leptris 1.9.398.0-aarch64-linux → 1.9.400.0-aarch64-linux

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1c84575ff4701153bfd035f65d1ab416a7623c56dbac71f4ed1f7c781e902f4d
-  data.tar.gz: c71192697eace0cef20fef8c77eddc1ed3ad8abd82be12864a77b6aae3c39127
+  metadata.gz: a2750b147604dc164b40657df49b82263a2b9dbd8e0df6fefd1aca0adae5e55a
+  data.tar.gz: 7bc50052800a5cc3687c653c7bc51ef10e181f2a0c9ac06d924177f1236e6b56
 SHA512:
-  metadata.gz: '038d13c05f966615bd72c2e78369e0bdff70e20b3409e28117a88fd52f86838fa6266bc63e7cd28cbc70e834ea7f3249c9cc7fb65b62da58fc99cedda80e2258'
-  data.tar.gz: e546b900e38bb669cd6c4658d5f896b855555a97e1974e11a6b545d1bb2c071315fd289b78a5b3bd6981f9f799cb7501e635f14a44dab97ee83ddd2868056cfc
+  metadata.gz: 4a2277bbb18fc090fa562809c16b2cb81b03d686b1227167b8e29f9a97e516ee2bd0962cf57ac601c74321befed8450795c188c609076ff79251a77ff5bc9243
+  data.tar.gz: 8e561a0aa0e59712aed4993473edaf2423f0defbf27f8122e4e227e06ec289eb0f5d02db1f0c98882c5b24452fd9209c418e4098051cd47560b82fa1f09e66b3

data/Rakefile

@@ -8,7 +8,7 @@ RSpec::Core::RakeTask.new(:spec)
 # Pin for `rake compile` and the platform-gem builds. Keep in lockstep
 # with .github/workflows/build.yml (which calls `rake compile`) and the
 # CHANGELOG when libleptris releases.
-LIBLEPTRIS_VERSION = "1.9.398"
+LIBLEPTRIS_VERSION = "1.9.400"
 # Vendored alongside libleptris for fn:normalize-unicode (TODO
 # .restructure/20): built per platform with a RELOCATABLE @rpath
 # install name, loaded by ffi.rb before libleptris so the

data/lib/leptris/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Leptris
-  VERSION = "1.9.398.0"
+  VERSION = "1.9.400.0"
 end

data/vendor-src/README.md

@@ -1,7 +1,7 @@
 Sources vendored in this gem (recompile rights; the ruby
 variant builds them at install via extconf.rb):
 
-- libleptris v1.9.398
+- libleptris v1.9.400
 - utf8proc v2.11.0
 
 Rebuild by hand:

data/vendor-src/libleptris/CHANGELOG.md

@@ -1,5 +1,42 @@
 ## [Unreleased]
 
+## [1.9.400] - 2026-11-01
+
+### Fixed
+
+- **A restriction's inline anonymous base drives validation
+  (leptris#1936 stG/stH, PR #1943).** An `xs:restriction` whose
+  base is an inline anonymous `<xs:simpleType>` — the W3C suite's
+  stG/stH style — never captured that base: values were
+  facet-checked with nothing underneath, so `length` counted
+  characters of the whole lexical instead of list items. The base
+  now rides the capture (`base_def`, mirroring `item_def`/
+  `member_defs`), the value passes through the base's own
+  derivation before the restriction's facets, and the list-chain
+  detector descends the anonymous path. RED-first spec; the
+  xmllint-arbiter harness agrees on all 8 collected
+  schema/instance pairs. (xsd)
+
+
+
+## [1.9.399] - 2026-10-31
+
+### Fixed
+
+- **`\\d` matches the Unicode-3.1 legacy digits (leptris#1936,
+  PR #1940).** XSD 1.0 Part 2 cites Unicode 3.1, where
+  U+1369–U+1371 (Ethiopic digits one-nine) were Nd — Unicode 4.0.1
+  demoted them to No, so the utf8proc-backed Nd mask missed them
+  and the suite's reS38 (`\\d` vs `&#x1371;`) / reT51 (`\\D`) rows
+  failed. The legacy-Nd set now joins the class as a pure-codepoint
+  range, outside the utf8proc guard so every build (windows
+  included) answers it; `\\D` inherits the exclusion through the
+  complement's negation. RED-first spec
+  (`XsdDatatypes.DigitClassPinsLegacyNd`), and the shared-fixture
+  collision behind an arm-lane flake got unique names.
+
+
+
 ## [1.9.398] - 2026-10-31
 
