/oss-fuzz/infra/cifuzz/actions/build_fuzzers@master
+      uses: google/oss-fuzz/infra/cifuzz/actions/build_fuzzers@57fe4475324c5506adbfecdcdd2917f65c86ee9e # master
      with:
        oss-fuzz-project-name: 'json'
        dry-run: false
        language: c++
    - name: Run Fuzzers
-      uses: google/oss-fuzz/infra/cifuzz/actions/run_fuzzers@master
+      uses: google/oss-fuzz/infra/cifuzz/actions/run_fuzzers@57fe4475324c5506adbfecdcdd2917f65c86ee9e # master
      with:
        oss-fuzz-project-name: 'json'
        fuzz-seconds: 300
        dry-run: false
        language: c++
    - name: Upload Crash
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
      if: failure() && steps.build.outcome == 'success'
      with:
        name: artifacts
--- a/external/json/.github/workflows/codeql-analysis.yml
+++ b/external/json/.github/workflows/codeql-analysis.yml
@@ -11,13 +11,13 @@ on:
    - cron: '0 19 * * 1'
  workflow_dispatch:
  
-permissions:
-  contents: read
-
 concurrency:
  group: ${{ github.workflow }}-${{ github.ref || github.run_id }}
  cancel-in-progress: true

+permissions:
+  contents: read
+
 jobs:
  CodeQL-Build:

@@ -26,19 +26,24 @@ jobs:
      security-events: write

    steps:
+    - name: Harden Runner
+      uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
+      with:
+        egress-policy: audit
+
    - name: Checkout repository
-      uses: actions/checkout@v3
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

    # Initializes the CodeQL tools for scanning.
    - name: Initialize CodeQL
-      uses: github/codeql-action/init@v2
+      uses: github/codeql-action/init@df409f7d9260372bd5f19e5b04e83cb3c43714ae # v3.27.9
      with:
        languages: c-cpp

    # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
    # If this step fails, then you should remove it and run the build manually (see below)
    - name: Autobuild
-      uses: github/codeql-action/autobuild@v2
+      uses: github/codeql-action/autobuild@df409f7d9260372bd5f19e5b04e83cb3c43714ae # v3.27.9

    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v2
+      uses: github/codeql-action/analyze@df409f7d9260372bd5f19e5b04e83cb3c43714ae # v3.27.9
--- a/external/json/.github/workflows/comment_check_amalgamation.yml
+++ b/external/json/.github/workflows/comment_check_amalgamation.yml
@@ -5,7 +5,8 @@ on:
    types:
      - completed

-permissions: {}
+permissions:
+  contents: read

 jobs:
  comment:
@@ -17,8 +18,13 @@ jobs:
      issues: read
      pull-requests: write
    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
+        with:
+          egress-policy: audit
+
      - name: 'Download artifact'
-        uses: actions/github-script@98814c53be79b1d30f795b907e553d8679345975 # v6.4.0
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
        with:
          script: |
            var artifacts = await github.rest.actions.listWorkflowRunArtifacts({
@@ -40,7 +46,7 @@ jobs:
      - run: unzip pr.zip

      - name: 'Comment on PR'
-        uses: actions/github-script@98814c53be79b1d30f795b907e553d8679345975 # v6.4.0
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
--- a/external/json/.github/workflows/dependency-review.yml
+++ b/external/json/.github/workflows/dependency-review.yml
@@ -0,0 +1,27 @@
+# Dependency Review Action
+#
+# This Action will scan dependency manifest files that change as part of a Pull Request,
+# surfacing known-vulnerable versions of the packages declared or updated in the PR.
+# Once installed, if the workflow run is marked as required,
+# PRs introducing known-vulnerable packages will be blocked from merging.
+#
+# Source repository: https://github.com/actions/dependency-review-action
+name: 'Dependency Review'
+on: [pull_request]
+
+permissions:
+  contents: read
+
+jobs:
+  dependency-review:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
+        with:
+          egress-policy: audit
+
+      - name: 'Checkout Repository'
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: 'Dependency Review'
+        uses: actions/dependency-review-action@3b139cfc5fae8b618d3eae3675e383bb1769c019 # v4.5.0
--- a/external/json/.github/workflows/labeler.yml
+++ b/external/json/.github/workflows/labeler.yml
@@ -4,7 +4,8 @@ on:
  pull_request_target:
    types: [opened, synchronize]

