Merge remote-tracking branch 'upstream/master'

DESCRIPTION

@@ -1,5 +1,5 @@
 Package: jsonlite
-Version: 1.8.8.999
+Version: 1.8.9.999
 Title: A Robust, High Performance JSON Parser and Generator for R (adjusted for use in MIRO)
 License: MIT + file LICENSE
 Depends: methods

NEWS

@@ -1,5 +1,6 @@
 1.8.8
   - Apply libyajl patches for CVE-2022-24795, CVE-2022-24795, CVE-2023-33460
+  - Fix printf warnings for cran
 
 1.8.7
   - toJSON(digits = NA) once again prints 15 digits max

R/stream.R

@@ -2,11 +2,11 @@
 #'
 #' The `stream_in` and `stream_out` functions implement line-by-line processing
 #' of JSON data over a [connection], such as a socket, url, file or pipe. JSON
-#' streaming requires the [ndjson](http://ndjson.org) format, which slightly differs
+#' streaming requires the [ndjson](https://ndjson.org) format, which slightly differs
 #' from [fromJSON()] and [toJSON()], see details.
 #'
 #' Because parsing huge JSON strings is difficult and inefficient, JSON streaming is done
-#' using **lines of minified JSON records**, a.k.a. [ndjson](http://ndjson.org).
+#' using **lines of minified JSON records**, a.k.a. [ndjson](https://ndjson.org).
 #' This is pretty standard: JSON databases such as MongoDB use the same format to
 #' import/export datasets. Note that this means that the
 #' total stream combined is not valid JSON itself; only the individual lines are. Also note

src/parse.c

@@ -35,7 +35,7 @@ SEXP R_parse(SEXP x, SEXP bigint_as_char) {
 
     /* parser error */
     if (!node) {
-      Rf_errorcall(R_NilValue, errbuf);
+      Rf_errorcall(R_NilValue, "%s", errbuf);
     }
     SEXP out = ParseValue(node, bigint);
     yajl_tree_free(node);

src/push_parser.c

@@ -68,5 +68,5 @@ SEXP R_parse_connection(SEXP sConn, SEXP bigint_as_char){
     strncpy(errbuf, (char *) errstr, bufsize - 1);
     yajl_free_error(push_parser, errstr);
     yajl_free(push_parser);
-    Rf_error(errbuf);
+    Rf_error("%s", errbuf);
 }