corvus_json_schema 0.1.3 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c49a0e22cb2d5d434a1cc48ff218ee2d8a1c75e12721672f8555ec1d7829ea4e
-  data.tar.gz: da2296f3cf10c8b9cd4e55c5455c4e159ba447530eaafaeda3d1692893d2b71a
+  metadata.gz: 7e2347892c4bd0c1e41ef9b14747b260c5938d47f1a644f1fdbe0c3992f822a1
+  data.tar.gz: 78e9eda166cac2e81b48f87927299d2c092f45b1269179c58ed65495e9cf278f
 SHA512:
-  metadata.gz: 131e37b22d753a2c9bd803a333a014796fd9dd0cf66f91a87f83d442b9afb34d6d60960da00d62c213be2e502634e96dcb6222a6f07395b1b245c9a23456a63b
-  data.tar.gz: 77e5b94a420597102e3c70d138778f9ad0744efdda767d258d47a20131b8b06a9aa571c4c159b8136180693c3c70623aa352d6863b0274e68bff7f340d456916
+  metadata.gz: b5d369d4df79459748f2eeaf93a1586986ab37d8d112e3095ca22650c0144ca110b6f0d85559c0f4cd82b704ba1bcee3117813785fa796d120e643f500228253
+  data.tar.gz: 9fca29ee3cdf761a2caeebf80a6f8c83f788957d346c0d66fdd1d7af2735c439b6b9a0f7161e5e570a07aef2f91075f2d9077aa0785fd3ecaa194a4642695de2

data/Cargo.lock

@@ -63,16 +63,26 @@ dependencies = [
 
 [[package]]
 name = "corvus-json-schema"
-version = "0.1.6"
+version = "0.2.0"
 dependencies = [
+ "corvus-regex-ecma262",
  "regex",
- "regress",
  "serde_json",
 ]
 
+[[package]]
+name = "corvus-regex-ecma262"
+version = "0.2.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "be72de82781404398482a431a88c1d03b82d474a5fad3003cac18f5893fc71ee"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+]
+
 [[package]]
 name = "corvus_json_schema"
-version = "0.1.3"
+version = "0.2.0"
 dependencies = [
  "corvus-json-schema",
  "magnus",
@@ -273,15 +283,6 @@ version = "0.8.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d6f6ff9a378485b298a5286656da665ba74413d36db0979633275d2e708145d4"
 
-[[package]]
-name = "regress"
-version = "0.12.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32eef8b209c3c1c15dbad02c1f30f9539f00dc7253e0cbcdaae442a50a09d7c1"
-dependencies = [
- "memchr",
-]
-
 [[package]]
 name = "rustc-hash"
 version = "2.1.3"

data/README.md

@@ -53,6 +53,9 @@ Its options:
 | `base_uri` | `nil` | The schema's base URI, when it has no `$id`. |
 | `entry_point` | `nil` | A reference to the subschema to validate against, such as `"#/$defs/item"`. |
 | `max_depth` | `128` | The deepest the evaluator recurses in place before it raises `DepthError`. |
+| `pattern_match_limit` | `1.0` | The seconds one match of a `pattern` or `patternProperties` regular expression against one string may take before the validation raises `PatternMatchLimitError`. `nil` or `0` turns the limit off, for a caller who trusts both the schema and the instances. |
+| `regex_edition` | `:dialect` | The edition of ECMA-262 `pattern`, `patternProperties` and the `regex` format are read with: `:dialect` (ECMAScript 2020 for 2019-09 and 2020-12, which name it, today's for the drafts before them), `:current` or `:es2020`. Under ECMAScript 2020 a modifier group such as `(?i:...)` is not valid. |
+| `regex_unicode_version` | `:default` | The version of Unicode patterns are read with: `:default` (the version of the V8 the answers are held to, 17 today), `:latest`, `13`, `17` or `18`. |
 
 A `Validator` is immutable and can be shared between threads.
 
@@ -65,7 +68,10 @@ A `Validator` is immutable and can be shared between threads.
   schema location.
 