 ### Fixed

data/vendor-src/libleptris/CLAUDE.md

@@ -169,3 +169,19 @@ calculates the next version, and updates three files:
 - `CHANGELOG.md` (version header)
 
 The bump-version.sh script handles all three in one shot.
+
+### Runtime coverage law: publish ALL runtimes every release
+
+An engine release is NOT done when the GitHub Release publishes — it is
+done when every runtime package riding it is published and VERIFIED on
+its registry, same day: **ruby** (rubygems, leptris-ruby: bump Rakefile
+`LIBLEPTRIS_VERSION` + `lib/leptris/version.rb`; merge = publish), **py**
+(PyPI, leptris-py: bump `libleptris-version.txt` + `pyproject.toml` +
+`leptris/__init__.py`; merge = publish), **rs** (crates.io, leptris-rs:
+conventional commits -> merge release-plz's release PR = publish), **ts**
+(npm package `leptris`, leptris-ts: bump pin + `package.json`; the
+`v<pkg>` tag push publishes). Verify on the registry itself — a merged
+PR with a stuck workflow is not a release (2026-10-29: ruby sat two
+engine releases behind with the pin already advanced; py seven behind;
+rs's release workflow had never succeeded — missing `id-token: write`;
+ts 0.1.24 never tagged).

data/vendor-src/libleptris/CMakeLists.txt

@@ -3,7 +3,7 @@
 cmake_minimum_required(VERSION 3.20)
 
 project(leptris
-    VERSION 1.9.398
+    VERSION 1.9.400
     DESCRIPTION "Fast XML parser and XPath evaluator in pure C"
     LANGUAGES C CXX
 )

data/vendor-src/libleptris/README.adoc

@@ -1172,6 +1172,53 @@ No runtime dependencies when built without utf8proc/iconv.
 |libFuzzer for 5 minutes; report any crashes.
 |===
 
+== Releasing and the runtime packages
+
+The engine releases via the automated workflow
+(`gh workflow run release.yml -f next_version=patch` — the workflow
+bumps the version, opens the release PR, and tags + publishes the
+GitHub Release when it merges). Never tag or release by hand.
+
+**Every engine release ships ALL runtime packages the same day** —
+an engine release is not done until each binding that rides it is
+published and verified on its registry:
+
+[cols="1,2,3",options="header"]
+|===
+|Runtime |Registry |Ride
+
+|Ruby
+|rubygems (`leptris`, `{engine-semver}.{binding-patch}`)
+|bump `Rakefile` `LIBLEPTRIS_VERSION` + `lib/leptris/version.rb` in
+link:https://github.com/leptris/leptris-ruby[leptris-ruby]; merging
+the bump PR is the release decision (auto-publish).
+
+|Python
+|PyPI (`leptris`)
+|bump `libleptris-version.txt` + `pyproject.toml` +
+`leptris/__init__.py` in
+link:https://github.com/leptris/leptris-py[leptris-py]; merging the
+bump PR publishes via trusted publishing.
+
+|Rust
+|crates.io (`leptris`)
+|conventional commits on
+link:https://github.com/leptris/leptris-rs[leptris-rs] main; the
+release-plz PR carries the version bump, and merging IT publishes
+(crates.io trusted publishing).
+
+|TypeScript / WASM
+|npm (`leptris`)
+|bump the engine pin + `package.json` version in
+link:https://github.com/leptris/leptris-ts[leptris-ts]; the
+tag-gated `v<pkg-version>` push publishes via npm trusted
+publishing.
+|===
+
+Verify each publication on the registry itself (`gem list -r`,
+`pip index versions`, the crates.io/npm APIs) — a merged PR with a
+stuck workflow is NOT a release.
+
 == Project layout
 
