corvus_json_schema 0.1.3-aarch64-linux-gnu → 0.2.0-aarch64-linux-gnu

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 93983f03ee11cc4b75a1940ef4a4fd91049092cf9db20653f6c1d57d5bb8f720
-  data.tar.gz: 83b22038e47d1e6a4eb65e863cf561fff92defafa68e9389da122921abe927c7
+  metadata.gz: 1261db29344a5a875d88f34058ef33484dcf53d41e25fa4c52c93d54ec2159ae
+  data.tar.gz: 7b2476f0f749ad9922263b507e85bfc28bb81c36c4f085bccec885cfa3394072
 SHA512:
-  metadata.gz: 476870fd9312071837aad6ff7359ab50e1445dbcb6cb76d65bd9cdb2b3c01ecd2af7f007b95fe453c34e344f8725e04bc2f4ffd1616ab898d7021dbdfe1a103b
-  data.tar.gz: 9a86f64c14e216f6ac26743d6cd3e256ecf98d6be4b7032ea1bc81f17178b867dcb1534b3908241f2b43ded0e2b1363d00919ecc3a1d4c08fb01de0ebd8ecb36
+  metadata.gz: f6e8908eb1d392fc099c63dc4ad7b8b36af5af84b18f353f7f3694a07e68044ccbd93bfd1167046d5fad6639015e5e04da01e80cf43ae9b9c9c370616c8db10b
+  data.tar.gz: e03a0c1bb986dc365db591467f9532175d4cedd650ce1c2db94b39848229707c69b23c796772b2603b0c57d0be0d29287b515a77e5a6d72d03bb24febd8e2d5d

data/README.md

@@ -53,6 +53,9 @@ Its options:
 | `base_uri` | `nil` | The schema's base URI, when it has no `$id`. |
 | `entry_point` | `nil` | A reference to the subschema to validate against, such as `"#/$defs/item"`. |
 | `max_depth` | `128` | The deepest the evaluator recurses in place before it raises `DepthError`. |
+| `pattern_match_limit` | `1.0` | The seconds one match of a `pattern` or `patternProperties` regular expression against one string may take before the validation raises `PatternMatchLimitError`. `nil` or `0` turns the limit off, for a caller who trusts both the schema and the instances. |
+| `regex_edition` | `:dialect` | The edition of ECMA-262 `pattern`, `patternProperties` and the `regex` format are read with: `:dialect` (ECMAScript 2020 for 2019-09 and 2020-12, which name it, today's for the drafts before them), `:current` or `:es2020`. Under ECMAScript 2020 a modifier group such as `(?i:...)` is not valid. |
+| `regex_unicode_version` | `:default` | The version of Unicode patterns are read with: `:default` (the version of the V8 the answers are held to, 17 today), `:latest`, `13`, `17` or `18`. |
 
 A `Validator` is immutable and can be shared between threads.
 
@@ -65,7 +68,10 @@ A `Validator` is immutable and can be shared between threads.
   schema location.
 
 Errors are subclasses of `CorvusJsonSchema::Error`: `CompilationError` (an invalid schema, or a reference that cannot
-be resolved), `DepthError` and `InvalidJsonError` (for `valid_json?`). An error raised by a format or resolver callable
+be resolved), `PatternTooLargeError` (a `CompilationError` for a regular expression over a limit of size: 1,048,576
+bytes, 1,000 levels of groups, or about 16,000 terms), `DepthError`, `PatternMatchLimitError` (a match of a regular
+expression reached its limit, so the instance is neither valid nor not valid) and `InvalidJsonError` (for
+`valid_json?`). An error raised by a format or resolver callable
 propagates.
 
 ## Values
@@ -109,3 +115,8 @@ repository's submodule (or `JSON_SCHEMA_TEST_SUITE`).
 ## License
 
 Apache-2.0
+
+The gem is built on the `corvus-json-schema` Rust crate, which matches patterns with the `corvus-regex-ecma262` crate,
+whose Unicode tables are derived from the Unicode Character Database, which is under the Unicode License V3.
+[THIRD-PARTY-NOTICES.txt](THIRD-PARTY-NOTICES.txt) has that notice, and the one of the `regress` crate, from whose
+tables those were written. The file is in the source gem and in every native gem, beside `LICENSE`.

