ujson: Ultra Fast JSON for Python

5.12.0 · maintenance · verified Sun Mar 29

UltraJSON (ujson) is an ultra-fast JSON encoder and decoder for Python, implemented in pure C with Python bindings. It focuses on performance for serialization and deserialization tasks. As of version 5.12.0, the project is in a maintenance-only mode due to architectural challenges in making changes without introducing security vulnerabilities. Support for new Python versions and critical bug/security fixes will continue, but other changes are generally rejected.

Warnings

breaking As of v5.9.0, if a custom `toDict()` method on an object returns a non-dictionary type, it will now raise a `TypeError` instead of silently converting the value to `null`.
Fix: Ensure that any custom `toDict()` implementation always returns a dictionary, or handle the `TypeError` appropriately.
breaking As of v5.9.0, boolean dictionary keys are now serialized using lowercase strings ('true'/'false') instead of potentially mixed case strings. This changes the output JSON structure for such keys.
Fix: Update parsers or consumers of ujson output to expect lowercase boolean strings for dictionary keys.
breaking As of v5.11.0, `ujson.loads()` now consistently raises a `JSONDecodeError` for parsing issues, aligning with the standard library's `json` module. Previously, it might have raised a `SystemError` in some error scenarios.
Fix: Update error handling blocks to catch `JSONDecodeError` (or its base class `ValueError`) instead of `SystemError` for JSON parsing failures.
deprecated Support for Python 3.9 was dropped in v5.12.0.
Fix: Upgrade to Python 3.10 or newer. For projects requiring Python 3.9, pin ujson to `<5.12.0`.
deprecated Support for Python 3.8 and EOL PyPy3.8-PyPy3.10 was dropped in v5.11.0.
Fix: Upgrade to Python 3.9 or newer, or PyPy3.11 or newer. For projects requiring these EOL versions, pin ujson to `<5.11.0`.
gotcha UltraJSON is in maintenance mode due to its C architecture being prone to security vulnerabilities like buffer overflows. Users are encouraged to consider alternatives like `orjson` which offers similar performance with potentially better security characteristics.
Fix: Evaluate migrating to `orjson` for new projects or existing projects where security is a paramount concern.
gotcha Previous versions (pre-5.4.0 and pre-5.3.0) had critical bugs including CVEs related to buffer overflows, double-frees, and various segmentation faults/memory leaks during error handling or with specific data types (e.g., large integers, non-string dict keys). While many of these have been fixed, they highlight the library's potential for low-level issues.
Fix: Ensure you are using the latest stable version of ujson (5.12.0 or newer) to benefit from security and stability fixes.

Install

pip install ujson Install with pip

Imports

ujson
```
import ujson
```

Quickstart

This example demonstrates how to encode a Python dictionary into a JSON string using `ujson.dumps()` and then decode a JSON string back into a Python dictionary using `ujson.loads()`.

import ujson

data = {
    "name": "Alice",
    "age": 30,
    "is_student": False,
    "courses": ["Math", "Science"],
    "address": None
}

# Encode Python dict to JSON string
json_string = ujson.dumps(data, indent=4) # indent for pretty-printing
print("Encoded JSON:", json_string)

# Decode JSON string to Python dict
decoded_data = ujson.loads(json_string)
print("Decoded data:", decoded_data)
print("Type of decoded_data:", type(decoded_data))

view raw JSON →