 [source,text]

data/vendor-src/libleptris/src/leptris/rng/rng_regex.c

@@ -112,6 +112,17 @@ static void cls_add_builtin(RreNode* n, char c) {
             n->cat_set = 1;
             n->cat_mask |= 1u << UTF8PROC_CATEGORY_ND;
 #endif
+            /* XSD 1.0 cites Unicode 3.1, where U+1369-1371
+             * (Ethiopic digits one-nine) were Nd — Unicode 4.0.1
+             * demoted them to No, so modern tables miss them
+             * (#1936 reS38/reT51). Pin the legacy-Nd set outside
+             * the utf8proc guard: the ranges are pure codepoints
+             * and \d must answer them on every build. */
+            if (n->uni_n < 4) {
+                n->uni_lo[n->uni_n] = 0x1369;
+                n->uni_hi[n->uni_n] = 0x1371;
+                n->uni_n++;
+            }
             break;
         case 'w':
             for (int i = '0'; i <= '9'; i++) cls_add(n, (unsigned char)i);

data/vendor-src/libleptris/src/leptris/xsd/compile.c

@@ -428,6 +428,22 @@ static XsdSimple* xsd_capture_simple(LeptrisElement st) {
         } else if (strcmp(local, "restriction") == 0) {
             simple->base = xsd_strdup(xsd_local_name(
                 leptris_element_attribute(e, "base")));
+            /* #1936 (stG/stH): an inline anonymous BASE rides this
+             * capture — without it the restriction's facets apply
+             * with no base (length counted characters, list
+             * semantics vanished). Mirrors the union member_defs. */
+            for (LeptrisNodeRef b = leptris_node_first_child(
+                     leptris_element_as_node(e));
+                 b && !simple->base_def;
+                 b = leptris_node_next_sibling(b)) {
+                if (leptris_node_get_type(b) != LEPTRIS_NODE_TYPE_ELEMENT)
+                    continue;
+                LeptrisElement be = (LeptrisElement)b;
+                const char* bl = NULL;
+                leptris_element_expanded_name(be, &bl, NULL, NULL);
+                if (bl && strcmp(bl, "simpleType") == 0)
+                    simple->base_def = xsd_capture_simple(be);
+            }
             for (LeptrisNodeRef f = leptris_node_first_child(
                      leptris_element_as_node(e));
                  f; f = leptris_node_next_sibling(f)) {
@@ -584,7 +600,13 @@ static int xsd_chain_is_list(struct leptris_xsd_schema* s,
     int depth = 0;
     while (t && depth < 32) {
         if (t->deriv == XSD_SIMPLE_LIST) return 1;
-        if (!t->base) return 0;
+        if (!t->base) {
+            /* #1936: an anonymous inline base continues the chain —
+             * a restriction of an inline list keeps list semantics
+             * (the length family counts items). */
+            if (t->base_def) { t = t->base_def; depth++; continue; }
+            return 0;
+        }
         if (strncmp(t->base, "xs:", 3) == 0)
             return strcmp(t->base, "xs:IDREFS") == 0 ||
                    strcmp(t->base, "xs:NMTOKENS") == 0 ||
@@ -651,6 +673,11 @@ static int xsd_deriv_valid(struct leptris_xsd_schema* s,
                 return 1;
         return 0;
     }
+    /* #1936: the value satisfies the inline base (its own
+     * derivation — list item walks, union members — first), then
+     * this level's facets. */
+    if (t->base_def && !xsd_deriv_valid(s, t->base_def, v, depth + 1))
+        return 0;
     return xsd_simple_valid(t, v, xsd_chain_terminal(s, t), 0);
 }
 