data/THIRD-PARTY-NOTICES.txt

@@ -0,0 +1,96 @@
+corvus_json_schema uses third-party libraries or other resources that may be
+distributed under licenses different than the corvus_json_schema software.
+
+In the event that we accidentally failed to list a required notice, please
+bring it to our attention. Post an issue or email us:
+
+           licensing@endjin.com
+
+The attached notices are provided for information only.
+
+License notice for the Unicode Character Database
+-------------------------------
+
+The gem is built on the corvus-json-schema Rust crate. The source gem holds
+the crate's sources (ext/corvus_json_schema/vendor/corvus-json-schema), and a
+native gem holds the extension compiled from them. That crate matches patterns
+with the corvus-regex-ecma262 crate, which is compiled in with it.
+corvus-regex-ecma262 holds tables derived from the data files of the Unicode
+Character Database, versions 13.0.0, 17.0.0 and 18.0.0
+(https://www.unicode.org/Public/), and from its emoji sequence files: the
+General_Category values, the binary properties, the Script and
+Script_Extensions values, the simple case folding, the simple uppercase
+mapping and the properties of strings. The data files are licensed under the
+Unicode License V3 (SPDX-License-Identifier: Unicode-3.0), as
+https://www.unicode.org/license.txt gives it:
+
+UNICODE LICENSE V3
+
+COPYRIGHT AND PERMISSION NOTICE
+
+Copyright © 1991-2026 Unicode, Inc.
+
+NOTICE TO USER: Carefully read the following legal agreement. BY
+DOWNLOADING, INSTALLING, COPYING OR OTHERWISE USING DATA FILES, AND/OR
+SOFTWARE, YOU UNEQUIVOCALLY ACCEPT, AND AGREE TO BE BOUND BY, ALL OF THE
+TERMS AND CONDITIONS OF THIS AGREEMENT. IF YOU DO NOT AGREE, DO NOT
+DOWNLOAD, INSTALL, COPY, DISTRIBUTE OR USE THE DATA FILES OR SOFTWARE.
+
+Permission is hereby granted, free of charge, to any person obtaining a
+copy of data files and any associated documentation (the "Data Files") or
+software and any associated documentation (the "Software") to deal in the
+Data Files or Software without restriction, including without limitation
+the rights to use, copy, modify, merge, publish, distribute, and/or sell
+copies of the Data Files or Software, and to permit persons to whom the
+Data Files or Software are furnished to do so, provided that either (a)
+this copyright and permission notice appear with all copies of the Data
+Files or Software, or (b) this copyright and permission notice appear in
+associated Documentation.
+
+THE DATA FILES AND SOFTWARE ARE PROVIDED "AS IS", WITHOUT WARRANTY OF ANY
+KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF
+THIRD PARTY RIGHTS.
+
+IN NO EVENT SHALL THE COPYRIGHT HOLDER OR HOLDERS INCLUDED IN THIS NOTICE
+BE LIABLE FOR ANY CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES,
+OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,
+WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION,
+ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THE DATA
+FILES OR SOFTWARE.
+
+Except as contained in this notice, the name of a copyright holder shall
+not be used in advertising or otherwise to promote the sale, use or other
+dealings in these Data Files or Software without prior written
+authorization of the copyright holder.
+
+License notice for https://github.com/ridiculousfish/regress
+-------------------------------
+
+The tables of the corvus-regex-ecma262 crate were written, through the tables
+of the Corvus Go module, from the property tables of regress (its gen-unicode
+tool), which are generated from the Unicode Character Database. regress is
+licensed under the MIT license or the Apache License, Version 2.0, at the
+user's option. Neither the gem nor the crates it is built on depend on it.
+
+MIT License
+
+Copyright (c) 2020 ridiculous_fish
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

data/VERSIONHISTORY.md

@@ -2,6 +2,39 @@
 
 The version history of the `corvus_json_schema` Ruby gem. It is versioned independently of the Corvus NuGet packages and of the [corvus-json-schema](../../src-rs/corvus-json-schema/VERSIONHISTORY.md) Rust crate it is built on.
 
