chore(deps): bump fastjson2 to 2.0.63

[Fyzu]

Upgrades the JSON engine from 2.0.62 → 2.0.63 (latest release on Maven Central; the .android5/.android8 classifiers on the same tag are Android-only variants and are not used here).

What changed

• pom.xml — <fastjson2.version> 2.0.62 → 2.0.63
• README.md — the fastjson2 row in the dependency table had drifted (still listed 2.0.61 while the pom was on 2.0.62); refreshed to 2.0.63

No source changes were needed — 2.0.63 introduces no API changes, and every fastjson2 entry point buff-json depends on (writeNameRaw(byte[]/char[]), writeString(long), writeBase64(byte[]), isUTF8(), JSONWriter/JSONReader construction) is unchanged.

Why

2.0.63 is primarily security hardening and robustness:

• Stricter AutoType validation — type names containing URL-special characters are rejected before class loading, and whitelist hash matches now require text verification (guards against hash collisions)
• Number-literal digit limit, guarding against BigInteger DoS from extremely long numeric literals
• JSONB BC_BIGINT and BC_BINARY declared-length OOM fixes (crafted payloads declaring huge lengths)
• Metaspace leak fix for uncached ObjectWriter instances
• Reference detection fixed for Collection elements such as HashSet
• Minor perf: getInt/setInt hoisted out of lambdas

The decoder-facing items are the relevant ones for buff-json, since BuffJsonDecoder parses caller-supplied JSON.

Verification

• mvn clean install on the full reactor — green, 482 tests, 0 failures / 0 errors / 0 skipped (covers all three encode paths: codegen, typed-accessor, pure reflection, plus schema, buf.validate, Jackson and memory-leak reachability tests). The build runs with -Xlint:all,-processing -Werror, so any new deprecation or warning from the upgrade would have failed it.

• ./allocation-check.sh — all 8 benchmarks within budget, no allocation regression on the hot encode paths:

  Benchmark	Measured	Budget
  ComplexMessageBenchmark.buffJsonCompiled	1531.7 B/op	2300
  ComplexMessageBenchmark.buffJsonRuntime	1395.7 B/op	2500
  DoubleHeavyBenchmark.compiledUtf16	1773.3 B/op	2200
  DoubleHeavyBenchmark.compiledUtf8	1749.3 B/op	2100
  SimpleMessageBenchmark.compiledUtf16	295.5 B/op	380
  SimpleMessageBenchmark.compiledUtf8	271.5 B/op	350
  SimpleMessageBenchmark.runtimeUtf16	295.5 B/op	400
  SimpleMessageBenchmark.runtimeUtf8	271.5 B/op	380

• Dependency resolution confirmed as 2.0.63 in every consuming module (buff-json provided, buff-json-schema compile, buff-json-jackson provided).

The official protobuf proto3 JSON conformance suite was not run locally — it needs the C++ conformance_test_runner built from protobuf source. The CI conformance job runs it (enforced, once per path: codegen / runtime / reflection) on this PR.

---

Generated by Claude Code