Migrate from encoding/json to encoding/json/v2 and encoding/json/jsontext

[Claude]

Go 1.27 ships encoding/json/v2 (semantic JSON) and encoding/json/jsontext (syntactic JSON) as standard library packages. This PR migrates all encoding/json v1 usage to these new packages.

Changes

audit.go — semantic unmarshaling

• Import encoding/json/v2
• json.Unmarshal → jsonv2.Unmarshal
• Existing UnmarshalJSON([]byte) error methods remain — v2 still honours the Unmarshaler interface

composer_lock.go — streaming/syntactic decoder

• Import encoding/json/jsontext
• *json.Decoder / json.NewDecoder → *jsontext.Decoder / jsontext.NewDecoder
• json.Delim → jsontext.Kind; delimiter constants replace rune literals ('{' → jsontext.KindBeginObject, etc.)
• decoder.More() → decoder.PeekKind() != jsontext.KindEnd{Object,Array}
• decoder.Token() → decoder.ReadToken(); token type assertions replaced with tok.Kind() / tok.String()
• skipJSONValue removed — replaced by the built-in decoder.SkipValue()

composer_lock_test.go

• Updated decoder construction and type references to jsontext
• skipJSONValue(dec) → dec.SkipValue()
• json.Delim literal values replaced with jsontext.Kind constants

[Copilot]

Pull request overview

Migrates JSON parsing to Go 1.27’s v2 semantic and syntactic APIs.

Changes:

• Uses encoding/json/v2 for audit unmarshaling.
• Uses jsontext.Decoder for composer.lock streaming.
• Updates decoder tests and malformed-input coverage.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
audit.go	Migrates semantic unmarshaling.
composer_lock.go	Migrates token-based parsing and value skipping.
composer_lock_test.go	Updates tests for jsontext.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.