# Patch release of elm/json 1.1.4

**URL:** <https://discourse.elm-lang.org/t/patch-release-of-elm-json-1-1-4/10440>\
**Category:** Request Feedback\
**Created:** [September 19, 2025, 8:17pm UTC](https://discourse.elm-lang.org/t/patch-release-of-elm-json-1-1-4/10440 "2025-09-19T20:17:57Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![novid](https://yyz1.discourse-cdn.com/flex035/user_avatar/discourse.elm-lang.org/novid/32/4341_2.png) [@novid](https://discourse.elm-lang.org/u/novid)\
**Post date:** [September 19, 2025, 8:17pm UTC](https://discourse.elm-lang.org/t/patch-release-of-elm-json-1-1-4/10440/1 "2025-09-19T20:17:57Z")

</div>

A new Patch release of [elm/json package](https://package.elm-lang.org/packages/elm/json/1.1.4/) is available with updated kernel code for stricter validation. This release has no API changes and you can safely update your projects and libraries.

> <https://github.com/elm/json/commit/2865dfce97a75724a75583a214d3a287d2abecd4>

---

<div class="post-metadata">

**Author:** ![rupert](https://yyz1.discourse-cdn.com/flex035/user_avatar/discourse.elm-lang.org/rupert/32/1775_2.png) [@rupert](https://discourse.elm-lang.org/u/rupert)\
**Post date:** [September 20, 2025, 7:46am UTC](https://discourse.elm-lang.org/t/patch-release-of-elm-json-1-1-4/10440/2 "2025-09-20T07:46:28Z")

</div>

I read the code delta but I didn’t really understand it. What effect does this change have?

> <https://github.com/elm/json/commit/2865dfce97a75724a75583a214d3a287d2abecd4>

---

<div class="post-metadata">

**Author:** ![lydell](https://yyz1.discourse-cdn.com/flex035/user_avatar/discourse.elm-lang.org/lydell/32/178_2.png) [@lydell](https://discourse.elm-lang.org/u/lydell)\
**Post date:** [September 20, 2025, 9:13am UTC](https://discourse.elm-lang.org/t/patch-release-of-elm-json-1-1-4/10440/3 "2025-09-20T09:13:26Z")

</div>

It makes you immune to Elm packages that try to run arbitrary JavaScript code using elm/json. (No such packages are known to exist.)

> <https://gist.github.com/lydell/e1e6c9a7cb88590d48cc4826725dd584>

Kudos to @miniBill for finding these vulnerabilities. I just helped making that summary gist.

---

<div class="post-metadata">

**Author:** ![rupert](https://yyz1.discourse-cdn.com/flex035/user_avatar/discourse.elm-lang.org/rupert/32/1775_2.png) [@rupert](https://discourse.elm-lang.org/u/rupert)\
**Post date:** [September 20, 2025, 10:57am UTC](https://discourse.elm-lang.org/t/patch-release-of-elm-json-1-1-4/10440/4 "2025-09-20T10:57:59Z")

</div>

Hackers are devious but Elmers more so… great find @minibill.

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex035/uploads/elm_lang/original/1X/50a05e53677a2c3b47776d7abd0f113eb50193a1.png) [@system](https://discourse.elm-lang.org/u/system)\
**Post date:** [September 30, 2025, 10:58am UTC](https://discourse.elm-lang.org/t/patch-release-of-elm-json-1-1-4/10440/5 "2025-09-30T10:58:43Z")

</div>

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.