Bump orjson from 3.11.9 to 3.12.0

[dependabot]

Bumps orjson from 3.11.9 to 3.12.0.

Release notes

Sourced from orjson's releases.

3.12.0

Changed

• Serialization implementation substantially rewritten.
• Publish PyPI wheels for Python 3.15. For Python 3.15 and later, manylinux_2_39 (2024) is targeted instead of manylinux_2_17 (2012).
• No longer publish PyPI wheels for ppc64le and s390x.

Changelog

Sourced from orjson's changelog.

3.12.0 - 2026-08-14

Changed

• Serialization implementation substantially rewritten.
• Publish PyPI wheels for Python 3.15. For Python 3.15 and later, manylinux_2_39 (2024) is targeted instead of manylinux_2_17 (2012).
• No longer publish PyPI wheels for ppc64le and s390x.

Commits

• 6737895 3.12.0
• c2a6e8f JsonWriter, iterators
• 6a2d7a7 yyjson 1ea2fb0
• 97bf170 build update
• See full diff in compare view

[github-actions]

🤖 Claude Code Review

No lock file in this repo, so nothing else needs updating. This is a routine dependabot dependency bump.

Code Review: Bump orjson from 3.11.9 to 3.12.0

Code Quality

• ✅ Style conventions — single-line version pin change, consistent with existing formatting.
• ✅ No commented-out code
• ✅ Meaningful variable names — N/A, no code logic changed.
• ✅ DRY principle — N/A.
• ✅ Defects — Pinned exact version bump (orjson==3.11.9 → ==3.12.0), a minor version bump per semver. No logic touched, low risk. senzing >= 4.0.0 constraint unaffected.
• ✅ CLAUDE.md review — .claude/CLAUDE.md unchanged in this diff; existing content is general (no local-machine-specific paths/settings). No issue.

Testing

• N/A — dependency bump only, no new functions/endpoints. CI test suite (make clean setup test) should be relied on to catch any orjson 3.12.0 compatibility regressions (e.g., serialization behavior changes) before merge — recommend confirming CI is green.

Documentation

• ⚠️ CHANGELOG.md not updated — but this matches the project's established pattern: prior dependency-bump commits (ba6cac1 wheel, f4b92a2 virtualenv, 47e9c3a pylint, and this repo's [1.0.3] release which lists "Updated dependencies" as a single batched entry) also skip per-PR CHANGELOG edits. Not a blocker given precedent.
• ✅ No README/API doc changes needed for a pure version bump.
• ✅ No markdown files touched.

Security

• ✅ No hardcoded credentials.
• ✅ No input validation concerns.
• ✅ No error handling changes.
• ✅ No sensitive data in logs.
• ✅ No .lic files or AQAAAD-prefixed strings present in this diff.

Summary

This is a low-risk, routine dependabot dependency bump with no code logic changes. No blocking issues found. Recommend verifying CI passes (particularly any tests exercising orjson serialization) before merge, since orjson has a track record of subtle behavior changes across minor versions (e.g., float/datetime serialization edge cases).

Automated code review analyzing defects and coding standards

[github-actions]

Coverage report

Click to see where and how coverage changed

File	Statements	Missing	Coverage	Coverage (new stmts)	Lines missing
src/senzing_core
_helpers.py
Project Total

This report was generated by python-coverage-comment-action

[github-actions]

🤖 Claude Code Review

PR Code Review

Scope: Single-line dependency bump (Dependabot) — orjson 3.11.9 → 3.12.0 in pyproject.toml. This is a minor semver update per the commit metadata (update-type: version-update:semver-minor), consistent with prior dependency-bump PRs in this repo's history (mypy, wheel, virtualenv) which also didn't touch CHANGELOG.md.

Code Quality

• ✅ Style/formatting — single version-string change, follows existing pyproject.toml conventions.
• ✅ No commented-out code.
• ✅ N/A — no variable naming involved.
• ✅ DRY — N/A, trivial version bump.
• ✅ Defects — no logic changes; no new bugs, race conditions, or crash paths introduced. orjson version is pinned exactly (==3.12.0), consistent with the prior pin style, so no unbounded-range risk.
• ✅ .claude/CLAUDE.md reviewed — content is general (build/test/lint commands, architecture, settings dict) and contains no local-machine-specific paths or credentials beyond documented Senzing install locations (/opt/senzing/er/lib), which are standard/documented install paths, not machine-specific secrets.

Testing

• ✅ N/A — dependency version bump only, no new functions/endpoints introduced.
• ⚠️ No indication CI was run against the new orjson version in this diff snapshot; recommend confirming make clean setup test passes in CI before merge (standard for dependency bumps, not a defect in the diff itself).

Documentation

• ✅ Readme — not applicable.
• ✅ API docs — not applicable.
• ✅ Inline comments — not applicable.
• ⚠️ CHANGELOG.md not updated. However, this matches the precedent set by the prior dependency-bump commits in git log (mypy 2.3.0→2.3.1, wheel 0.47.0→0.48.0, virtualenv 21.7.3→21.7.4) — none of those updated CHANGELOG.md either, and the last CHANGELOG entry ("Updated dependencies" for 1.0.3) suggests these are batched at release time rather than per-PR. Not a blocker given repo convention.
• ✅ No markdown files changed in this diff.

Security

• ✅ No hardcoded credentials.
• ✅ No input validation concerns — dependency bump only.
• ✅ No error handling changes.
• ✅ No sensitive data/logs touched.
• ✅ No .lic files or AQAAAD-prefixed strings present in this diff.

Verdict

✅ Approve. Trivial, low-risk dependency bump consistent with repo conventions. No blocking issues found.

Automated code review analyzing defects and coding standards