 Errors are subclasses of `CorvusJsonSchema::Error`: `CompilationError` (an invalid schema, or a reference that cannot
-be resolved), `DepthError` and `InvalidJsonError` (for `valid_json?`). An error raised by a format or resolver callable
+be resolved), `PatternTooLargeError` (a `CompilationError` for a regular expression over a limit of size: 1,048,576
+bytes, 1,000 levels of groups, or about 16,000 terms), `DepthError`, `PatternMatchLimitError` (a match of a regular
+expression reached its limit, so the instance is neither valid nor not valid) and `InvalidJsonError` (for
+`valid_json?`). An error raised by a format or resolver callable
 propagates.
 
 ## Values
@@ -109,3 +115,8 @@ repository's submodule (or `JSON_SCHEMA_TEST_SUITE`).
 ## License
 
 Apache-2.0
+
+The gem is built on the `corvus-json-schema` Rust crate, which matches patterns with the `corvus-regex-ecma262` crate,
+whose Unicode tables are derived from the Unicode Character Database, which is under the Unicode License V3.
+[THIRD-PARTY-NOTICES.txt](THIRD-PARTY-NOTICES.txt) has that notice, and the one of the `regress` crate, from whose
+tables those were written. The file is in the source gem and in every native gem, beside `LICENSE`.

data/THIRD-PARTY-NOTICES.txt

@@ -0,0 +1,96 @@
+corvus_json_schema uses third-party libraries or other resources that may be
+distributed under licenses different than the corvus_json_schema software.
+
+In the event that we accidentally failed to list a required notice, please
+bring it to our attention. Post an issue or email us:
+
+           licensing@endjin.com
+
+The attached notices are provided for information only.
+
+License notice for the Unicode Character Database
+-------------------------------
+
+The gem is built on the corvus-json-schema Rust crate. The source gem holds
+the crate's sources (ext/corvus_json_schema/vendor/corvus-json-schema), and a
+native gem holds the extension compiled from them. That crate matches patterns
+with the corvus-regex-ecma262 crate, which is compiled in with it.
+corvus-regex-ecma262 holds tables derived from the data files of the Unicode
+Character Database, versions 13.0.0, 17.0.0 and 18.0.0
+(https://www.unicode.org/Public/), and from its emoji sequence files: the
+General_Category values, the binary properties, the Script and
+Script_Extensions values, the simple case folding, the simple uppercase
+mapping and the properties of strings. The data files are licensed under the
+Unicode License V3 (SPDX-License-Identifier: Unicode-3.0), as
+https://www.unicode.org/license.txt gives it:
+
+UNICODE LICENSE V3
+
+COPYRIGHT AND PERMISSION NOTICE
+
+Copyright © 1991-2026 Unicode, Inc.
+
+NOTICE TO USER: Carefully read the following legal agreement. BY
+DOWNLOADING, INSTALLING, COPYING OR OTHERWISE USING DATA FILES, AND/OR
+SOFTWARE, YOU UNEQUIVOCALLY ACCEPT, AND AGREE TO BE BOUND BY, ALL OF THE
+TERMS AND CONDITIONS OF THIS AGREEMENT. IF YOU DO NOT AGREE, DO NOT
+DOWNLOAD, INSTALL, COPY, DISTRIBUTE OR USE THE DATA FILES OR SOFTWARE.
+
+Permission is hereby granted, free of charge, to any person obtaining a
+copy of data files and any associated documentation (the "Data Files") or
+software and any associated documentation (the "Software") to deal in the
+Data Files or Software without restriction, including without limitation
+the rights to use, copy, modify, merge, publish, distribute, and/or sell
+copies of the Data Files or Software, and to permit persons to whom the
+Data Files or Software are furnished to do so, provided that either (a)
+this copyright and permission notice appear with all copies of the Data
+Files or Software, or (b) this copyright and permission notice appear in
+associated Documentation.
+
+THE DATA FILES AND SOFTWARE ARE PROVIDED "AS IS", WITHOUT WARRANTY OF ANY
+KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF
+THIRD PARTY RIGHTS.
+
+IN NO EVENT SHALL THE COPYRIGHT HOLDER OR HOLDERS INCLUDED IN THIS NOTICE
+BE LIABLE FOR ANY CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES,
+OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,
+WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION,
+ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THE DATA
+FILES OR SOFTWARE.
+
+Except as contained in this notice, the name of a copyright holder shall
+not be used in advertising or otherwise to promote the sale, use or other
+dealings in these Data Files or Software without prior written
+authorization of the copyright holder.
+
+License notice for https://github.com/ridiculousfish/regress
+-------------------------------
+
+The tables of the corvus-regex-ecma262 crate were written, through the tables
+of the Corvus Go module, from the property tables of regress (its gen-unicode
+tool), which are generated from the Unicode Character Database. regress is
+licensed under the MIT license or the Apache License, Version 2.0, at the
+user's option. Neither the gem nor the crates it is built on depend on it.
+
+MIT License
+
+Copyright (c) 2020 ridiculous_fish
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

