This project uses Break Versioning as of Aug 16, 2014.
Identical to v3.2.0-RC3 (2022 Jun 27)
[com.taoensso/nippy "3.2.0"]
This is a non-breaking maintenance release.
See here for recommended steps when updating any Clojure/Script dependencies.
v3.1.3
org.joda.time.DateTime
to default-thaw-serializable-allowlist
(@slipset)v3.1.3
v3.1.1
true
(@RolT)tools/freeze
should use *freeze-opts*
even for unwrapped valsThe boxed Boolean bug has been around since the first version of Nippy and is mostly relevant to users doing Java interop. For more info see: https://github.com/ptaoussanis/nippy/commit/8909a32bdd654a136da385e0e09c9cc44416f964
[com.taoensso/nippy "3.2.0-RC3"]
This is a non-breaking maintenance release.
See here for recommended steps when updating any Clojure/Script dependencies.
v3.1.3
org.joda.time.DateTime
to default-thaw-serializable-allowlist
(@slipset)v3.1.3
v3.1.1
true
(@RolT)tools/freeze
should use *freeze-opts*
even for unwrapped valsThe boxed Boolean bug has been around since the first version of Nippy and is mostly relevant to users doing Java interop. For more info see: https://github.com/ptaoussanis/nippy/commit/8909a32bdd654a136da385e0e09c9cc44416f964
[com.taoensso/nippy "3.2.0-RC2"]
This is a non-breaking maintenance release.
See here for recommended steps when updating any Clojure/Script dependencies.
v3.1.3
org.joda.time.DateTime
to default-thaw-serializable-allowlist
(@slipset)v3.1.3
v3.1.1
tools/freeze
should use *freeze-opts*
even for unwrapped valstrue
(@RolT)The boxed Boolean bug has been around since the first version of Nippy and is mostly relevant to users doing Java interop. For more info see: https://github.com/ptaoussanis/nippy/commit/8909a32bdd654a136da385e0e09c9cc44416f964
[com.taoensso/nippy "3.1.3"]
This is a non-breaking, bugfix release.
See here for recommended steps when updating any Clojure/Script dependencies.
v3.1.1
tools/freeze
should use *freeze-opts*
even for unwrapped valstrue
(@RolT)The boxed Boolean bug has been around since the first version of Nippy and is mostly relevant to users doing Java interop. For more info see: https://github.com/ptaoussanis/nippy/commit/8909a32bdd654a136da385e0e09c9cc44416f964
[com.taoensso/nippy "3.1.1"]
This is a non-breaking, bugfix release. But please note that large keywords or symbols (with >127 characters) frozen with >=
v3.1.1
will need >=v3.1.1
to thaw.
v3.1.0
[1] Keywords or symbols with >127 characters in their name
[com.taoensso/nippy "3.1.0"]
This is a non-breaking, minor feature release.
v3.0.0
freeze/thaw
support for java.time
classes on JVM 8+: Instant
, Duration
, Period
.thaw-from-resource
convenience util.swap-serializable-whitelist!
for backwards compatibility.v3.0.0
java.time
classes to default *thaw-serializable-whitelist*
.[com.taoensso/nippy "3.1.0-RC1"]
This is a non-breaking, minor feature release.
v3.0.0
freeze/thaw
support for java.time.Instant
on JVM 8+ (@cnuernber).[com.taoensso/nippy "3.0.0"]
This release is focused on smoothing out rough edges left by
CVE-2020-24164
[#130], and to ease transition from versions of Nippy <v2.15.0 final
.
See here for recommended steps when updating any Clojure/Script dependencies.
Note that there's separate details below for upgrading from v2.15
vs v2.14
:
v2.15
(usually non-breaking)Usually a non-breaking drop-in replacement, but there's some changes you might like to take advantage of. See [#130] for detailed upgrade instructions.
v1.5
to v1.7
.:nippy/unthawable
responses now have a standardized form: {:nippy/unthawable {:type _ :cause _ ...}
. Most folks won't care about this change unless they have code specifically to deal with :nippy/unthawable
responses.*serializable-whitelist*
has been split into two separate vars: *freeze-serializable-allowlist*
, *thaw-serializable-allowlist
*. See [#130] for details.freeze
now allows the use of Java's Serializable for any class. thaw
continues to be restrictive by default, and will quarantine any objects not on the class allowlist. See [#130] for details.freeze
and thaw
now support opts: :serializable-allowlist
, :incl-metadata?