-permissions: {}
+permissions:
+  contents: read

 jobs:
  label:
@@ -15,6 +16,11 @@ jobs:
    runs-on: ubuntu-latest

    steps:
-      - uses: srvaroa/labeler@master
+      - name: Harden Runner
+        uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
+        with:
+          egress-policy: audit
+
+      - uses: srvaroa/labeler@1b3cdb1af3e59155a08b9b2436d0d54feaff49e2 # master
        env:
          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
--- a/external/json/.github/workflows/macos.yml
+++ b/external/json/.github/workflows/macos.yml
@@ -9,24 +9,60 @@ on:
  pull_request:
  workflow_dispatch:

-permissions:
-  contents: read
-
 concurrency:
  group: ${{ github.workflow }}-${{ github.ref || github.run_id }}
  cancel-in-progress: true

+permissions:
+  contents: read
+
 jobs:
-  xcode_1:
-    runs-on: macos-11
+# macos-11 is deprecated
+#  macos-11:
+#    runs-on: macos-11
+#    strategy:
+#      matrix:
+#        xcode: ['11.7', '12.4', '12.5.1', '13.0']
+#    env:
+#      DEVELOPER_DIR: /Applications/Xcode_${{ matrix.xcode }}.app/Contents/Developer
+#
+#    steps:
+#      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+#      - name: Run CMake
+#        run: cmake -S . -B build -D CMAKE_BUILD_TYPE=Debug -DJSON_BuildTests=On -DJSON_FastTests=ON
+#      - name: Build
+#        run: cmake --build build --parallel 10
+#      - name: Test
+#        run: cd build ; ctest -j 10 --output-on-failure
+
+# macos-12 is deprecated (https://github.com/actions/runner-images/issues/10721)
+#  macos-12:
+#    runs-on: macos-12 # https://github.com/actions/runner-images/blob/main/images/macos/macos-12-Readme.md
+#    strategy:
+#      matrix:
+#        xcode: ['13.1', '13.2.1', '13.3.1', '13.4.1', '14.0', '14.0.1', '14.1']
+#    env:
+#      DEVELOPER_DIR: /Applications/Xcode_${{ matrix.xcode }}.app/Contents/Developer
+#
+#    steps:
+#      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+#      - name: Run CMake
+#        run: cmake -S . -B build -D CMAKE_BUILD_TYPE=Debug -DJSON_BuildTests=On -DJSON_FastTests=ON
+#      - name: Build
+#        run: cmake --build build --parallel 10
+#      - name: Test
+#        run: cd build ; ctest -j 10 --output-on-failure
+
+  macos-13:
+    runs-on: macos-13 # https://github.com/actions/runner-images/blob/main/images/macos/macos-13-Readme.md
    strategy:
      matrix:
-        xcode: ['11.7', '12.4', '12.5.1', '13.0']
+        xcode: ['14.1', '14.2', '14.3', '14.3.1', '15.0.1', '15.1', '15.2']
    env:
      DEVELOPER_DIR: /Applications/Xcode_${{ matrix.xcode }}.app/Contents/Developer

    steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Run CMake
        run: cmake -S . -B build -D CMAKE_BUILD_TYPE=Debug -DJSON_BuildTests=On -DJSON_FastTests=ON
      - name: Build
@@ -34,16 +70,33 @@ jobs:
      - name: Test
        run: cd build ; ctest -j 10 --output-on-failure