data/VERSIONHISTORY.md

@@ -2,6 +2,39 @@
 
 The version history of the `corvus_json_schema` Ruby gem. It is versioned independently of the Corvus NuGet packages and of the [corvus-json-schema](../../src-rs/corvus-json-schema/VERSIONHISTORY.md) Rust crate it is built on.
 
+## V0.2.0
+
+V0.2.0 takes version 0.2.0 of the `corvus-json-schema` crate, which matches patterns with the [`corvus-regex-ecma262`](https://crates.io/crates/corvus-regex-ecma262) crate and reads them in the grammar of the dialect. It is a minor version because under 2019-09 and 2020-12 a pattern that uses what ECMAScript added after 2020 is no longer valid. Everything else that was there is unchanged, and there are two new options.
+
+- **The grammar of the dialect.** JSON Schema 2019-09 and 2020-12 name the grammar of ECMAScript 2020, and patterns under them are now read with it: a modifier group such as `(?i:...)`, or a group name used by two groups, is not valid, and `CorvusJsonSchema.compile` raises `CompilationError` for a schema with one in a `pattern`. A property escape that the tables of 2020 do not have (`\p{Script=Yezidi}`) is not valid with the `u` flag, so the pattern is read without it, where `\p` is the letter `p`, as a pattern with `\&` is. The `regex` format reads only the grammar of the flag. Drafts 4 to 7 read today's grammar, as before.
+- **`regex_edition:`** (`:dialect`, the default, `:current` or `:es2020`) chooses the edition for every dialect, and **`regex_unicode_version:`** (`:default`, the default, `:latest`, `13`, `17` or `18`) the version of Unicode. Another value raises `ArgumentError`.
+- **The engine.** Every pattern that no dedicated matcher of the crate takes is matched by `corvus-regex-ecma262`, whose answers are V8's for the whole of the ECMA-262 regular expression test data. The limits are those of 0.1.4. Over the jsonschema-benchmark corpora the crate validates in 0.98 of the time of 0.1.7 once warm, and takes 1.06 of it for the first validation and 1.05 to compile, since the engine builds a pattern's automaton on its first match.
+- **Notices.** `THIRD-PARTY-NOTICES.txt` names the tables of `corvus-regex-ecma262`, which the native gems now hold in place of the crate's own. The source gem no longer carries a copy of the crate's notice, which the crate no longer has.
+
+## V0.1.4
+
+V0.1.4 takes version 0.1.7 of the `corvus-json-schema` crate. That fixes wrong results for several forms of pattern and a validation that did not end, replaces the crate's regular expression engine, and gives every match of a pattern a limit of time. The functions and types that were there are unchanged, and there are additions for the limit. Versions 0.1.0 to 0.1.3 are affected.
+
+### The regular expression engine
+
+The crate no longer uses the `regress` crate for the patterns with a lookaround, a backreference or a modifier group. It matches them with an engine of its own, a port of the ECMA-262 engine of the Corvus Go module, and matches every pattern as it is written. The crate's [version history](../../src-rs/corvus-json-schema/VERSIONHISTORY.md) lists the patterns that were answered wrongly before (a repetition inside a repetition that lost its count or did not end, a backreference from inside its group, two groups with one name, case-insensitive matching without the `u` flag, a pattern that is valid only without the `u` flag and a character beyond the Basic Multilingual Plane, `\B` beside a character of several bytes, and others), and what was measured: V8's answer for all 4,268,313 texts of the ECMA-262 regular expression test data that can be asked.
+
+### Limits on regular expressions
+
+A schema and an instance may both come from outside, so a pattern is now bounded in what it costs. Nothing that was there has changed. There is one new option and there are two new errors.
+
+- **A match has a limit of one second.** `pattern_match_limit`, a keyword of `CorvusJsonSchema.compile`, is the seconds one match of a `pattern` or `patternProperties` regular expression against one string may take. The default is `CorvusJsonSchema::DEFAULT_PATTERN_MATCH_LIMIT`, `1.0`. `nil` or `0` turns the limit off for a caller who trusts both the schema and the instances. The limit is on each match, not on the validation.
+- **`CorvusJsonSchema::PatternMatchLimitError`** is raised by `valid?`, `valid_json?` and `evaluate` when a match reached the limit, or when its backtracking held 1,048,576 entries. The instance is then neither valid nor not valid. The message names the pattern and the limit. `compile` can raise it too, because a pattern of `patternProperties` is matched against the property names the schema declares.
+- **`CorvusJsonSchema::PatternTooLargeError`** is raised by `compile` for a schema with a regular expression over a limit of size: 1,048,576 bytes of pattern, 1,000 levels of groups, or 1,048,576 counted for it as it is read (a pattern of plain characters can be 16,384 characters long). It is a `CompilationError`, so code that rescues those still does. A regular expression that is not valid raises `CompilationError` itself, as before.
+
+### Bug fixes
+
+- **A separated list with a `$` inside it.** The crate matches a pattern of the form `^item(separator item)*$`, such as `^([a-z]+)(\.[a-z]+)*$`, without a regular expression engine. It dropped a `$` at the end of the first item or of the repeated group, so `^x(,a$)*$` was matched as `^x(,a)*$`. A `$` holds only at the end of the string, so the group of `^x(,a$)*$` can match once at most. `CorvusJsonSchema.compile({ "pattern" => '^x(,a$)*$' }).valid?("x,a,a")` returned `true`, where the instance is not valid. `^x$(,a)*$` took `"x,a"`, and `^(a,$)*b$` took `"a,b"`. `valid?`, `valid_json?` and `evaluate` were all affected, and so was a pattern used for `patternProperties` or `propertyNames`. Such a pattern is now matched by a regular expression engine. An escaped `\$` is a literal character and is matched as before. No other form of pattern was affected. The extension's crate requirement names 0.1.7, so the copy of the crate vendored at build time cannot be an older one.
+
+### Notices
+
+- **The notice of the Unicode data is in the gem.** The Unicode tables of the `corvus-json-schema` crate are derived from the Unicode Character Database, which is under the Unicode License V3. That license asks that its notice goes with every copy of the data. `THIRD-PARTY-NOTICES.txt` has it, with the notice of the `regress` crate that the tables were first read from, and is now in the source gem and in every native gem. Versions 0.1.0 to 0.1.3 carried no such notice.
+
 ## V0.1.3
 
