corvus_json_schema 0.1.1 → 0.1.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 31371364d14a0b654889fc47b325553d0c8c0851da6acdf8a32794704aca30d5
-  data.tar.gz: a5769ffed7a3d92f28959821e68890acfcedb84afe072771416a2ca602b023aa
+  metadata.gz: c49a0e22cb2d5d434a1cc48ff218ee2d8a1c75e12721672f8555ec1d7829ea4e
+  data.tar.gz: da2296f3cf10c8b9cd4e55c5455c4e159ba447530eaafaeda3d1692893d2b71a
 SHA512:
-  metadata.gz: 7410802842bb6dcbf949cf63cba86c429430e4aa8a8fe901fbe30a2ff9ff475278c64440e84296795f0f25528fc43780e0c1b46a6c46552ca930ae9a8085d1a5
-  data.tar.gz: 5221fd2ea871f4ec29864c29e975ff623c75d85afe36a5a1a9fad86f39eb9d5a1cb886d3c261f00792eb515589c49f5ce5a246471ad5c2e0befc0dd5853fbc93
+  metadata.gz: 131e37b22d753a2c9bd803a333a014796fd9dd0cf66f91a87f83d442b9afb34d6d60960da00d62c213be2e502634e96dcb6222a6f07395b1b245c9a23456a63b
+  data.tar.gz: 77e5b94a420597102e3c70d138778f9ad0744efdda767d258d47a20131b8b06a9aa571c4c159b8136180693c3c70623aa352d6863b0274e68bff7f340d456916

data/Cargo.lock

@@ -63,7 +63,7 @@ dependencies = [
 
 [[package]]
 name = "corvus-json-schema"
-version = "0.1.4"
+version = "0.1.6"
 dependencies = [
  "regex",
  "regress",
@@ -72,7 +72,7 @@ dependencies = [
 
 [[package]]
 name = "corvus_json_schema"
-version = "0.1.1"
+version = "0.1.3"
 dependencies = [
  "corvus-json-schema",
  "magnus",

data/README.md

@@ -11,7 +11,7 @@ standalone evaluator.
   validated without creating Ruby objects for it.
 - **Precompiled**: native gems for Linux (x86_64 and aarch64, glibc and musl), macOS (x86_64 and arm64) and Windows
   (x64), for Ruby 3.3, 3.4 and 4.0. On other platforms the source gem builds the extension, which needs a Rust
-  toolchain (1.85 or later) and libclang.
+  toolchain (1.89 or later) and libclang.
 
 ## Install
 

data/VERSIONHISTORY.md

@@ -2,6 +2,24 @@
 
 The version history of the `corvus_json_schema` Ruby gem. It is versioned independently of the Corvus NuGet packages and of the [corvus-json-schema](../../src-rs/corvus-json-schema/VERSIONHISTORY.md) Rust crate it is built on.
 
+## V0.1.3
+
+V0.1.3 fixes `gem install corvus_json_schema` on Alpine Linux and other musl systems, where RubyGems before 4.0 could install the glibc gem, which does not load there. There are no API changes, and the extension is the one in 0.1.2. Versions 0.1.0 to 0.1.2 are affected.
+
+### Bug fixes
+
+- **`gem install` on a musl system with RubyGems before 4.0 (the RubyGems of Ruby 3.3 and 3.4).** The precompiled glibc gems had the platforms `x86_64-linux` and `aarch64-linux`. On a musl Ruby, those versions of RubyGems rank such a gem equal to the musl gem (`x86_64-linux-musl`) and install whichever comes last in their own ordering. Since 0.1.1 was published that has been the glibc gem, and `require "corvus_json_schema"` then failed with a `LoadError` naming `ld-linux-x86-64.so.2`. The glibc gems now have the platforms `x86_64-linux-gnu` and `aarch64-linux-gnu`, which RubyGems does not offer to a musl Ruby at all, so the musl gem is the one installed. Bundler was not affected, and neither was any glibc system, macOS or Windows.
+
+  The earlier versions stay as they are. On a musl system with RubyGems before 4.0, install 0.1.3 or later, or install an earlier version with Bundler.
+
+## V0.1.2
+
+V0.1.2 fixes a crash of the Ruby process for a schema whose `not` leads back to the schema it is in, by taking version 0.1.6 of the corvus-json-schema crate. There are no API changes. Versions 0.1.0 and 0.1.1 are affected.
+
+### Bug fixes
+
+- **A `not` that leads back to the schema it is in.** A schema can loop without consuming the instance. The gem abandons such an evaluation at `max_depth` (128 by default) and raises `CorvusJsonSchema::DepthError`. Evaluating `not` went around that guard. For a schema such as `{"not": {"$ref": "#"}}`, validating an instance that reached the `not` recursed in the native extension until the stack overflowed, which crashes the Ruby process. `valid?`, `valid_json?` and `evaluate` were all affected. A `not` is now under the guard, so they raise `CorvusJsonSchema::DepthError`. The fault is in the schema. No instance causes it for a schema without such a loop, so a program was exposed only if it compiled schemas it did not write. A schema that loops elsewhere under a `not` was not affected in this gem: it raised `CorvusJsonSchema::DepthError`, and still does.
+
 ## V0.1.1
 
 V0.1.1 fixes wrong validation results for one form of pattern, by taking version 0.1.4 of the corvus-json-schema crate. There are no API changes. Version 0.1.0 is affected.