.read-quarantined-serializable-object-unsafe!
util to read quarantined Serializable objects. See API docs and/or [#130] for details.allow-and-record-any-serializable-class-unsafe
util. See API docs and/or [#130] for details.v2.14
(may be BREAKING)Likely breaking. Please see [#130] for detailed upgrade instructions.
v1.5
to v1.7
.thaw
will now quarantine Serializable objects whose class is not allowed by *thaw-serializable-allowlist*
. See [#130] for details.:nippy/unthawable
responses now have a standardized form: {:nippy/unthawable {:type _ :cause _ ...}
. Most folks won't care about this change unless you have code specifically to deal with :nippy/unthawable
responses.AES-CBC
to AES-GCM
(faster, includes integrity check)freeze-to-string
, thaw-from-string
(@piotr-yuxuan)extend-freeze
: include id collision odds in docstringfreezable?
to cover nil
[com.taoensso/nippy "3.0.0-RC3"]
v3.0.0-RC1
allow-and-record-any-serializable-class-unsafe
util.[com.taoensso/nippy "3.0.0-RC1"]
Major BREAKING feature + security release.
See here for recommended steps when updating any Clojure/Script dependencies.
This release is focused on smoothing out rough edges left by
CVE-2020-24164
[#130], and to ease transition from version of Nippy <v2.15.0
final.
Apologies for the recent breaking changes!
Note that there's separate documentation below if upgrading from v2.15
or v2.14
:
v2.15.0
(incl. BREAKING changes)See [#130] for detailed upgrade instructions.
v1.5
to v1.7
.*serializable-whitelist*
has been split into two separate vars: *freeze-serializable-allowlist*
, *thaw-serializable-allowlist
*. See [#130] for details.:nippy/unthawable
responses now have a standardized form: {:nippy/unthawable {:type _ :cause _ ...}
. Most folks won't care about this change unless you have code specifically to deal with :nippy/unthawable
responses.freeze
now allows the use of Java's Serializable for any class. thaw
continues to be restrictive by default, and will quarantine any objects not on the class allowlist. See [#130] for details.freeze
and thaw
now support opts: :serializable-allowlist
, :incl-metadata?
.read-quarantined-serializable-object-unsafe!
util to read quarantined Serializable objects. See [#130] for details.v2.14.0
(incl. BREAKING changes)See [#130] for detailed upgrade instructions.
thaw
will now quarantine Serializable objects whose class is not allowed by *thaw-serializable-allowlist*
. See [#130] for details.v1.5
to v1.7
.:nippy/unthawable
responses now have a standardized form: {:nippy/unthawable {:type _ :cause _ ...}
. Most folks won't care about this change unless you have code specifically to deal with :nippy/unthawable
responses.AES-CBC
to AES-GCM
(faster, includes integrity check)freeze-to-string
, thaw-from-string
(@piotr-yuxuan)extend-freeze
: include id collision odds in docstringfreezable?
to cover nil
[com.taoensso/nippy "2.15.3"]
Non-breaking release. See here for recommended steps when updating any Clojure/Script dependencies.
v2.15.2
*serializable-whitelist*
: added a number of common classes to default value. See default-serializable-whitelist
for details.[com.taoensso/nippy "2.15.2"]
This is a quick hotfix release, should be non-breaking.
Only change since v2.15.0
is to bump Encore dependency (v2.124.0
->v2.126.2
).
Encore v1.123.0
introduced an issue affecting Timbre.
Issue was addressed with Encore v2.125.2
.
Updating Encore here doesn't affect Nippy, but may be helpful for users of Nippy that also use Timbre and that haven't otherwise updated to a newer version of Encore yet.
[com.taoensso/nippy "2.15.1"]
This is a minor feature release. Should be non-breaking.
New since v2.15.0
:
*serializable-whitelist*
: sets of approved class names may now contain "*" wildcards.*serializable-whitelist*
: added JVM properties and env vars to override initial value. See updated docstring for details.Changes since v2.15.0
:
extend-freeze
: include id collision odds in docstring.[com.taoensso/nippy "2.15.0"]
This is a major feature release. It may be BREAKING!
BREAKING CHANGES since v2.14.0
:
*serialization-whitelist*
, ENABLED BY DEFAULT.See https://github.com/ptaoussanis/nippy/issues/130 for details, incl. upgrade instructions.
Big thanks to Timo Mihaljov (@solita-timo-mihaljov) for an excellent report identifying this vulnerability!
New since v2.14.0
:
freeze-to-string
, thaw-from-string
(@piotr-yuxuan)Changes since v2.14.0
:
AES-CBC
to AES-GCM
(faster, includes integrity check)Fixes since v2.14.0
:
freezable?
to cover nil
[com.taoensso/nippy "2.14.2"]
This is a non-breaking hotfix security release. PLEASE READ CAREFULLY.
New since v2.14.0
:
*serialization-whitelist*
feature, DISABLED BY DEFAULT.To prevent a possible Remote Code Execution (RCE) vulnerability (#130), you must opt-in to use the new *serialization-whitelist*
feature.