+## V0.2.0
+
+V0.2.0 takes version 0.2.0 of the `corvus-json-schema` crate, which matches patterns with the [`corvus-regex-ecma262`](https://crates.io/crates/corvus-regex-ecma262) crate and reads them in the grammar of the dialect. It is a minor version because under 2019-09 and 2020-12 a pattern that uses what ECMAScript added after 2020 is no longer valid. Everything else that was there is unchanged, and there are two new options.
+
+- **The grammar of the dialect.** JSON Schema 2019-09 and 2020-12 name the grammar of ECMAScript 2020, and patterns under them are now read with it: a modifier group such as `(?i:...)`, or a group name used by two groups, is not valid, and `CorvusJsonSchema.compile` raises `CompilationError` for a schema with one in a `pattern`. A property escape that the tables of 2020 do not have (`\p{Script=Yezidi}`) is not valid with the `u` flag, so the pattern is read without it, where `\p` is the letter `p`, as a pattern with `\&` is. The `regex` format reads only the grammar of the flag. Drafts 4 to 7 read today's grammar, as before.
+- **`regex_edition:`** (`:dialect`, the default, `:current` or `:es2020`) chooses the edition for every dialect, and **`regex_unicode_version:`** (`:default`, the default, `:latest`, `13`, `17` or `18`) the version of Unicode. Another value raises `ArgumentError`.
+- **The engine.** Every pattern that no dedicated matcher of the crate takes is matched by `corvus-regex-ecma262`, whose answers are V8's for the whole of the ECMA-262 regular expression test data. The limits are those of 0.1.4. Over the jsonschema-benchmark corpora the crate validates in 0.98 of the time of 0.1.7 once warm, and takes 1.06 of it for the first validation and 1.05 to compile, since the engine builds a pattern's automaton on its first match.
+- **Notices.** `THIRD-PARTY-NOTICES.txt` names the tables of `corvus-regex-ecma262`, which the native gems now hold in place of the crate's own. The source gem no longer carries a copy of the crate's notice, which the crate no longer has.
+
+## V0.1.4
+
+V0.1.4 takes version 0.1.7 of the `corvus-json-schema` crate. That fixes wrong results for several forms of pattern and a validation that did not end, replaces the crate's regular expression engine, and gives every match of a pattern a limit of time. The functions and types that were there are unchanged, and there are additions for the limit. Versions 0.1.0 to 0.1.3 are affected.
+
+### The regular expression engine
+
+The crate no longer uses the `regress` crate for the patterns with a lookaround, a backreference or a modifier group. It matches them with an engine of its own, a port of the ECMA-262 engine of the Corvus Go module, and matches every pattern as it is written. The crate's [version history](../../src-rs/corvus-json-schema/VERSIONHISTORY.md) lists the patterns that were answered wrongly before (a repetition inside a repetition that lost its count or did not end, a backreference from inside its group, two groups with one name, case-insensitive matching without the `u` flag, a pattern that is valid only without the `u` flag and a character beyond the Basic Multilingual Plane, `\B` beside a character of several bytes, and others), and what was measured: V8's answer for all 4,268,313 texts of the ECMA-262 regular expression test data that can be asked.
+
+### Limits on regular expressions
+
+A schema and an instance may both come from outside, so a pattern is now bounded in what it costs. Nothing that was there has changed. There is one new option and there are two new errors.
+
+- **A match has a limit of one second.** `pattern_match_limit`, a keyword of `CorvusJsonSchema.compile`, is the seconds one match of a `pattern` or `patternProperties` regular expression against one string may take. The default is `CorvusJsonSchema::DEFAULT_PATTERN_MATCH_LIMIT`, `1.0`. `nil` or `0` turns the limit off for a caller who trusts both the schema and the instances. The limit is on each match, not on the validation.
+- **`CorvusJsonSchema::PatternMatchLimitError`** is raised by `valid?`, `valid_json?` and `evaluate` when a match reached the limit, or when its backtracking held 1,048,576 entries. The instance is then neither valid nor not valid. The message names the pattern and the limit. `compile` can raise it too, because a pattern of `patternProperties` is matched against the property names the schema declares.
+- **`CorvusJsonSchema::PatternTooLargeError`** is raised by `compile` for a schema with a regular expression over a limit of size: 1,048,576 bytes of pattern, 1,000 levels of groups, or 1,048,576 counted for it as it is read (a pattern of plain characters can be 16,384 characters long). It is a `CompilationError`, so code that rescues those still does. A regular expression that is not valid raises `CompilationError` itself, as before.
+
+### Bug fixes
+
+- **A separated list with a `$` inside it.** The crate matches a pattern of the form `^item(separator item)*$`, such as `^([a-z]+)(\.[a-z]+)*$`, without a regular expression engine. It dropped a `$` at the end of the first item or of the repeated group, so `^x(,a$)*$` was matched as `^x(,a)*$`. A `$` holds only at the end of the string, so the group of `^x(,a$)*$` can match once at most. `CorvusJsonSchema.compile({ "pattern" => '^x(,a$)*$' }).valid?("x,a,a")` returned `true`, where the instance is not valid. `^x$(,a)*$` took `"x,a"`, and `^(a,$)*b$` took `"a,b"`. `valid?`, `valid_json?` and `evaluate` were all affected, and so was a pattern used for `patternProperties` or `propertyNames`. Such a pattern is now matched by a regular expression engine. An escaped `\$` is a literal character and is matched as before. No other form of pattern was affected. The extension's crate requirement names 0.1.7, so the copy of the crate vendored at build time cannot be an older one.
+
+### Notices
+
+- **The notice of the Unicode data is in the gem.** The Unicode tables of the `corvus-json-schema` crate are derived from the Unicode Character Database, which is under the Unicode License V3. That license asks that its notice goes with every copy of the data. `THIRD-PARTY-NOTICES.txt` has it, with the notice of the `regress` crate that the tables were first read from, and is now in the source gem and in every native gem. Versions 0.1.0 to 0.1.3 carried no such notice.
+
 ## V0.1.3
 
