jsonatapy 2.2.12__tar.gz → 2.2.14__tar.gz

{jsonatapy-2.2.12 → jsonatapy-2.2.14}/CHANGELOG.md

@@ -19,6 +19,100 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Security
 
+## [2.2.14] - 2026-11-04
+
+### Added
+
+### Changed
+
+- **Compiled regexes are reused.** The same regex literal evaluated again, such as once per element
+  under `$map`, no longer compiles again; each thread keeps up to 256.
+- Updated Rust dependencies: `simd-json` 0.18.1 → 0.19.0, used by the default `simd` feature. (#274)
+- **The `mcp` extra now needs Python 3.11 or later.** On Python 3.10, `pip install
+  'jsonatapy[mcp]'` installs no `fastmcp`, and `jsonatapy mcp` says the extra needs 3.11. Its
+  `dnspython` dependency (through `email-validator`) has no release for 3.10 with the fix for
+  GHSA-45c3-73f7-pv4m. The rest of `jsonatapy` still supports 3.10.
+
+### Deprecated
+
+### Removed
+
+### Fixed
+
+- **Object keys are in JavaScript's order**: integer-like keys first in ascending order, then the
+  rest in insertion order, so `$keys({"b":1,"2":2})` is `["2","b"]` as in jsonata-js. Python
+  callers see it too: a dict an expression builds comes back in that order, while a dict passed
+  through untouched is the caller's own object and keeps its order. (#273) Thanks to
+  @Sawmonabo for finding this and for the fix.
+- **A cancel or a timeout now stops `$distinct` and `$keys` part way.** Both compare each element
+  with every one kept so far, and over a large input that ran to the end before U1003 or D1012 was
+  seen. (#272) Thanks to @Sawmonabo for the cancel check; the timeout check followed from it.
+- **`\d`, `\w`, `\s` and `\b` in a regex now mean what they mean in jsonata-js**: ASCII digits and
+  word characters and ECMAScript's whitespace, so `$contains("٣", /\d/)` is `false`. (#271)
+  Thanks to @Sawmonabo for finding and fixing this.
+- **A regex with the `i` flag folds case as jsonata-js does**, by upper case rather than Unicode
+  case folding. The Kelvin sign (U+212A) and the long s (U+017F) match only themselves, so
+  `$contains("\u212A", /k/i)` and `/[\w]/i` against it are `false`; `ß` and `ẞ` no longer match,
+  nor the Ohm and Angstrom signs with `ω` and `å`; and characters outside the BMP no longer fold.
+
+### Security
+
+- `uv.lock`: `authlib` 1.7.2 → 1.9.1 (seven advisories), `joserfc` 1.7.3 → 1.7.7
+  (GHSA-jpxq-7h8p-2q76, GHSA-9pg5-8c7x-5hfx), and `dnspython` 2.8.0 → 2.9.0
+  (GHSA-45c3-73f7-pv4m), which no longer resolves for Python 3.10 now that the `mcp` extra needs
+  3.11 (see Changed). All three are transitive dependencies of the optional `mcp` extra, not
+  of the published crate or of the wheel, which has no runtime dependencies. Users of the `mcp`
+  extra resolve their own versions and should upgrade these. (#269, #270)
+
+## [2.2.13] - 2026-10-24
+
+**Upgrade notes**
+
+- **Breaking for Rust code that builds `EvaluatorOptions` field by field.** `EvaluatorOptions`
+  has a new public `cancel` field (see Added), so a struct literal that lists every field
+  without `..Default::default()` no longer compiles. Add `cancel: None`, or end the literal with
+  `..Default::default()`. Strict semver would call this a major change. It ships in a patch
+  release because jsonata-core's version tracks the jsonata-js version it targets (2.2), and
+  code that uses `..Default::default()` is unaffected. The Python and C APIs are unchanged.
+- **`jsonatapy[mcp]` now needs fastmcp 4.1.2 or later**, which brings `mcp` 2.x (see Changed).
+
+### Added
+
+- **An evaluation can be cancelled from another thread.** `EvaluatorOptions` has a new
+  `cancel` field that takes a `CancelToken`. Calling `cancel()` on any clone of the token
+  stops the evaluation with `U1003: Evaluation cancelled` wherever `timeout_ms` is checked:
+  each node evaluated, each element a higher-order builtin hands its callback, each match
+  `$replace` hands its replacement function, and each pass of a tail-call loop. A single
+  builtin call over a large input finishes first, as it does under `timeout_ms`, and if it is
+  the last step the evaluation returns its result. jsonata-js has no cancellation, so the
+  code is in the `U` series. This is a Rust API only. See the upgrade notes above for the
+  `EvaluatorOptions` source break. (#264) Thanks to @jonking-ajar for the design, the
+  implementation and its tests.
+
+### Changed
+
+- **The `mcp` extra now needs fastmcp 4.1.2 or later** (was 3.0). fastmcp 4 brings `mcp` 2.x
+  and replaces `httpx` with `httpx2`, so an environment that pins `mcp<2` or depends on
+  `httpx` alongside `jsonatapy[mcp]` may need updating. The `jsonatapy mcp` server itself is
+  unchanged. 4.1.2 is also the first 4.x release with the fix for GHSA-7xgj-8392-5q4r.
+
+### Deprecated
+
+### Removed
+
+### Fixed
+
+- **`timeout_ms` now stops `$map`, `$filter`, `$reduce`, `$single`, `$sift`, `$each` and
+  `$sort` when their callback is a builtin, host or partial function, and `$replace` when its
+  replacement function is one.** Their loops over such a function had no checkpoint, because
+  the call evaluates no node, so `$map(items, $string)` over a large array ran to the end past
+  its timeout. A lambda callback was already stopped, since its body is checked like any node.
+  An expression with `timeout_ms` set that used to finish late in one of these loops and
+  return a result now fails with D1012 instead. (#264) Thanks to @jonking-ajar, who found and
+  fixed this alongside the cancellation work.
+
+### Security
+
 ## [2.2.12] "Gymkata" - 2026-10-20
 