See the nippy/*serialization-whitelist*
docstring for usage instructions.
[com.taoensso/nippy "2.14.0"]
This is a minor, non-breaking maintenance release.
[com.taoensso/nippy "2.13.0"]
This is a minor, non-breaking maintenance release.
freeze-to-file
and thaw-from-file
utils (@Engelberg)[com.taoensso/nippy "2.13.0-RC1"]
This should be a minor, non-breaking release.
[com.taoensso/nippy "2.12.2"]
[com.taoensso/nippy "2.12.1"]
[com.taoensso/nippy "2.12.0"]
This is a major release that may involve some breaking API changes in rare cases for users of some low-level or obscure features that have been made private or removed. If your code compiles with this new version of Nippy, you should be fine.
As with all Nippy releases: this version can read data written by older versions but older versions may not be able to read data written by this version.
No changes since
2.12.0-RC2
Changes since2.11.1
:
*final-freeze-fallback*
(rarely used)*default-freeze-compressor-selector*
(rarely used)write-<x>
and read-<x>
fns (rarely used)cache
docstring for details)fast-freeze
, fast-thaw
utils (please see docstrings for details)freeze
return val is no longer auto type hinted as ^bytes
(had a performance cost, rarely used)fn?
s were incorrectly reporting true for serializable?
[com.taoensso/nippy "2.12.0-RC2"]
Changes since
2.12.0-RC1
:
cache
feature now supports metadata[com.taoensso/nippy "2.12.0-RC1"]
This is a major release that may involve some breaking API changes in rare cases for users of some low-level or obscure features that have been made private or removed. If your code compiles with this new version of Nippy, you should be fine.
As with all Nippy releases: this version can read data written by older versions but older versions may not be able to read data written by this version.
PLEASE REPORT ANY PROBLEMS, thank you!
No changes since
2.12.0-beta3
. Changes since2.11.1
:
*final-freeze-fallback*
(rarely used)*default-freeze-compressor-selector*
(rarely used)write-<x>
and read-<x>
fns (rarely used)cache
docstring for details)fast-freeze
, fast-thaw
utils (please see docstrings for details)freeze
return val is no longer auto type hinted as ^bytes
(had a performance cost, rarely used)fn?
s were incorrectly reporting true for serializable?
[com.taoensso/nippy "2.12.0-beta3"]
Changes since 2.12.0-beta2:
fn?
s were incorrectly reporting true for serializable?
[com.taoensso/nippy "2.12.0-beta2"]
This is a major release that may involve some breaking API changes in rare cases for users of some low-level or obscure features that have been made private or removed. If your code compiles with this new version of Nippy, you should be fine.
As with all Nippy releases: this version can read data written by older versions but older versions may not be able to read data written by this version.
*final-freeze-fallback*
(rarely used)*default-freeze-compressor-selector*
(rarely used)write-<x>
and read-<x>
fns (rarely used)cache
docstring for details)fast-freeze
, fast-thaw
utils (please see docstrings for details)freeze
return val is no longer auto type hinted as ^bytes
(had a performance cost, rarely used)PLEASE REPORT ANY PROBLEMS, thank you!
Hotfix for broken Clojure 1.5 support
[com.taoensso/nippy "2.11.1"]
Identical to v2.11.0-beta1 (published December 13 2015)
[com.taoensso/nippy "2.11.0"]
Identical to v2.11.0-beta1 (published December 13 2015)
[com.taoensso/nippy "2.11.0-RC1"]
This is a major performance release that drops default support for thawing Nippy v1 archives but is otherwise non-breaking
thaw
now has :v1-compatibility?
opt set to false by default (was true before) [1]freeze
when using no compression or encryption[com.taoensso/nippy "2.11.0-beta1"]
[1] Use (thaw <frozen-byte-array> {:v1-compatibility? true})
to support thawing of data frozen with Nippy v1 (before ~June 2013)
This is a major feature/performance release that drops support for Clojure 1.4 but is otherwise non-breaking
*default-freeze-compressor-selector*
, set-default-freeze-compressor-selector!
util*custom-readers*
, swap-custom-readers!
util*print-level*
, *print-length*
for safety[com.taoensso/nippy "2.10.0"]
This is a hotfix release with an important fix for Nippy encryption users
[com.taoensso/nippy "2.9.1"]
This is a major non-breaking release that improves performance and makes thawing more resilient to certain failures. Identical to v2.9.0-RC3.
doseq
-> (faster) run!
callsfreeze
compression scheme using :auto
compressor (now the default). This can result in significant speed+space improvements for users serializing many small values.[com.taoensso/nippy "2.9.0"]
This is a maintenance release with some minor fixes and some dependency updates.
freezable?
should return true for clojure.lang.PersistentVector (@chairmanwow).This is a minor maintenance release & should be a safe upgrade for users of v2.7.0/RC-1.