-  xcode_2:
-    runs-on: macos-12
+  macos-14:
+    runs-on: macos-14 # https://github.com/actions/runner-images/blob/main/images/macos/macos-14-Readme.md
    strategy:
      matrix:
-        xcode: ['13.1', '13.2.1', '13.3.1', '13.4.1', '14.0', '14.0.1', '14.1']
+        xcode: ['15.3', '15.4']
    env:
      DEVELOPER_DIR: /Applications/Xcode_${{ matrix.xcode }}.app/Contents/Developer

    steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: Run CMake
+        run: cmake -S . -B build -D CMAKE_BUILD_TYPE=Debug -DJSON_BuildTests=On -DJSON_FastTests=ON
+      - name: Build
+        run: cmake --build build --parallel 10
+      - name: Test
+        run: cd build ; ctest -j 10 --output-on-failure
+
+  macos-15:
+    runs-on: macos-15 # https://github.com/actions/runner-images/blob/main/images/macos/macos-15-Readme.md
+    strategy:
+      matrix:
+        xcode: ['16.0', '16.1']
+    env:
+      DEVELOPER_DIR: /Applications/Xcode_${{ matrix.xcode }}.app/Contents/Developer
+
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Run CMake
        run: cmake -S . -B build -D CMAKE_BUILD_TYPE=Debug -DJSON_BuildTests=On -DJSON_FastTests=ON
      - name: Build
@@ -58,7 +111,7 @@ jobs:
        standard: [11, 14, 17, 20, 23]

    steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Run CMake
        run: cmake -S . -B build -D CMAKE_BUILD_TYPE=Debug -DJSON_BuildTests=On -DJSON_TestStandards=${{ matrix.standard }}
      - name: Build
--- a/external/json/.github/workflows/publish_documentation.yml
+++ b/external/json/.github/workflows/publish_documentation.yml
@@ -10,23 +10,28 @@ on:
      - docs/examples/**
  workflow_dispatch:

-permissions:
-  contents: read
-
 # we don't want to have concurrent jobs, and we don't want to cancel running jobs to avoid broken publications
 concurrency:
  group: documentation
  cancel-in-progress: false

+permissions:
+  contents: read
+
 jobs:
  publish_documentation:
+    permissions:
+      contents: write
+
    if: github.repository == 'nlohmann/json'
    runs-on: ubuntu-22.04
    steps:
-      - uses: actions/checkout@v3
+      - name: Harden Runner
+        uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
+        with:
+          egress-policy: audit

-      - name: Install and update PlantUML
-        run: sudo apt-get update ; sudo apt-get install -y plantuml
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Install virtual environment
        run: make install_venv -C docs/mkdocs
@@ -35,7 +40,7 @@ jobs:
        run: make build -C docs/mkdocs

      - name: Deploy documentation
-        uses: peaceiris/actions-gh-pages@v3
+        uses: peaceiris/actions-gh-pages@4f9cc6602d3f66b9c108549d475ec49e8ef4d45e # v4.0.0
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
          publish_dir: ./docs/mkdocs/site
--- a/external/json/.github/workflows/scorecards.yml
+++ b/external/json/.github/workflows/scorecards.yml
@@ -0,0 +1,81 @@
+# This workflow uses actions that are not certified by GitHub. They are provided
+# by a third-party and are governed by separate terms of service, privacy
+# policy, and support documentation.
+
+name: Scorecard supply-chain security
+on:
+  # For Branch-Protection check. Only the default branch is supported. See
+  # https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection
+  branch_protection_rule:
+  # To guarantee Maintained check is occasionally updated. See
+  # https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained
+  schedule:
+    - cron: '20 7 * * 2'
+  push:
+    branches: ["develop"]
+
+permissions:
+  contents: read
+
+jobs:
+  analysis:
+    name: Scorecard analysis
+    runs-on: ubuntu-latest
+    permissions:
+      # Needed to upload the results to code-scanning dashboard.
+      security-events: write
+      # Needed to publish results and get a badge (see publish_results below).
+      id-token: write
+      contents: read
+      actions: read
+      # To allow GraphQL ListCommits to work
+      issues: read
+      pull-requests: read
+      # To detect SAST tools
+      checks: read
+
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
+        with:
+          egress-policy: audit
+
+      - name: "Checkout code"
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+
+      - name: "Run analysis"
+        uses: ossf/scorecard-action@62b2cac7ed8198b15735ed49ab1e5cf35480ba46 # v2.4.0
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          # (Optional) "write" PAT token. Uncomment the `repo_token` line below if:
+          # - you want to enable the Branch-Protection check on a *public* repository, or
+          # - you are installing Scorecards on a *private* repository
+          # To create the PAT, follow the steps in https://github.com/ossf/scorecard-action#authentication-with-pat.
+          # repo_token: ${{ secrets.SCORECARD_TOKEN }}
+
+          # Public repositories:
+          #   - Publish results to OpenSSF REST API for easy access by consumers
+          #   - Allows the repository to include the Scorecard badge.
+          #   - See https://github.com/ossf/scorecard-action#publishing-results.
+          # For private repositories:
+          #   - `publish_results` will always be set to `false`, regardless
+          #     of the value entered here.
+          publish_results: true
+
+      # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
+      # format to the repository Actions tab.
+      - name: "Upload artifact"
+        uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
+        with:
+          name: SARIF file
+          path: results.sarif
+          retention-days: 5
+
+      # Upload the results to GitHub's code scanning dashboard.
+      - name: "Upload to code-scanning"
+        uses: github/codeql-action/upload-sarif@df409f7d9260372bd5f19e5b04e83cb3c43714ae # v3.27.9
+        with:
+          sarif_file: results.sarif
--- a/external/json/.github/workflows/ubuntu.yml
+++ b/external/json/.github/workflows/ubuntu.yml
@@ -8,7 +8,7 @@ on:
      - release/*
  pull_request:
  workflow_dispatch:
-  
+
 permissions:
  contents: read