 ### Added

{jsonatapy-2.2.12 → jsonatapy-2.2.14}/Cargo.lock

@@ -620,7 +620,7 @@ dependencies = [
 
 [[package]]
 name = "jsonata-core"
-version = "2.2.12"
+version = "2.2.14"
 dependencies = [
  "assert_cmd",
  "base64",
@@ -637,6 +637,7 @@ dependencies = [
  "pyo3",
  "rand",
  "regex",
+ "regex-syntax",
  "serde",
  "serde_json",
  "simd-json",
@@ -986,26 +987,6 @@ dependencies = [
  "crossbeam-utils",
 ]
 
-[[package]]
-name = "ref-cast"
-version = "1.0.25"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f354300ae66f76f1c85c5f84693f0ce81d747e2c3f21a45fef496d89c960bf7d"
-dependencies = [
- "ref-cast-impl",
-]
-
-[[package]]
-name = "ref-cast-impl"
-version = "1.0.25"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b7186006dcb21920990093f30e3dea63b7d6e977bf1256be20c3563a5db070da"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.118",
-]
-
 [[package]]
 name = "regex"
 version = "1.13.1"
@@ -1134,12 +1115,11 @@ checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"
 
 [[package]]
 name = "simd-json"
-version = "0.18.1"
+version = "0.19.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6ebe141eb4a23ecc4d5de93fa5b139ac65dc07c38037a2fe9a8fb7c9d36bd832"
+checksum = "e8f2e4d523646f7da6dde3983bd18ede0babc21c258ab708b3dd93ea0259719d"
 dependencies = [
  "halfbrown",
- "ref-cast",
  "serde",
  "serde_json",
  "simdutf8",
@@ -1304,9 +1284,9 @@ checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
 
 [[package]]
 name = "value-trait"
-version = "0.12.1"
+version = "0.12.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e80f0c733af0720a501b3905d22e2f97662d8eacfe082a75ed7ffb5ab08cb59"
+checksum = "545a3d7089f11f1741d12963c057adf9443fc24325110a6a6daf582e825fd51b"
 dependencies = [
  "float-cmp",
  "halfbrown",