@@ -663,6 +690,11 @@ static int xsd_valid_chain(struct leptris_xsd_schema* s,
     }
     if (t->deriv != XSD_SIMPLE_RESTRICT)
         return xsd_deriv_valid(s, t, v, depth);
+    /* #1936: the inline anonymous base drives the value first
+     * (its own derivation — list item walks, union members),
+     * then this restriction's facets. */
+    if (t->base_def && !xsd_deriv_valid(s, t->base_def, v, depth + 1))
+        return 0;
     return xsd_simple_valid(t, v, xsd_chain_terminal(s, t),
                             xsd_chain_is_list(s, t));
 }
@@ -2551,6 +2583,7 @@ static void xsd_free_simple_one(XsdSimple* t) {
     free(t->assertion);
     free(t->item_type);
     xsd_free_simple_one(t->item_def);
+    xsd_free_simple_one(t->base_def);
     for (size_t i = 0; i < t->member_count; i++) free(t->members[i]);
     free(t->members);
     for (size_t i = 0; i < t->member_def_count; i++)

data/vendor-src/libleptris/src/leptris/xsd/xsd_internal.h

@@ -40,6 +40,7 @@ typedef struct xsd_simple {
     char* name;
     char* ns;    /* leptris-ruby#440: declaring schema's targetNamespace */
     char* base;
+    struct xsd_simple* base_def; /* RESTRICTION: inline anonymous base */
     XsdSimpleDeriv deriv;
     char* item_type;         /* LIST: builtin or local type name */
     struct xsd_simple* item_def; /* LIST: inline anonymous item type */

