I would like to update python-ujson in Fedora 35 from 3.0.0 to 5.4.0.

The 5.4.0 release contains fixes for CVE-2022-31117 and CVE-2022-31116. The latter is fixed by a series of commits that are not trivial to safely backport. Furthermore, updating past 5.1.0 also fixes CVE-2021-45958, and updating past 5.3.0 fixes some memory safety issues that don’t seem to be associated with CVEs but could potentially have security implications.

While updating by two major versions would seem disruptive, a review of the upstream changelogs shows that each time the major version was bumped, the breaking change was the removal of support for an old Python version. From the perspective of Fedora, such a change is not incompatible. Furthermore, I used COPR to verify that the update introduces no regressions to dependent packages.

Overall, I have no reason to believe that this update contains any incompatible or disruptive changes in practice. Still, given the large apparent difference in the version number, I’ve chosen to request a formal exception before proceeding.