 V0.1.3 fixes `gem install corvus_json_schema` on Alpine Linux and other musl systems, where RubyGems before 4.0 could install the glibc gem, which does not load there. There are no API changes, and the extension is the one in 0.1.2. Versions 0.1.0 to 0.1.2 are affected.

data/ext/corvus_json_schema/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "corvus_json_schema"
-version = "0.1.3"
+version = "0.2.0"
 edition = "2024"
 rust-version = "1.89"
 description = "The native extension of the corvus_json_schema gem: the corvus-json-schema crate, reading Ruby values in place."
@@ -12,7 +12,7 @@ crate-type = ["cdylib"]
 
 [dependencies]
 # The crate, copied in by `rake vendor` (from src-rs/corvus-json-schema) so that the source gem builds on its own.
-corvus = { package = "corvus-json-schema", path = "vendor/corvus-json-schema", version = "0.1.6" }
+corvus = { package = "corvus-json-schema", path = "vendor/corvus-json-schema", version = "0.2.0" }
 magnus = { version = "0.9.1", features = ["rb-sys"] }
 rb-sys = "0.9.130"
 serde_json = { version = "1.0.151", features = ["preserve_order", "float_roundtrip"] }

data/ext/corvus_json_schema/clippy.toml

@@ -1,4 +1,3 @@
-# Clippy suggests idioms by the minimum Rust version. The declared minimum (rust-version in Cargo.toml) was corrected
-# from 1.85 to 1.89 with no change to the source, so the lints stay at the level the source was written to. Raise this
-# when the source is next revised for the newer idioms.
-msrv = "1.85"
+# Clippy suggests idioms by the minimum Rust version, which is the one declared in Cargo.toml (rust-version). Keep the
+# two the same: clippy warns when they differ, and uses this one.
+msrv = "1.89"

data/ext/corvus_json_schema/src/lib.rs

@@ -4,7 +4,8 @@
 use std::cell::{Cell, RefCell};
 
 use corvus::{
-    ArrayView, CompileOptions, Dialect, Instance, JsonSchemaResultsCollector, Kind, ObjectView, ResultsLevel, View,
+    ArrayView, CompileOptions, Dialect, Instance, JsonSchemaResultsCollector, Kind, ObjectView, RegexEdition,
+    RegexUnicodeVersion, ResultsLevel, View,
 };
 use magnus::prelude::*;
 use magnus::rb_sys::AsRawValue;
@@ -401,8 +402,14 @@ struct Validator {
     ruby_formats: bool,
 }
 
-fn depth_error(ruby: &Ruby, e: corvus::SchemaEvaluationDepthError) -> Error {
-    raise(ruby, "DepthError", e.to_string())
+/// The exception for an evaluation that gave no answer: it recursed in place beyond the maximum depth, or a match
+/// of a regular expression reached its limit.
+fn evaluation_error(ruby: &Ruby, e: corvus::SchemaEvaluationError) -> Error {
+    match e {
+        corvus::SchemaEvaluationError::InvalidJson(e) => raise(ruby, "InvalidJsonError", e.to_string()),
+        corvus::SchemaEvaluationError::PatternMatchLimit(e) => raise(ruby, "PatternMatchLimitError", e.to_string()),
+        other => raise(ruby, "DepthError", other.to_string()),
+    }
 }
 
 impl Validator {
@@ -411,15 +418,15 @@ impl Validator {
     fn check(&self, ruby: &Ruby, value: Value) -> Result<bool, Error> {
         if !self.ruby_formats {
             let ctx = Context::new();
-            let result = self.inner.validate_instance(RbInstance::root(value, &ctx));
+            let result = self.inner.try_validate_instance(RbInstance::root(value, &ctx));
             if !ctx.fallback.get() {
-                return result.map_err(|e| depth_error(ruby, e));
+                return result.map_err(|e| evaluation_error(ruby, e));
             }
         }
         let json = to_json(ruby, value, 0)?;
-        let result = self.inner.validate(&json);
+        let result = self.inner.try_validate(&json);
         take_callback_error()?;
-        result.map_err(|e| depth_error(ruby, e))
+        result.map_err(|e| evaluation_error(ruby, e))
     }
 
     fn valid(ruby: &Ruby, rb_self: &Self, value: Value) -> Result<bool, Error> {
@@ -435,13 +442,9 @@ impl Validator {
         } else {
             str_of(text).ok_or_else(|| raise(ruby, "InvalidJsonError", "the JSON text is not valid UTF-8"))?
         };
-        let result = rb_self.inner.validate_json(json);
+        let result = rb_self.inner.try_validate_json(json);
         take_callback_error()?;
-        match result {
-            Ok(valid) => Ok(valid),
-            Err(corvus::JsonValidationError::InvalidJson(e)) => Err(raise(ruby, "InvalidJsonError", e.to_string())),
-            Err(corvus::JsonValidationError::DepthExceeded(e)) => Err(depth_error(ruby, e)),
-        }
+        result.map_err(|e| evaluation_error(ruby, e))
     }
 