@@ -23,9 +23,9 @@ jobs:
    steps:
      - name: Install git and unzip
        run: apt-get update ; apt-get install -y git unzip
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Get latest CMake and ninja
-        uses: lukka/get-cmake@v3.27.7
+        uses: lukka/get-cmake@5979409e62bdf841487c5fb3c053149de97a86d3 # v3.31.2
      - name: Run CMake
        run: cmake -S . -B build -DJSON_CI=On
      - name: Build
@@ -33,36 +33,54 @@ jobs:

  ci_test_gcc:
    runs-on: ubuntu-latest
-    container: ghcr.io/nlohmann/json-ci:v2.4.0
+    container: gcc:latest
    steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: Get latest CMake and ninja
+        uses: lukka/get-cmake@5979409e62bdf841487c5fb3c053149de97a86d3 # v3.31.2
      - name: Run CMake
        run: cmake -S . -B build -DJSON_CI=On
      - name: Build
        run: cmake --build build --target ci_test_gcc

-  ci_static_analysis:
+  ci_infer:
    runs-on: ubuntu-latest
    container: ghcr.io/nlohmann/json-ci:v2.4.0
-    strategy:
-      matrix:
-        target: [ci_cppcheck, ci_test_valgrind, ci_test_amalgamation, ci_test_single_header, ci_single_binaries, ci_infer]
    steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Run CMake
        run: cmake -S . -B build -DJSON_CI=On
      - name: Build
-        run: cmake --build build --target ${{ matrix.target }}
+        run: cmake --build build --target ci_infer
+
+  ci_test_single_header:
+    runs-on: ubuntu-latest
+    container: gcc:latest
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: Get latest CMake and ninja
+        uses: lukka/get-cmake@5979409e62bdf841487c5fb3c053149de97a86d3 # v3.31.2
+      - name: Run CMake
+        run: cmake -S . -B build -DJSON_CI=On
+      - name: Build
+        run: cmake --build build --target ci_test_single_header

