From fff99a941869bb3e96b1325b32a91c35a0ea77c4 Mon Sep 17 00:00:00 2001
From: zonyitoo <zonyitoo@gmail.com>
Date: Thu, 20 Nov 2025 21:26:10 +0800
Subject: [PATCH] fix: json5 unmaintained, RUSTSEC-2025-0120

---
 Cargo.lock                                    | 26 +++++++++----------
 Cargo.toml                                    |  2 +-
 crates/shadowsocks-service/Cargo.toml         |  7 +++--
 crates/shadowsocks-service/src/config.rs      |  6 ++---
 .../src/local/socks/config.rs                 |  2 +-
 src/config.rs                                 |  4 +--
 6 files changed, 25 insertions(+), 22 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index c5c45c87..b85a6478 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1836,17 +1836,6 @@ dependencies = [
  "wasm-bindgen",
 ]
 
-[[package]]
-name = "json5"
-version = "0.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "96b0db21af676c1ce64250b5f40f3ce2cf27e4e47cb91ed91eb6fe9350b430c1"
-dependencies = [
- "pest",
- "pest_derive",
- "serde",
-]
-
 [[package]]
 name = "kqueue"
 version = "1.1.1"
@@ -3125,6 +3114,17 @@ dependencies = [
  "serde_core",
 ]
 
+[[package]]
+name = "serde_json5"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5d34d03f54462862f2a42918391c9526337f53171eaa4d8894562be7f252edd3"
+dependencies = [
+ "pest",
+ "pest_derive",
+ "serde",
+]
+
 [[package]]
 name = "serde_urlencoded"
 version = "0.7.1"
@@ -3254,7 +3254,6 @@ dependencies = [
  "futures",
  "ipnet",
  "jemallocator",
- "json5",
  "libc",
  "log",
  "log4rs",
@@ -3265,6 +3264,7 @@ dependencies = [
  "rpassword",
  "rpmalloc",
  "serde",
+ "serde_json5",
  "shadowsocks-service",
  "snmalloc-rs",
  "sysexits",
@@ -3303,7 +3303,6 @@ dependencies = [
  "idna",
  "ipnet",
  "iprange",
- "json5",
  "libc",
  "log",
  "lru_time_cache",
@@ -3316,6 +3315,7 @@ dependencies = [
  "rocksdb",
  "rustls-native-certs",
  "serde",
+ "serde_json5",
  "shadowsocks",
  "smoltcp",
  "socket2 0.6.1",
diff --git a/Cargo.toml b/Cargo.toml
index dbb27610..a832e8ce 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -218,7 +218,7 @@ tracing-appender = { version = "0.2.3", optional = true, default-features = fals
 time = { version = "0.3", optional = true }
 
 serde = { version = "1.0", features = ["derive"] }
-json5 = "0.4"
+serde_json5 = "0.2"
 thiserror = "2.0"
 base64 = "0.22"
 
diff --git a/crates/shadowsocks-service/Cargo.toml b/crates/shadowsocks-service/Cargo.toml
index b49f2708..655cca6d 100644
--- a/crates/shadowsocks-service/Cargo.toml
+++ b/crates/shadowsocks-service/Cargo.toml
@@ -170,7 +170,10 @@ hickory-resolver = { version = "0.25", optional = true, features = ["serde"] }
 idna = "1.0"
 ipnet = "2.10"
 iprange = "0.6"
-regex = { version = "1.4", default-features = false, features = ["std", "perf"] }
+regex = { version = "1.4", default-features = false, features = [
+    "std",
+    "perf",
+] }
 
 mime = { version = "0.3", optional = true }
 flate2 = { version = "1.0", optional = true }
@@ -192,7 +195,7 @@ smoltcp = { version = "0.12", optional = true, default-features = false, feature
 ] }
 
 serde = { version = "1.0", features = ["derive"] }
-json5 = "0.4"
+serde_json5 = "0.2"
 bson = { version = "3.0.0", features = ["serde"], optional = true }
 
 shadowsocks = { version = "1.23.2", path = "../shadowsocks", default-features = false }
diff --git a/crates/shadowsocks-service/src/config.rs b/crates/shadowsocks-service/src/config.rs
index 65aec145..05eb21b8 100644
--- a/crates/shadowsocks-service/src/config.rs
+++ b/crates/shadowsocks-service/src/config.rs
@@ -1457,7 +1457,7 @@ macro_rules! impl_from {
 }
 
 impl_from!(::std::io::Error, ErrorKind::IoError, "error while reading file");
-impl_from!(json5::Error, ErrorKind::JsonParsingError, "json parse error");
+impl_from!(serde_json5::Error, ErrorKind::JsonParsingError, "json parse error");
 
 impl Debug for Error {
     fn fmt(&self, f: &mut Formatter) -> fmt::Result {
@@ -2564,7 +2564,7 @@ impl Config {
 
     /// Load Config from a `str`
     pub fn load_from_str(s: &str, config_type: ConfigType) -> Result<Self, Error> {
-        let c = json5::from_str::<SSConfig>(s)?;
+        let c = serde_json5::from_str::<SSConfig>(s)?;
         Self::load_from_ssconfig(c, config_type)
     }
 
@@ -3178,7 +3178,7 @@ impl fmt::Display for Config {
             });
         }
 
-        write!(f, "{}", json5::to_string(&jconf).unwrap())
+        write!(f, "{}", serde_json5::to_string(&jconf).unwrap())
     }
 }
 
diff --git a/crates/shadowsocks-service/src/local/socks/config.rs b/crates/shadowsocks-service/src/local/socks/config.rs
index 5378fac9..c2dd16dc 100644
--- a/crates/shadowsocks-service/src/local/socks/config.rs
+++ b/crates/shadowsocks-service/src/local/socks/config.rs
@@ -66,7 +66,7 @@ impl Socks5AuthConfig {
         let mut content = String::new();
         reader.read_to_string(&mut content)?;
 
-        let jconf: SSSocks5AuthConfig = match json5::from_str(&content) {
+        let jconf: SSSocks5AuthConfig = match serde_json5::from_str(&content) {
             Ok(c) => c,
             Err(err) => return Err(io::Error::other(err)),
         };
diff --git a/src/config.rs b/src/config.rs
index dacfeb3d..4c423275 100644
--- a/src/config.rs
+++ b/src/config.rs
@@ -88,7 +88,7 @@ pub enum ConfigError {
     IoError(#[from] io::Error),
     /// JSON parsing error
     #[error("{0}")]
-    JsonError(#[from] json5::Error),
+    JsonError(#[from] serde_json5::Error),
     /// Invalid value
     #[error("Invalid value: {0}")]
     InvalidValue(String),
@@ -120,7 +120,7 @@ impl Config {
 
     /// Load `Config` from string
     pub fn load_from_str(s: &str) -> Result<Self, ConfigError> {
-        json5::from_str(s).map_err(ConfigError::from)
+        serde_json5::from_str(s).map_err(ConfigError::from)
     }
 
     /// Set by command line options