data/ext/corvus_json_schema/Cargo.toml

@@ -1,8 +1,8 @@
 [package]
 name = "corvus_json_schema"
-version = "0.1.1"
+version = "0.1.3"
 edition = "2024"
-rust-version = "1.85"
+rust-version = "1.89"
 description = "The native extension of the corvus_json_schema gem: the corvus-json-schema crate, reading Ruby values in place."
 license = "Apache-2.0"
 publish = false
@@ -12,7 +12,7 @@ crate-type = ["cdylib"]
 
 [dependencies]
 # The crate, copied in by `rake vendor` (from src-rs/corvus-json-schema) so that the source gem builds on its own.
-corvus = { package = "corvus-json-schema", path = "vendor/corvus-json-schema", version = "0.1.4" }
+corvus = { package = "corvus-json-schema", path = "vendor/corvus-json-schema", version = "0.1.6" }
 magnus = { version = "0.9.1", features = ["rb-sys"] }
 rb-sys = "0.9.130"
 serde_json = { version = "1.0.151", features = ["preserve_order", "float_roundtrip"] }

data/ext/corvus_json_schema/clippy.toml

@@ -0,0 +1,4 @@
+# Clippy suggests idioms by the minimum Rust version. The declared minimum (rust-version in Cargo.toml) was corrected
+# from 1.85 to 1.89 with no change to the source, so the lints stay at the level the source was written to. Raise this
+# when the source is next revised for the newer idioms.
+msrv = "1.85"

data/ext/corvus_json_schema/vendor/corvus-json-schema/Cargo.toml

@@ -1,8 +1,8 @@
 [package]
 name = "corvus-json-schema"
-version = "0.1.4"
+version = "0.1.6"
 edition = "2024"
-rust-version = "1.85"
+rust-version = "1.89"
 description = "A high-performance JSON Schema evaluator (draft 4 to 2020-12) with results collection and annotations, ported from the Corvus.Text.Json V5 runtime evaluator."
 license = "Apache-2.0"
 repository = "https://github.com/corvus-dotnet/Corvus.JsonSchema"

data/ext/corvus_json_schema/vendor/corvus-json-schema/src/eval/plan.rs

@@ -1268,7 +1268,8 @@ impl Evaluator<'_, '_> {
                 }
                 matched == 1
             }
-            Op::Not(c) => !self.run(*c, x),
+            // Under the depth guard, like every other in-place applicator: a not can be part of a cycle too.
+            Op::Not(c) => !self.run_in_place(*c, x),
             Op::DynamicRef(d) => {
                 let target = self.p.fast_target[self.resolve_dynamic(d) as usize];
                 self.run_in_place(target, x)

data/ext/corvus_json_schema/vendor/corvus-json-schema/src/eval.rs

@@ -597,7 +597,9 @@ impl<'p, 'c> Evaluator<'p, 'c> {
     /// Evaluates the program's entry in fast mode.
     pub fn validate<'x, I: Instance<'x>>(&mut self, x: I) -> bool {
         let root = self.p.fast_target[self.p.root as usize];
-        self.fast(root, x)
+        // An evaluation that recursed in place beyond the maximum depth is not valid, whatever it came to: the
+        // branch that was abandoned counts as false, which a not above it turns into true.
+        self.fast(root, x) && !self.depth_exceeded
     }
 
     /// Fail-fast evaluation of a node, through its plan when there are plans.
@@ -1413,16 +1415,28 @@ impl<'p, 'c> Evaluator<'p, 'c> {
             check!(self, M, ok, matched == 1, Message::Static(message), "oneOf");
         }
         if let Some(not) = n.not {
-            // Not elided, never contributes results or evaluated properties/items.
-            let inner = if M::COLLECT {
+            // Not elided, never contributes results or evaluated properties/items. A not on an in-place cycle is
+            // under the depth guard, like every other in-place applicator.
+            let target = if M::COLLECT { not } else { self.p.fast_target[not as usize] };
+            let guarded = self.node(target).in_place_cycle;
+            if guarded {
+                self.depth += 1;
+            }
+            let inner = if guarded && self.depth > self.p.max_depth {
+                self.depth_exceeded = true;
+                false
+            } else if M::COLLECT {
                 let pointer = &self.node(not).pointer;
                 self.col().begin_child_context(Some("not"), Some(pointer), None);
                 let inner = self.eval_node::<Collect, I>(not, x, None);
                 self.col().pop_child_context();
                 inner
             } else {
-                self.fast(self.p.fast_target[not as usize], x)
+                self.fast(target, x)
             };
+            if guarded {
+                self.depth -= 1;
+            }
             check!(self, M, ok, !inner, Message::Static(if inner { MATCHED_NOT } else { DID_NOT_MATCH_NOT }), "not");
         }
         if let Some(cond_node) = n.if_ {

data/lib/corvus_json_schema/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module CorvusJsonSchema
-  VERSION = "0.1.1"
+  VERSION = "0.1.3"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: corvus_json_schema
 version: !ruby/object:Gem::Version
-  version: 0.1.1
+  version: 0.1.3
 platform: ruby
 authors:
 - endjin
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-10-08 00:00:00.000000000 Z
+date: 2026-10-12 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rb_sys
@@ -39,6 +39,7 @@ files:
 - README.md
 - VERSIONHISTORY.md
 - ext/corvus_json_schema/Cargo.toml
+- ext/corvus_json_schema/clippy.toml
 - ext/corvus_json_schema/extconf.rb
 - ext/corvus_json_schema/rustfmt.toml
 - ext/corvus_json_schema/src/lib.rs