Serializer::JSON: deserialize ignores engine config that serialize honours

Status: reasoned from code

lib/Dancer2/Serializer/JSON.pm:50-57. serialize merges $self->config into its options (lines 39-41); deserialize does not — it only sets utf8 and deletes strict_utf8.

So allow_nonref and every other configured option apply in one direction only, despite being configured in one place. That is surprising and undocumented.

Suggested fix

Mirror the merge loop from serialize, but be deliberate about which options are safe to honour on the decode side. Blindly forwarding every config key to the decoder could enable options nobody intended, so an allowlist is probably right.

Worth explicitly supporting max_depth and max_size as hardening while in there — JSON::XS defaults to max_depth 512 and max_size 0 (unlimited), and neither is currently settable from Dancer2 config.

Start in lib/Dancer2/Serializer/JSON.pm at lines 39-41 and 50-57, comparing how serialize merges $self->config with how deserialize builds its options. Identify which configured decoder options are safe to allow, including max_depth and max_size. Done means supported configuration affects deserialization consistently without forwarding unsafe or unintended keys.