safeParse returns null rather than undefined, but null is a valid JSON value.

[Arlen22]

Prerequisites

• I have written a descriptive issue title
• I have searched existing issues to ensure the issue has not already been raised

Issue

safeParse returns null if parsing fails, but it should return undefined, because JSON.parse will never return undefined, but it will return null. 'null' is valid JSON, 'undefined' will throw. With it returning null, there is no way to tell that parsing failed.

You had one job! 😢 Ok, technically that wasn't your one job. But now I guess I'll have to fork it just to change that.

[mcollina]

A PR would be awesome of course!

[Arlen22]

The package has 6M+ weekly downloads, so I'd have to fully understand everything going on related to this before I could think of opening a PR.

I did end up figuring out that most of the complication in the library is just to make it faster than using a reviver, so I ended up just using a reviver.

[kibertoad]

@Arlen22 what does amount of downloads have to do with the scope of the change? it should be a pretty simple adjustment

[Arlen22]

I don't know why you're asking me to open a PR on a change that simple. I'm just a drive-by user who was trying to find a parsing library that took care of the security problem. Next thing you'll merge my one line PR without even wondering how many applications it breaks.

Think about all the applications that could have possibly used a triple equals sign, relying on the fact that it returns null if parsing fails.

Changing that to undefined would suddenly break all those applications. So no I can't just open a PR because you can't just merge a PR for this one.

[kibertoad]

@Arlen22 Semver exists for a reason, and fastify ecosystem follows it strictly. As long as it's done in a well-documented way, introducing such change in a major version bump is perfectly fine, and people are expected to check their code for breakage when bumping semver major.

[gurgunday]

But now I guess I'll have to fork it just to change that.

Welcome to OSS 😄

Think about all the applications that could have possibly used a triple equals sign, relying on the fact that it returns null if parsing fails.

Well it still doesn't prevent you from creating a PR, we'd think about all that before merging of course, and yeah like @kibertoad said, this would be a major