     /// Evaluates into the collector (replacing its results), reporting every keyword at its level.
@@ -449,18 +452,18 @@ impl Validator {
         let mut c = JsonSchemaResultsCollector::new(collector.level);
         if !rb_self.ruby_formats {
             let ctx = Context::new();
-            let result = rb_self.inner.evaluate_instance(RbInstance::root(value, &ctx), &mut c);
+            let result = rb_self.inner.try_evaluate_instance(RbInstance::root(value, &ctx), &mut c);
             if !ctx.fallback.get() {
                 *collector.inner.borrow_mut() = c;
-                return result.map_err(|e| depth_error(ruby, e));
+                return result.map_err(|e| evaluation_error(ruby, e));
             }
             c = JsonSchemaResultsCollector::new(collector.level);
         }
         let json = to_json(ruby, value, 0)?;
-        let result = rb_self.inner.evaluate(&json, &mut c);
+        let result = rb_self.inner.try_evaluate(&json, &mut c);
         take_callback_error()?;
         *collector.inner.borrow_mut() = c;
-        result.map_err(|e| depth_error(ruby, e))
+        result.map_err(|e| evaluation_error(ruby, e))
     }
 }
 
@@ -478,6 +481,9 @@ fn compile(
     base_uri: Option<String>,
     entry_point: Option<String>,
     max_depth: u32,
+    pattern_match_limit: Option<f64>,
+    regex_edition: String,
+    regex_unicode_version: String,
 ) -> Result<Validator, Error> {
     let schema: Json = match RString::from_value(schema) {
         Some(text) => serde_json::from_str(&text.to_string()?)
@@ -499,6 +505,41 @@ fn compile(
         base_uri,
         entry_point,
         max_depth,
+        // In seconds. nil, zero or less turns the limit off.
+        pattern_match_limit: match pattern_match_limit {
+            Some(seconds) if seconds.is_nan() => {
+                return Err(Error::new(ruby.exception_arg_error(), "pattern_match_limit is not a number of seconds"));
+            }
+            Some(seconds) if seconds > 0.0 => {
+                Some(std::time::Duration::try_from_secs_f64(seconds).unwrap_or(std::time::Duration::MAX))
+                    .filter(|limit| !limit.is_zero())
+            }
+            _ => None,
+        },
+        regex_edition: match regex_edition.as_str() {
+            "dialect" => None,
+            "current" => Some(RegexEdition::Current),
+            "es2020" => Some(RegexEdition::Es2020),
+            e => {
+                return Err(Error::new(
+                    ruby.exception_arg_error(),
+                    format!("regex_edition is :dialect, :current or :es2020, not {e:?}"),
+                ));
+            }
+        },
+        regex_unicode_version: match regex_unicode_version.as_str() {
+            "default" => RegexUnicodeVersion::Default,
+            "latest" => RegexUnicodeVersion::Latest,
+            "13" => RegexUnicodeVersion::V13,
+            "17" => RegexUnicodeVersion::V17,
+            "18" => RegexUnicodeVersion::V18,
+            v => {
+                return Err(Error::new(
+                    ruby.exception_arg_error(),
+                    format!("regex_unicode_version is :default, :latest, 13, 17 or 18, not {v:?}"),
+                ));
+            }
+        },
         ..CompileOptions::default()
     };
     let mut ruby_formats = false;
@@ -560,7 +601,12 @@ fn compile(
                 Some(r) => format!("{} ({r})", e.message()),
                 None => e.message().to_owned(),
             };
-            Err(raise(ruby, "CompilationError", message))
+            let class = match e.kind() {
+                corvus::SchemaCompilationErrorKind::PatternTooLarge(_) => "PatternTooLargeError",
+                corvus::SchemaCompilationErrorKind::PatternMatchLimit(_) => "PatternMatchLimitError",
+                _ => "CompilationError",
+            };
+            Err(raise(ruby, class, message))
         }
     }
 }
@@ -621,12 +667,16 @@ impl Collector {
 fn init(ruby: &Ruby) -> Result<(), Error> {
     let module = ruby.define_module("CorvusJsonSchema")?;
     let error = module.define_error("Error", ruby.exception_standard_error())?;
-    module.define_error("CompilationError", error)?;
+    let compilation = module.define_error("CompilationError", error)?;
+    // A regular expression over a limit of size. It is a CompilationError, so code that rescues those still does.
+    module.define_error("PatternTooLargeError", compilation)?;
     module.define_error("DepthError", error)?;
+    // A match of a regular expression that reached its limit: the instance is neither valid nor not valid.
+    module.define_error("PatternMatchLimitError", error)?;
     module.define_error("InvalidJsonError", error)?;
 