  ci_static_analysis_ubuntu:
    runs-on: ubuntu-latest
    strategy:
      matrix:
-        target: [ci_cpplint, ci_reproducible_tests, ci_non_git_tests, ci_offline_testdata]
+        target: [ci_test_amalgamation, ci_cppcheck, ci_cpplint, ci_reproducible_tests, ci_non_git_tests, ci_offline_testdata, ci_reuse_compliance, ci_test_valgrind]
    steps:
-      - uses: actions/checkout@v3
+      - name: Harden Runner
+        uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
+        with:
+          egress-policy: audit
+
+      - name: Install Valgrind
+        run: sudo apt-get update ; sudo apt-get install -y valgrind
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Get latest CMake and ninja
-        uses: lukka/get-cmake@v3.27.7
+        uses: lukka/get-cmake@5979409e62bdf841487c5fb3c053149de97a86d3 # v3.31.2
      - name: Run CMake
        run: cmake -S . -B build -DJSON_CI=On
      - name: Build
@@ -73,13 +91,13 @@ jobs:
    container: silkeh/clang:dev
    strategy:
      matrix:
-        target: [ci_clang_tidy, ci_test_clang_sanitizer, ci_clang_analyze]
+        target: [ci_clang_tidy, ci_test_clang_sanitizer, ci_clang_analyze, ci_single_binaries]
    steps:
      - name: Install git, clang-tools, and unzip
-        run: apt-get update ; apt-get install -y git clang-tools unzip
-      - uses: actions/checkout@v3
+        run: apt-get update ; apt-get install -y git clang-tools iwyu unzip
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Get latest CMake and ninja
-        uses: lukka/get-cmake@v3.27.7
+        uses: lukka/get-cmake@5979409e62bdf841487c5fb3c053149de97a86d3 # v3.31.2
      - name: Run CMake
        run: cmake -S . -B build -DJSON_CI=On
      - name: Build
@@ -90,13 +108,13 @@ jobs:
    container: ubuntu:focal
    strategy:
      matrix:
-        target: [ci_cmake_flags, ci_test_diagnostics, ci_test_noexceptions, ci_test_noimplicitconversions, ci_test_legacycomparison, ci_test_noglobaludls]
+        target: [ci_cmake_flags, ci_test_diagnostics, ci_test_diagnostic_positions, ci_test_noexceptions, ci_test_noimplicitconversions, ci_test_legacycomparison, ci_test_noglobaludls]
    steps:
      - name: Install build-essential
        run: apt-get update ; apt-get install -y build-essential unzip wget git
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Get latest CMake and ninja
-        uses: lukka/get-cmake@v3.27.7
+        uses: lukka/get-cmake@5979409e62bdf841487c5fb3c053149de97a86d3 # v3.31.2
      - name: Run CMake
        run: cmake -S . -B build -DJSON_CI=On
      - name: Build
@@ -104,37 +122,59 @@ jobs:

  ci_test_coverage:
    runs-on: ubuntu-latest
-    container: ghcr.io/nlohmann/json-ci:v2.4.0
-    permissions:
-      contents: read
-      checks: write
    steps:
-      - uses: actions/checkout@v3
+      - name: Harden Runner
+        uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: Install dependencies and de_DE locale
+        run: |
+          sudo apt-get clean
+          sudo apt-get update
+          sudo apt-get install -y build-essential cmake lcov ninja-build make locales gcc-multilib g++-multilib
+          sudo locale-gen de_DE
+          sudo update-locale
      - name: Run CMake
        run: cmake -S . -B build -DJSON_CI=On
      - name: Build
        run: cmake --build build --target ci_test_coverage
      - name: Archive coverage report
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
        with:
          name: code-coverage-report
          path: ${{ github.workspace }}/build/html
      - name: Publish report to Coveralls
-        uses: coverallsapp/github-action@master
+        uses: coverallsapp/github-action@cfd0633edbd2411b532b808ba7a8b5e04f76d2c8 # v2.3.4
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          path-to-lcov: ${{ github.workspace }}/build/json.info.filtered.noexcept