No changes from v2.7.0-RC1
.
Major release with significant performance improvements, a new default compression type (LZ4), and better support for a variety of compression/encryption tools.
The data format is fully backwards-compatible, the API is backwards compatible unless you are using the
:headerless-meta
thaw option.
thaw
:headerless-meta
option has been dropped. Its purpose was to provide Nippy v1 compatibility, which is now done automatically. To prevent any surprises, thaw
calls with this option will now throw an assertion error.thaw
API has been improved (simplified). The default :encryptor
and :compressor
values are now both :auto
, which'll choose intelligently based on data now included with the Nippy header. Behaviour remains the same for data written without a header: you must specify the correct :compressor
and :encryptor
values manually.taoensso.nippy.compression
ns, taoensso.nippy.encryption
ns, taoensso.nippy.tools
ns, extend-freeze
, extend-thaw
.ex-info
s.extend-thaw
now prints a warning when replacing a pre-existing type id.extend-freeze
, extend-thaw
can now take arbitrary keyword type ids (see docstrings for more info).CRITICAL FIX for v2.6.0 released 9 days ago. Please upgrade ASAP!
Small strings weren't getting a proper UTF-8 encoding:
(.getBytes <string>)
was being used here instead of
(.getBytes <string> "UTF-8")
as is correct and done elsewhere.
This means that small UTF-8 strings may have been incorrectly stored in environments where UTF-8 is not the default JVM character encoding.
Bug was introduced in Nippy v2.6.0, released 9 days ago (2014 Mar 30).
Please check for possible errors in Unicode text written using Nippy v2.6.0 if your JVM uses an alternative character encoding by default
Really sorry about this! Thanks to @xkihzew for the bug report.
Major release with efficiency improvements, reliability improvements, and some new utils.
freeze-to-out!
, thaw-from-in!
for operating directly on DataOutputs/DataInputs.:skip-header?
freeze
option to freeze data without standard Nippy headers (can be useful in very performance sensitive environments).freezable?
util fn to main ns.write-bytes
, write-biginteger
, write-utf8
, write-compact-long
, and respective readers.Compressable-LZMA2
type has changed (less overhead).freeze-to-stream!
, thaw-from-stream!
are deprecated in favor of the more general freeze-to-out!
, thaw-from-in!
.:legacy-mode
options. This was being used mainly for headerless freezing, so a new headerless mode is taking its place.BigInteger
and BigInt
on thawing (previously both thawed to BigInt
s). (mlacorte).encore
dependency.serializable?
/readable?
for types with gensym-style names (e.g. as used for anonymous fns, etc.).inspect-ba
fn for examining data possibly frozen by Nippy.Compressable-LZMA2
type & (replaceable) de/serializer.:read-eval?
, :print-dup?
options.Thanks to James Reeves (weavejester) for these changes!:
tools.reader.edn
for safer reader fallback.Exposed low-level fns: freeze-to-stream!
, thaw-from-stream!
.
Added extend-freeze
and extend-thaw
for extending to custom types:
Added support for easily extending Nippy de/serialization to custom types:
(defrecord MyType [data])
(nippy/extend-freeze MyType 1 [x steam] (.writeUTF stream (:data x)))
(nippy/extend-thaw 1 [stream] (->MyType (.readUTF stream)))
(nippy/thaw (nippy/freeze (->MyType "Joe"))) => #taoensso.nippy.MyType{:data "Joe"}
MIGRATION NOTE: Please be sure to use lein clean
to clear old (v1) build artifacts!
Refactored for huge performance improvements (~40% roundtrip time).
New header format for better error messages.
New taoensso.nippy.tools
ns for easier integration with 3rd-party tools.
DEPRECATED: freeze-to-bytes
-> freeze
, thaw-from-bytes
-> thaw
.
See the new fn docstrings for updated opts, etc.
Added pluggable compression support:
(freeze "Hello") ; defaults to:
(freeze "Hello" {:compressor taoensso.nippy.compression/snappy-compressor})
;; The :compressor value above can be replaced with nil (no compressor) or
;; an alternative Compressor implementing the appropriate protocol
Added pluggable crypto support:
(freeze "Hello") ; defaults to:
(freeze "Hello" {:encryptor taoensso.nippy.encryption/aes128-encryptor}
;; The :encryptor value above can be replaced with nil (no encryptor) or
;; an alternative Encryptor implementing the appropriate protocol
See the README for an example using encryption.
Can you improve this documentation?Edit on GitHub
cljdoc is a website building & hosting documentation for Clojure/Script libraries
× close