     let native = module.define_module("Native")?;
-    native.define_singleton_method("compile", function!(compile, 10))?;
+    native.define_singleton_method("compile", function!(compile, 13))?;
     native.define_singleton_method("crate_version", function!(|| corvus::VERSION, 0))?;
 
     let validator = module.define_class("Validator", ruby.class_object())?;

data/ext/corvus_json_schema/vendor/corvus-json-schema/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "corvus-json-schema"
-version = "0.1.6"
+version = "0.2.0"
 edition = "2024"
 rust-version = "1.89"
 description = "A high-performance JSON Schema evaluator (draft 4 to 2020-12) with results collection and annotations, ported from the Corvus.Text.Json V5 runtime evaluator."
@@ -17,8 +17,8 @@ categories = ["encoding", "parser-implementations"]
 include = ["src/**", "Cargo.toml", "README.md", "LICENSE"]
 
 [dependencies]
+corvus-regex-ecma262 = "0.2.7"
 regex = "1.13.1"
-regress = "0.12.0"
 serde_json = { version = "1.0.151", features = ["preserve_order", "float_roundtrip"] }
 
 [profile.release]

data/ext/corvus_json_schema/vendor/corvus-json-schema/README.md

@@ -70,10 +70,63 @@ this way, through CPython's C API.
 