+  ci_test_compilers_gcc_old:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        compiler: ['4.8', '4.9', '5', '6']
+    container: ghcr.io/nlohmann/json-ci:v2.4.0
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: Run CMake
+        run: CXX=g++-${{ matrix.compiler }} cmake -S . -B build -DJSON_CI=On
+      - name: Build
+        run: cmake --build build --target ci_test_compiler_g++-${{ matrix.compiler }}
+
  ci_test_compilers_gcc:
    runs-on: ubuntu-latest
    strategy:
      matrix:
-        compiler: ['4', '5', '6', '7', '8', '9', '10', '11', '12', 'latest']
+        # older GCC docker images (4, 5, 6) fail to check out code
+        compiler: ['7', '8', '9', '10', '11', '12', '13', '14', 'latest']
    container: gcc:${{ matrix.compiler }}
    steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Get latest CMake and ninja
-        uses: lukka/get-cmake@v3.27.7
+        uses: lukka/get-cmake@5979409e62bdf841487c5fb3c053149de97a86d3 # v3.31.2
      - name: Run CMake
        run: cmake -S . -B build -DJSON_CI=On
      - name: Build
@@ -144,14 +184,14 @@ jobs:
    runs-on: ubuntu-latest
    strategy:
      matrix:
-        compiler: ['3.5', '3.6', '3.7', '3.8', '3.9', '4', '5', '6', '7', '8', '9', '10', '11', '12', '13', '14', '15-bullseye', 'latest']
+        compiler: ['3.5', '3.6', '3.7', '3.8', '3.9', '4', '5', '6', '7', '8', '9', '10', '11', '12', '13', '14', '15-bullseye', '16', '17', '18', '19', 'latest']
    container: silkeh/clang:${{ matrix.compiler }}
    steps:
      - name: Install unzip and git
        run: apt-get update ; apt-get install -y unzip git
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Get latest CMake and ninja
-        uses: lukka/get-cmake@v3.27.7
+        uses: lukka/get-cmake@5979409e62bdf841487c5fb3c053149de97a86d3 # v3.31.2
      - name: Set env FORCE_STDCPPFS_FLAG for clang 7 / 8 / 9 / 10
        run: echo "JSON_FORCED_GLOBAL_COMPILE_OPTIONS=-DJSON_HAS_FILESYSTEM=0;-DJSON_HAS_EXPERIMENTAL_FILESYSTEM=0" >> "$GITHUB_ENV"
        if: ${{ matrix.compiler == '7' || matrix.compiler == '8' || matrix.compiler == '9' || matrix.compiler == '10' }}
@@ -160,27 +200,16 @@ jobs:
      - name: Build
        run: cmake --build build --target ci_test_compiler_default

-  ci_test_compilers:
-    runs-on: ubuntu-latest
-    container: ghcr.io/nlohmann/json-ci:v2.4.0
-    strategy:
-      matrix:
-        compiler: [g++-4.8]
-    steps:
-      - uses: actions/checkout@v3
-      - name: Run CMake
-        run: cmake -S . -B build -DJSON_CI=On
-      - name: Build
-        run: cmake --build build --target ci_test_compiler_${{ matrix.compiler }}
-
  ci_test_standards_gcc:
    runs-on: ubuntu-latest
-    container: ghcr.io/nlohmann/json-ci:v2.4.0
+    container: gcc:latest
    strategy:
      matrix:
        standard: [11, 14, 17, 20, 23]
    steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: Get latest CMake and ninja
+        uses: lukka/get-cmake@5979409e62bdf841487c5fb3c053149de97a86d3 # v3.31.2
      - name: Run CMake
        run: cmake -S . -B build -DJSON_CI=On
      - name: Build
@@ -192,22 +221,27 @@ jobs:
    strategy:
      matrix:
        standard: [11, 14, 17, 20, 23]
+        stdlib: [libcxx, libstdcxx]
    steps:
      - name: Install git and unzip
        run: apt-get update ; apt-get install -y git unzip
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Get latest CMake and ninja
-        uses: lukka/get-cmake@v3.27.7
+        uses: lukka/get-cmake@5979409e62bdf841487c5fb3c053149de97a86d3 # v3.31.2
      - name: Run CMake
        run: cmake -S . -B build -DJSON_CI=On
-      - name: Build
+      - name: Build with libc++
+        run: cmake --build build --target ci_test_clang_libcxx_cxx${{ matrix.standard }}
+        if: ${{ matrix.stdlib == 'libcxx' }}
+      - name: Build with libstdc++
        run: cmake --build build --target ci_test_clang_cxx${{ matrix.standard }}
+        if: ${{ matrix.stdlib == 'libstdcxx' }}

