From 583e2500b64427d668d66bcb670d5cb9627a93fd Mon Sep 17 00:00:00 2001
From: Emerson Matos <emerson.matos@nubank.com.br>
Date: Mon, 5 Oct 2026 20:10:22 -0300
Subject: [PATCH] Replace jsonista with charred to drop jackson-core

jsonista 0.3.13 pulls jackson-core 2.18.2, flagged by CVE-2026-89425
(GHSA-7hhh-6rmp-j9qf). charred is jackson-free and produces identical
output for metrepl's metric payloads (keywords, strings, numbers,
booleans, nested maps/vectors) with :escape-slash false to match
jsonista's default of not escaping forward slashes.

Adds format_test.clj covering :json, :edn, and :summary paths; the
format namespace previously had no test coverage.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 deps.edn                     |  2 +-
 src/metrepl/format.clj       |  6 +++---
 test/metrepl/format_test.clj | 33 +++++++++++++++++++++++++++++++++
 3 files changed, 37 insertions(+), 4 deletions(-)
 create mode 100644 test/metrepl/format_test.clj

diff --git a/deps.edn b/deps.edn
index 31fe5e8..e90be53 100644
--- a/deps.edn
+++ b/deps.edn
@@ -1,7 +1,7 @@
 {:paths ["src"]
  :deps {nrepl/nrepl {:mvn/version "1.5.0"}
         org.clojure/java.classpath {:mvn/version "1.1.0"}
-        metosin/jsonista {:mvn/version "0.3.13"}
+        com.cnuernber/charred {:mvn/version "1.037"}
         io.opentelemetry/opentelemetry-sdk-extension-autoconfigure {:mvn/version "1.51.0"}
         io.opentelemetry/opentelemetry-api {:mvn/version "1.51.0"}
         io.opentelemetry/opentelemetry-exporter-otlp {:mvn/version "1.51.0"}}
diff --git a/src/metrepl/format.clj b/src/metrepl/format.clj
index 7a9bbcb..9190cb3 100644
--- a/src/metrepl/format.clj
+++ b/src/metrepl/format.clj
@@ -1,7 +1,7 @@
 (ns metrepl.format
   (:require
-   [clojure.string :as string]
-   [jsonista.core :as j]))
+   [charred.api :as json]
+   [clojure.string :as string]))
 
 (defn ^:private ->summary [data]
   (format "%s %s %s [%s] - %s"
@@ -15,7 +15,7 @@
   (pr-str (update data :timestamp str)))
 
 (defn ^:private ->json [data]
-  (j/write-value-as-string data))
+  (json/write-json-str data :escape-slash false))
 
 (defn parse-data ^String [data format]
   (case format
diff --git a/test/metrepl/format_test.clj b/test/metrepl/format_test.clj
new file mode 100644
index 0000000..9fa6824
--- /dev/null
+++ b/test/metrepl/format_test.clj
@@ -0,0 +1,33 @@
+(ns metrepl.format-test
+  (:require
+   [clojure.test :refer [deftest is testing]]
+   [metrepl.format :as format]))
+
+(deftest parse-data-json-test
+  (testing "serializes keywords, strings, numbers, bools, nested maps and vectors"
+    (is (= "{\"metric\":\"event/op-completed\",\"level\":\"info\",\"payload\":{\"op\":\"eval\",\"time-ms\":12}}"
+           (format/parse-data {:metric :event/op-completed
+                               :level :info
+                               :payload {:op "eval" :time-ms 12}}
+                              :json))))
+  (testing "does not escape forward slashes in namespaced keywords"
+    (is (= "{\"metric\":\"info/repl-ready\"}"
+           (format/parse-data {:metric :info/repl-ready} :json))))
+  (testing "serializes nested maps and vectors"
+    (is (= "{\"summary\":{\"pass\":3,\"fail\":0},\"ns\":[\"a\",\"b\"]}"
+           (format/parse-data {:summary {:pass 3 :fail 0} :ns ["a" "b"]} :json)))))
+
+(deftest parse-data-edn-test
+  (testing "serializes as edn with stringified timestamp"
+    (is (= "{:timestamp \"2026-10-05\", :op \"eval\"}"
+           (format/parse-data {:timestamp "2026-10-05" :op "eval"} :edn)))))
+
+(deftest parse-data-summary-test
+  (testing "renders the summary line"
+    (is (= "2026-10-05 host INFO [event/op-completed] - {:op \"eval\"}"
+           (format/parse-data {:timestamp "2026-10-05"
+                               :hostname "host"
+                               :level :info
+                               :metric :event/op-completed
+                               :payload {:op "eval"}}
+                              :summary)))))