 - **Numbers:** compared exactly. Integers are compared as integers and doubles against integers without rounding.
   `multipleOf` is decided on decimal forms, so `0.0075` is a multiple of `0.0001`.
-- **Patterns:** use ECMA-262 semantics with the `u` flag. Common shapes (class sequences, literals and their
-  alternatives, separated lists, line lengths) get dedicated matchers, as in the C# evaluator. Patterns within the
-  common subset of ECMA-262 and the [`regex`](https://crates.io/crates/regex) crate's syntax are translated and run by
-  `regex`, and anything else by [`regress`](https://crates.io/crates/regress).
+- **Patterns:** use ECMA-262 semantics. A pattern is compiled with the `u` flag. One that is not valid with it (it has
+  `\&` or `\-`, say) is compiled without it, as many validators accept such patterns, and is then matched as
+  ECMA-262 says for it: by UTF-16 code unit, so a character beyond the Basic Multilingual Plane is two. The `regex`
+  format accepts only the grammar of the flag, and asks the grammar alone, without the engine's limits of size. Common shapes (class sequences, a few literals and alternatives, line
+  lengths) get dedicated matchers, as in the C# evaluator, where each was measured faster than the engine over the
+  strings of the jsonschema-benchmark corpora. Every other pattern is matched by
+  [`corvus-regex-ecma262`](https://crates.io/crates/corvus-regex-ecma262), an ECMA-262 engine. The crate depends
+  on it, `regex` (for the format checks) and `serde_json`.
+
+  **What is exact.** Everything. A pattern is matched as it is written, whichever matcher has it, and none is
+  refused for what an engine cannot do. The engine's answers are V8's for the whole of the
+  [ECMA-262 regular expression test data](https://github.com/corvus-dotnet/ecma262-regex-test-data): lookaheads and
+  lookbehinds, backreferences into and out of repetitions and lookarounds, named groups, a name shared by groups in
+  separate alternatives, modifier groups, repetitions inside repetitions with any count, and case-insensitive
+  matching in both grammars.
+
+  **The grammar of the dialect.** JSON Schema 2019-09 and 2020-12 name the grammar of ECMAScript 2020, so under them a
+  pattern is read with `RegexEdition::Es2020`: what later editions added (modifier groups such as `(?i:...)`, a group
+  name used by two groups) is not valid, and a schema that uses it is refused. A property escape that is not in the
+  tables of 2020 is not valid with the `u` flag, so the pattern is read without it, where `\p` is the letter `p`. Drafts
+  4 to 7 read today's grammar. `CompileOptions::regex_edition` chooses another edition and
+  `CompileOptions::regex_unicode_version` the version of Unicode (by default the version of the V8 the engine's answers
+  are held to, 17 today), for `pattern`, `patternProperties` and the `regex` format alike.
+
+  **Limits.** A schema and an instance may both come from outside, so a pattern is bounded in what it costs.
+
+  - *A match has a limit of time.* `CompileOptions::pattern_match_limit` is the time one match against one string may
+    take. The default is one second (`DEFAULT_PATTERN_MATCH_LIMIT`), and `None` or zero turns it off for a caller who
+    trusts both the schema and the instances. A match that reaches it is abandoned, and so is one whose backtracking
+    runs out of the memory the engine allows it. The validation then has no answer: the `try_` functions
+    (`try_validate`, `try_validate_json`, `try_evaluate` and the rest) return
+    `SchemaEvaluationError::PatternMatchLimit` with the pattern and the limit.