{jsonatapy-2.2.12 → jsonatapy-2.2.14}/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "jsonata-core"
-version = "2.2.12"
+version = "2.2.14"
 edition = "2021"
 authors = ["txjmb <txjmb@users.noreply.github.com>"]
 description = "High-performance Rust implementation of JSONata query and transformation language"
@@ -46,14 +46,15 @@ serde = { version = "1.0", features = ["derive"] }
 serde_json = { version = "1.0", features = ["preserve_order"] }
 thiserror = "2.0"
 regex = "1.12"
+regex-syntax = "0.8"
 chrono = "0.4"
 num-traits = "0.2"
 base64 = "0.23"
-indexmap = "2.2"
+indexmap = "2.2.3"
 percent-encoding = "2.3"
 rand = "0.10"
 stacker = "0.1"
-simd-json = { version = "0.18", optional = true }
+simd-json = { version = "0.19", optional = true }
 clap = { version = "4.6", features = ["derive"], optional = true }
 mimalloc = { version = "0.1.52", optional = true }
 libmimalloc-sys = { version = "0.1.49", optional = true }

{jsonatapy-2.2.12 → jsonatapy-2.2.14}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: jsonatapy
-Version: 2.2.12
+Version: 2.2.14
 Classifier: Development Status :: 5 - Production/Stable
 Classifier: Intended Audience :: Developers
 Classifier: License :: OSI Approved :: MIT License
@@ -24,12 +24,12 @@ Requires-Dist: pytest-asyncio>=0.24 ; extra == 'dev'
 Requires-Dist: ruff>=0.3.0 ; extra == 'dev'
 Requires-Dist: mypy>=1.0 ; extra == 'dev'
 Requires-Dist: maturin>=1.0 ; extra == 'dev'
-Requires-Dist: fastmcp>=3.0 ; extra == 'dev'
+Requires-Dist: fastmcp>=4.1.2 ; python_full_version >= '3.11' and extra == 'dev'
 Requires-Dist: mkdocs>=1.5 ; extra == 'docs'
 Requires-Dist: mkdocs-material>=9.0 ; extra == 'docs'
 Requires-Dist: mkdocstrings[python]>=0.24 ; extra == 'docs'
 Requires-Dist: pymdown-extensions>=10.0 ; extra == 'docs'
-Requires-Dist: fastmcp>=3.0 ; extra == 'mcp'
+Requires-Dist: fastmcp>=4.1.2 ; python_full_version >= '3.11' and extra == 'mcp'
 Provides-Extra: bench
 Provides-Extra: dev
 Provides-Extra: docs
@@ -75,13 +75,13 @@ Project-URL: Repository, https://github.com/txjmb/jsonata-core
     <source media="(prefers-color-scheme: dark)"
             srcset="https://raw.githubusercontent.com/txjmb/jsonata-core/main/docs/assets/realistic-workload-dark.svg">
     <img width="880"
-         alt="Realistic-workload benchmark on a 100-product dataset, lower is better: jsonatapy is 8.7x faster than the jsonata-js reference on the geometric mean of 5 e-commerce queries, and the pure-Rust jsonata-core engine is faster still."
+         alt="Realistic-workload benchmark on a 100-product dataset, lower is better: jsonatapy is 8.2x faster than the jsonata-js reference on the geometric mean of 5 e-commerce queries, and the pure-Rust jsonata-core engine is faster still."
          src="https://raw.githubusercontent.com/txjmb/jsonata-core/main/docs/assets/realistic-workload-light.svg">
   </picture>
 </a>
 
 *Click the chart for the full category-by-category tables, including jsonata-python
-and jsonata-rs, which are left off the chart because at 68 ms–9 s they would
+and jsonata-rs, which are left off the chart because at 67 ms–9 s they would
 flatten everything else into a sliver.*
 <!-- END generated performance chart -->
 
@@ -156,10 +156,10 @@ let result = Evaluator::new().evaluate(&ast, &data)?;
 ```toml
 # Cargo.toml
 [dependencies]
-jsonata-core = "2.2.12"          # pure Rust, no Python dependency
+jsonata-core = "2.2.14"          # pure Rust, no Python dependency
 
 # Optional: disable SIMD for constrained targets
-jsonata-core = { version = "2.2.12", default-features = false }
+jsonata-core = { version = "2.2.14", default-features = false }
 ```
 