data/vendor-src/libleptris/test/xsd/test_xsd_compile.cpp

@@ -390,6 +390,56 @@ TEST(XsdDatatypes, LengthFacetCountsOctetsForHexBinary) {
 // byte world and character-class SUBTRACTION — the OPC
 // ST_ContentType shape. A pattern that fails to parse rejects
 // everything, so media types failed wholesale.
+// leptris#1936 (stG/stH oracle pair): a restriction whose base is
+// an ANONYMOUS inline simpleType must validate the value against
+// that base before its own facets — length on a list-with-length-2
+// counts items, not characters of the whole lexical.
+TEST(XsdDatatypes, RestrictionInlineBaseDrivesFacets) {
+    const char xsd[] =
+        "<xs:schema xmlns:xs=\"http://www.w3.org/2001/XMLSchema\">"
+        "<xs:simpleType name=\"twoInts\"><xs:restriction>"
+        "<xs:simpleType><xs:list itemType=\"xs:int\"/></xs:simpleType>"
+        "<xs:length value=\"2\"/></xs:restriction></xs:simpleType>"
+        "<xs:element name=\"r\" type=\"twoInts\"/></xs:schema>";
+    LeptrisStatus st = LEPTRIS_OK;
+    LeptrisXsdSchema s = leptris_xsd_compile(xsd, strlen(xsd), &st);
+    ASSERT_EQ(st, LEPTRIS_OK);
+    ASSERT_NE(s, (LeptrisXsdSchema)0);
+    // 2 items: valid per xmllint (the engine used to count chars)
+    EXPECT_EQ(leptris_xsd_simple_valid(s, "twoInts", "1 2"), 1);
+    // 3 items: over the length facet
+    EXPECT_EQ(leptris_xsd_simple_valid(s, "twoInts", "1 2 3"), 0);
+    // a member fails the item type
+    EXPECT_EQ(leptris_xsd_simple_valid(s, "twoInts", "1 x"), 0);
+    leptris_xsd_free(s);
+}
+
+// leptris#1936 (reS38/reT51): XSD 1.0 cites Unicode 3.1, where
+// U+1369-1371 (Ethiopic digits one-nine) were Nd — \\d matches
+// &#x1371; and \\D rejects it even though the host tables (4.0.1+)
+// carry them as No.
+TEST(XsdDatatypes, DigitClassPinsLegacyNd) {
+    const char xsd[] =
+        "<xs:schema xmlns:xs=\"http://www.w3.org/2001/XMLSchema\">"
+        "<xs:simpleType name=\"Digs\"><xs:restriction base=\"xs:string\">"
+        "<xs:pattern value=\"\\d\"/></xs:restriction></xs:simpleType>"
+        "<xs:simpleType name=\"NonDigs\"><xs:restriction base=\"xs:string\">"
+        "<xs:pattern value=\"\\D\"/></xs:restriction></xs:simpleType>"
+        "</xs:schema>";
+    LeptrisStatus st = LEPTRIS_OK;
+    LeptrisXsdSchema s = leptris_xsd_compile(xsd, strlen(xsd), &st);
+    ASSERT_EQ(st, LEPTRIS_OK);
+    ASSERT_NE(s, (LeptrisXsdSchema)0);
+    EXPECT_EQ(leptris_xsd_simple_valid(s, "Digs", "\xE1\x8D\xB1"), 1);
+    EXPECT_EQ(leptris_xsd_simple_valid(s, "Digs", "\xE1\x8D\xA9"), 1);
+    EXPECT_EQ(leptris_xsd_simple_valid(s, "Digs", "5"), 1);
+    EXPECT_EQ(leptris_xsd_simple_valid(s, "Digs", "x"), 0);
+    EXPECT_EQ(leptris_xsd_simple_valid(s, "NonDigs", "\xE1\x8D\xB1"), 0);
+    EXPECT_EQ(leptris_xsd_simple_valid(s, "NonDigs", "5"), 0);
+    EXPECT_EQ(leptris_xsd_simple_valid(s, "NonDigs", "x"), 1);
+    leptris_xsd_free(s);
+}
+
 TEST(XsdDatatypes, PatternPropertyClassesAndSubtraction) {
     // The OPC ST_ContentType shape, minus the quoted-string member
     // (same property-class + subtraction machinery): type/subtype
@@ -3816,7 +3866,7 @@ TEST(XsdCrossNs, SingleDocImportChaseResolves) {
         " xmlns:r=\"urn:r\" xmlns=\"urn:a\" targetNamespace=\"urn:a\""
         " elementFormDefault=\"qualified\">"
         "<xs:import namespace=\"urn:r\""
-        " schemaLocation=\"blip_repro_rel.xsd\"/>"
+        " schemaLocation=\"blip_chase_rel.xsd\"/>"
         "<xs:attributeGroup name=\"AG_Blob\">"
         "<xs:attribute ref=\"r:embed\" use=\"optional\"/>"
         "</xs:attributeGroup>"
@@ -3832,8 +3882,8 @@ TEST(XsdCrossNs, SingleDocImportChaseResolves) {
     if (!dir) dir = std::getenv("TEMP"); /* windows runners define TEMP/TMP */
     if (!dir) dir = std::getenv("TMP");
     std::string base = dir ? dir : ".";
-    std::string rel_path = base + "/blip_repro_rel.xsd";
-    std::string main_path = base + "/blip_repro_main.xsd";
+    std::string rel_path = base + "/blip_chase_rel.xsd";
+    std::string main_path = base + "/blip_chase_main.xsd";
     {
         std::ofstream f(rel_path);
         f << rel;

data/vendor-src/libleptris/vcpkg.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://raw.githubusercontent.com/microsoft/vcpkg/master/scripts/vcpkg.schema.json",
   "name": "leptris",
-  "version": "1.9.398",
+  "version": "1.9.400",
   "description": "High-performance XML parser and XPath 1.0 engine in C (libleptris)",
   "homepage": "https://github.com/leptris/leptris",
   "license": "MIT",

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: leptris
 version: !ruby/object:Gem::Version
-  version: 1.9.398.0
+  version: 1.9.400.0
 platform: aarch64-linux
 authors:
 - Ribose Inc.
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-10-31 00:00:00.000000000 Z
+date: 2026-11-01 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: ffi