+  - *The functions without the new error.* `is_valid` returns a `bool` and fails closed: it returns `false` for a
+    match that reached its limit, as it does for the maximum depth, and never `true`. `validate`,
+    `validate_instance`, `validate_json` and the `evaluate` functions report it as the one error their type has for
+    a validation that was abandoned (`SchemaEvaluationDepthError`, named when the depth was the one limit). Its
+    message says the validation was abandoned at a limit, the maximum depth or the limit of a match, and that the
+    `try_` functions say which. At a limit the instance is not known to be not valid, whatever `is_valid` returned.
+  - *A pattern has limits of size.* A pattern longer than 1,048,576 bytes, nested more than 1,000 groups deep, or
+    counted as more than 1,048,576 as it is read (64 for a term, 32 for an alternative, 8 for a range of a class) is
+    refused when the schema is compiled. The message says it is too large, not that it is not valid, and
+    `SchemaCompilationError::kind` is `PatternTooLarge`. A pattern of plain characters can be 16,384 characters long.
+    These are the engine's limits.
+  - *What the crate keeps is bounded.* The cache of compiled patterns of the process holds 1,024 patterns and 64 MiB
+    at most.
+  - *The format checks take time proportional to the string.* They read strings of the instance and are not under
+    the limit of a match. Dates, times, UUIDs, IP addresses and host names are read by scanners that pass over the
+    string once, and the others are regular expressions on the `regex` crate, which is linear. `regex` reads the
+    string with the engine's grammar-only reader, without the limits of size. `idn-hostname`, and the domain of an `idn-email`, read nothing of
+    a string over 1,012 bytes: an internationalized host name has 253 characters at most, and its check decodes and
+    encodes Punycode, which takes time that grows with the square of a label.
+  - *What is not bounded.* The limit is for each match, not for a validation. The matchers that read a string once
+    are not stopped. With the limit turned off, nothing bounds a match: a group read back inside a repetition, as in
+    `^(?:(a+)\1*)+$`, takes time that doubles with each character of some strings.
+
+  **Lone surrogates.** A JSON string with the escape of half of a surrogate pair (`"\ud800"`) is not a Rust string.
+  `validate_json` and `serde_json` both refuse the document as not valid JSON.
 - **Formats:** are annotations unless asserted by the vocabulary or by `CompileOptions::assert_format`. The format
   validators follow the C# implementations (RFC 3339 dates and times, IDN hostnames, IRIs, and so on).
 
@@ -137,3 +190,14 @@ This runs:
 - **`tests/results.rs`:** the results-collection expectations shared with the C# and TypeScript evaluators.
 - **`tests/metaschemas.rs`:** checks that `src/metaschemas.rs` matches `src/Corvus.Text.Json/metaschema`.
   Regenerate it with `UPDATE_METASCHEMAS=1 cargo test --test metaschemas`.
+- **The tests of `src/pattern.rs`:** every dedicated matcher agrees with the engine on strings made to probe it,
+  and the cache of compiled patterns stays within its bounds.
+- **`tests/pattern_anchors.rs` and `tests/pattern_class.rs`:** patterns that an engine or a matcher answered wrongly
+  at some point, with V8's answers.
+- **`tests/pattern_limits.rs`:** the limit of a match and the limits of size, through the public functions.
+- **`tests/allocations.rs`:** validating JSON text allocates nothing in the steady state, with patterns the engine
+  matches and with the limit on or off.
+
+## License
+
+Apache 2.0.