 ---

{jsonatapy-2.2.12 → jsonatapy-2.2.14}/README.md

@@ -26,13 +26,13 @@
     <source media="(prefers-color-scheme: dark)"
             srcset="https://raw.githubusercontent.com/txjmb/jsonata-core/main/docs/assets/realistic-workload-dark.svg">
     <img width="880"
-         alt="Realistic-workload benchmark on a 100-product dataset, lower is better: jsonatapy is 8.7x faster than the jsonata-js reference on the geometric mean of 5 e-commerce queries, and the pure-Rust jsonata-core engine is faster still."
+         alt="Realistic-workload benchmark on a 100-product dataset, lower is better: jsonatapy is 8.2x faster than the jsonata-js reference on the geometric mean of 5 e-commerce queries, and the pure-Rust jsonata-core engine is faster still."
          src="https://raw.githubusercontent.com/txjmb/jsonata-core/main/docs/assets/realistic-workload-light.svg">
   </picture>
 </a>
 
 *Click the chart for the full category-by-category tables, including jsonata-python
-and jsonata-rs, which are left off the chart because at 68 ms–9 s they would
+and jsonata-rs, which are left off the chart because at 67 ms–9 s they would
 flatten everything else into a sliver.*
 <!-- END generated performance chart -->
 
@@ -107,10 +107,10 @@ let result = Evaluator::new().evaluate(&ast, &data)?;
 ```toml
 # Cargo.toml
 [dependencies]
-jsonata-core = "2.2.12"          # pure Rust, no Python dependency
+jsonata-core = "2.2.14"          # pure Rust, no Python dependency
 
 # Optional: disable SIMD for constrained targets
-jsonata-core = { version = "2.2.12", default-features = false }
+jsonata-core = { version = "2.2.14", default-features = false }
 ```
 
 ---

{jsonatapy-2.2.12 → jsonatapy-2.2.14}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "maturin"
 
 [project]
 name = "jsonatapy"
-version = "2.2.12"
+version = "2.2.14"
 description = "High-performance Python/Rust implementation of JSONata query and transformation language"
 authors = [
     {name = "txjmb", email = "txjmb@users.noreply.github.com"}
@@ -42,10 +42,12 @@ dev = [
     "ruff>=0.3.0",        # Linting and formatting
     "mypy>=1.0",
     "maturin>=1.0",
-    "fastmcp>=3.0",       # So `dev` installs can run the full test suite (Task 9)
+    "fastmcp>=4.1.2; python_version >= '3.11'",  # So `dev` installs can run the full test suite
 ]
 mcp = [
-    "fastmcp>=3.0",
+    # 3.11+ only: fastmcp pulls in dnspython through email-validator, and dnspython 2.9.0,
+    # the first release with the fix for GHSA-45c3-73f7-pv4m, dropped 3.10.
+    "fastmcp>=4.1.2; python_version >= '3.11'",
 ]
 bench = [
     "jsonata>=0.2.0",     # jsonata-python for benchmarking
@@ -82,7 +84,7 @@ dev = [
     "ruff>=0.3.0",
     "mypy>=1.0",
     "maturin>=1.0",
-    "fastmcp>=3.0",
+    "fastmcp>=4.1.2; python_version >= '3.11'",
 ]
 
 [tool.ruff]

{jsonatapy-2.2.12 → jsonatapy-2.2.14}/python/jsonatapy/__main__.py

@@ -24,7 +24,7 @@ def _run_mcp(argv: list[str]) -> int:
         from ._cli.mcp_server import serve
     except ImportError:
         print(
-            "error: the 'mcp' extra is not installed. Run:\n"
+            "error: the 'mcp' extra is not installed (it needs Python 3.11 or later). Run:\n"
             '  uvx --from "jsonatapy[mcp]" jsonatapy mcp\n'
             "or: pip install jsonatapy[mcp]",
             file=sys.stderr,