 V0.1.3 fixes `gem install corvus_json_schema` on Alpine Linux and other musl systems, where RubyGems before 4.0 could install the glibc gem, which does not load there. There are no API changes, and the extension is the one in 0.1.2. Versions 0.1.0 to 0.1.2 are affected.

data/lib/corvus_json_schema/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module CorvusJsonSchema
-  VERSION = "0.1.3"
+  VERSION = "0.2.0"
 end

data/lib/corvus_json_schema.rb

@@ -25,6 +25,9 @@ module CorvusJsonSchema
     draft4: 4, draft6: 6, draft7: 7, draft201909: 2019, draft202012: 2020
   }.freeze
 
+  # The seconds one match of a regular expression may take, unless compile is told otherwise.
+  DEFAULT_PATTERN_MATCH_LIMIT = 1.0
+
   RESULTS_LEVELS = { basic: 0, detailed: 1, verbose: 2 }.freeze
 
   # Compiles a schema (a Hash or Array, true or false, or JSON text) into a Validator.
@@ -33,12 +36,24 @@ module CorvusJsonSchema
   # $schema), assert_format (nil follows the vocabularies), assert_format_in_legacy_drafts, assert_content, formats (a
   # Hash of format name to a callable returning whether a string is valid), resolver (a callable from an absolute URI
   # to the document, as a Hash or JSON text, or nil when unknown), base_uri, entry_point (a reference such as
-  # "#/$defs/item") and max_depth (of in-place recursion, default 128).
+  # "#/$defs/item"), max_depth (of in-place recursion, default 128) and pattern_match_limit (the seconds one match of
+  # a pattern or patternProperties regular expression may take, default 1. A match that takes longer is abandoned and
+  # the validation raises PatternMatchLimitError. nil or 0 turns the limit off, for a caller who trusts both the
+  # schema and the instances), regex_edition (the edition of ECMA-262 patterns are read with: :dialect, the default,
+  # which is ECMAScript 2020 for 2019-09 and 2020-12 and today's for the drafts before them, :current or :es2020) and
+  # regex_unicode_version (the version of Unicode they are read with: :default, Unicode 17 today, :latest, 13, 17 or
+  # 18).
+  #
+  # A schema that does not compile raises CompilationError, and one with a regular expression over a limit of size
+  # (1,048,576 bytes of pattern, 1,000 levels of groups) raises PatternTooLargeError, which is a CompilationError.
   def self.compile(schema, default_dialect: :draft202012, assert_format: nil, assert_format_in_legacy_drafts: false,
-                   assert_content: true, formats: nil, resolver: nil, base_uri: nil, entry_point: nil, max_depth: 128)
+                   assert_content: true, formats: nil, resolver: nil, base_uri: nil, entry_point: nil, max_depth: 128,
+                   pattern_match_limit: DEFAULT_PATTERN_MATCH_LIMIT, regex_edition: :dialect,
+                   regex_unicode_version: :default)
     dialect = DIALECTS.fetch(default_dialect) { raise ArgumentError, "unknown dialect #{default_dialect.inspect}" }
     Native.compile(schema, dialect, assert_format, assert_format_in_legacy_drafts, assert_content, formats, resolver,
-                   base_uri, entry_point, Integer(max_depth))
+                   base_uri, entry_point, Integer(max_depth), pattern_match_limit&.to_f, regex_edition.to_s,
+                   regex_unicode_version.to_s)
   end
 
   # The version of the corvus-json-schema crate the extension was built from.

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: corvus_json_schema
 version: !ruby/object:Gem::Version
-  version: 0.1.3
+  version: 0.2.0
 platform: aarch64-linux-gnu
 authors:
 - endjin
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2026-10-12 00:00:00.000000000 Z
+date: 2026-11-01 00:00:00.000000000 Z
 dependencies: []
 description: 'JSON Schema validation for Ruby with the corvus-json-schema Rust crate:
   drafts 4, 6, 7, 2019-09 and 2020-12, results and annotations, Ruby values read in
@@ -20,6 +20,7 @@ extra_rdoc_files: []
 files:
 - LICENSE
 - README.md
+- THIRD-PARTY-NOTICES.txt
 - VERSIONHISTORY.md
 - lib/corvus_json_schema.rb
 - lib/corvus_json_schema/3.3/corvus_json_schema.so