  ci_cuda_example:
    runs-on: ubuntu-latest
    container: ghcr.io/nlohmann/json-ci:v2.4.0
    steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Run CMake
        run: cmake -S . -B build -DJSON_CI=On
      - name: Build
@@ -217,7 +251,7 @@ jobs:
    runs-on: ubuntu-latest
    container: ghcr.io/nlohmann/json-ci:v2.2.0
    steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Run CMake
        run: cmake -S . -B build -DJSON_CI=On
      - name: Build
@@ -225,23 +259,18 @@ jobs:
          . /opt/intel/oneapi/setvars.sh
          cmake --build build --target ci_icpc

-  ci_reuse_compliance:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-python@v3
-      - name: Install REUSE tool
-        run:  python -m pip install reuse
-      - name: Run REUSE lint
-        run: reuse lint
-
  ci_test_documentation:
    runs-on: ubuntu-latest
    strategy:
      matrix:
-        target: [ci_test_examples, ci_test_api_documentation]
+        target: [ci_test_examples, ci_test_build_documentation]
    steps:
-      - uses: actions/checkout@v3
+      - name: Harden Runner
+        uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Run CMake
        run: cmake -S . -B build -DJSON_CI=On
      - name: Build
--- a/external/json/.github/workflows/windows.yml
+++ b/external/json/.github/workflows/windows.yml
@@ -24,9 +24,9 @@ jobs:
        architecture: [x64, x86]

    steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Set up MinGW
-        uses: egor-tensin/setup-mingw@v2
+        uses: egor-tensin/setup-mingw@84c781b557efd538dec66bde06988d81cd3138cf # v2.2.0
        with:
          platform: ${{ matrix.architecture }}
          version: 12.2.0 # https://github.com/egor-tensin/setup-mingw/issues/14
@@ -45,7 +45,7 @@ jobs:
        architecture: [Win32, x64]

    steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
    - name: Run CMake
      run: cmake -S . -B build -G "Visual Studio 16 2019" -A ${{ matrix.architecture }} -DJSON_BuildTests=On -DCMAKE_CXX_FLAGS="/W4 /WX"
      if: matrix.build_type == 'Release'
@@ -61,7 +61,7 @@ jobs:
    runs-on: windows-2019

    steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
    - name: Run CMake
      run: cmake -S . -B build -G "Visual Studio 16 2019" -DJSON_BuildTests=On -DCMAKE_CXX_FLAGS="/permissive- /std:c++latest /utf-8 /W4 /WX"
    - name: Build
@@ -77,7 +77,7 @@ jobs:
        architecture: [Win32, x64]

    steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
    - name: Run CMake
      run: cmake -S . -B build -G "Visual Studio 17 2022" -A ${{ matrix.architecture }} -DJSON_BuildTests=On -DCMAKE_CXX_FLAGS="/W4 /WX"
      if: matrix.build_type == 'Release'
@@ -93,7 +93,7 @@ jobs:
    runs-on: windows-2022

    steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
    - name: Run CMake
      run: cmake -S . -B build -G "Visual Studio 17 2022" -DJSON_BuildTests=On -DCMAKE_CXX_FLAGS="/permissive- /std:c++latest /utf-8 /W4 /WX"
    - name: Build
@@ -108,7 +108,7 @@ jobs:
        version: [11, 12, 13, 14, 15]

    steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Install Clang
        run: curl -fsSL -o LLVM${{ matrix.version }}.exe https://github.com/llvm/llvm-project/releases/download/llvmorg-${{ matrix.version }}.0.0/LLVM-${{ matrix.version }}.0.0-win64.exe ; 7z x LLVM${{ matrix.version }}.exe -y -o"C:/Program Files/LLVM"
      - name: Run CMake
@@ -125,7 +125,7 @@ jobs:
        architecture: [Win32, x64]

    steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Run CMake
        run: cmake -S . -B build -G "Visual Studio 16 2019" -A ${{ matrix.architecture }} -T ClangCL -DJSON_BuildTests=On
      - name: Build