{jsonatapy-2.2.12 → jsonatapy-2.2.14}/src/builtins.rs

@@ -241,11 +241,17 @@ fn describe_operand(v: &JValue) -> String {
 /// boundary collapses it, so a builtin passed as a callback (`$map(arr,
 /// $keys)`) is unwrapped once, by the higher-order function's own result,
 /// exactly as in jsonata-js.
+///
+/// `start_time` is when the evaluation started, if it has a timeout; the
+/// builtins whose walk is quadratic (`$distinct`, `$keys` over an array)
+/// check it with the cancel token per element, so neither runs on past
+/// D1012 or U1003.
 pub(crate) fn dispatch_pure(
     name: &str,
     args: &[JValue],
     context: &JValue,
     options: &EvaluatorOptions,
+    start_time: Option<std::time::Instant>,
 ) -> Result<JValue, EvaluatorError> {
     // 1. Implicit context insertion. The union of what the two paths used to
     //    do separately: only the tree-walker had `fromMillis` here and
@@ -916,7 +922,9 @@ pub(crate) fn dispatch_pure(
             // genuinely absent argument) moves to Undefined.
             None | Some(JValue::Undefined) => Ok(JValue::Undefined),
             Some(JValue::Array(arr)) if arr.len() > 1 => {
-                let mut result = functions::array::distinct(arr)?;
+                let mut result = functions::array::distinct_checked(arr, || {
+                    crate::evaluator::check_loop_timeout(options, start_time)
+                })?;
                 // jsonata-js builds a sequence only when the input was one.
                 if arr.sequence {
                     result.mark_sequence();
@@ -1035,6 +1043,7 @@ pub(crate) fn dispatch_pure(
                     let normalized_item = crate::evaluator::normalize_lazy(item)?;
                     if let JValue::Object(obj) = &normalized_item {
                         for key in obj.keys() {
+                            crate::evaluator::check_loop_timeout(options, start_time)?;
                             let k = JValue::string(key.clone());
                             if !all_keys.contains(&k) {
                                 all_keys.push(k);
@@ -1608,6 +1617,7 @@ mod tests {
             &[JValue::Undefined],
             &JValue::Number(5.0),
             &opts,
+            None,
         )
         .expect_err("a numeric context cannot satisfy substring's first parameter");
         assert!(
@@ -1625,11 +1635,62 @@ mod tests {
         // assert on the member only one list had.
         let opts = EvaluatorOptions::default();
         // $fromMillis() with a numeric context formats that context.
-        let got = dispatch_pure("fromMillis", &[], &JValue::Number(0.0), &opts)
+        let got = dispatch_pure("fromMillis", &[], &JValue::Number(0.0), &opts, None)
             .expect("fromMillis should read the context");
         assert!(
             matches!(&got, JValue::String(s) if s.starts_with("1970-01-01")),
             "expected an epoch timestamp, got {got:?}"
         );
     }
+
+    #[test]
+    fn distinct_and_keys_stop_on_cancel() {
+        // Both walk their input once per element against everything kept so
+        // far, so a cancel has to be seen inside the walk, not only after it.
+        let token = crate::evaluator::CancelToken::new();
+        token.cancel();
+        let opts = EvaluatorOptions {
+            cancel: Some(token),
+            ..Default::default()
+        };
+        for (name, arg) in [
+            ("distinct", serde_json::json!([1, 2, 1])),
+            ("keys", serde_json::json!([{"a": 1}, {"b": 2}])),
+        ] {
+            let err = dispatch_pure(name, &[JValue::from(arg)], &JValue::Undefined, &opts, None)
+                .expect_err("a cancelled evaluation must not finish the walk");
+            assert!(
+                err.to_string().contains("U1003"),
+                "{name}: expected U1003, got {err}"
+            );
+        }
+    }
+
+    #[test]
+    fn distinct_and_keys_stop_on_timeout() {
+        // The same walks honour the evaluation timeout, not only a cancel.
+        let opts = EvaluatorOptions {
+            timeout_ms: Some(1),
+            ..Default::default()
+        };
+        let started = std::time::Instant::now();
+        std::thread::sleep(std::time::Duration::from_millis(5));
+        for (name, arg) in [
+            ("distinct", serde_json::json!([1, 2, 1])),
+            ("keys", serde_json::json!([{"a": 1}, {"b": 2}])),
+        ] {
+            let err = dispatch_pure(
+                name,
+                &[JValue::from(arg)],
+                &JValue::Undefined,
+                &opts,
+                Some(started),
+            )
+            .expect_err("a timed-out evaluation must not finish the walk");
+            assert!(
+                err.to_string().contains("D1012"),
+                "{name}: expected D1012, got {err}"
+            );
+        }
+    }
 }

{jsonatapy-2.2.12 → jsonatapy-2.2.14}/src/capi.rs

@@ -491,6 +491,7 @@ pub unsafe extern "C" fn jsonata_set_limits(
         timeout_ms: (timeout_ms > 0).then_some(timeout_ms),
         max_stack_depth: (max_stack_depth > 0).then_some(max_stack_depth as usize),
         max_sequence_length: (max_sequence_length > 0).then_some(max_sequence_length as usize),
+        cancel: None,
     };
     clear_error();
     0