jsonatapy 2.2.8__tar.gz → 2.2.10__tar.gz

{jsonatapy-2.2.8 → jsonatapy-2.2.10}/.gitignore

@@ -71,3 +71,4 @@ benchmarks/javascript/package-lock.json
 # Temporary files
 *.tmp
 *.bak
+*.exe

{jsonatapy-2.2.8 → jsonatapy-2.2.10}/.serena/memories/architecture.md

@@ -45,9 +45,12 @@ site (grep `unwrap_or(JValue::Null)` / `JValue::Null =>` near field-access code)
 ### Compilation pipeline (bytecode fast path)
 `evaluator::try_compile_expr(ast)` → `CompiledExpr` (IR) → `compiler::BytecodeCompiler::compile`
 → `BytecodeProgram` (flat `Vec<Instr>`) → `peephole()` folds (`PushData+GetField` →
-`GetDataField`, `GetVar+GetField` → `GetVarField`, elides `Not+Not`) → `vm::Vm::new(bc).run(...)`.
-`JsonataExpression` (lib.rs) caches `bytecode: OnceCell<Option<BytecodeProgram>>`; all 4 evaluate
-entrypoints try the VM first and fall back to the tree-walker.
+`GetDataField`, `GetVar+GetField` → `GetVarField`, elides `Not+Not`) →
+`vm::Vm::with_options(bc, options).run(...)`.
+`JsonataExpression` (lib.rs) caches `bytecode: OnceCell<Option<BytecodeProgram>>`; all 5 evaluate
+entrypoints funnel through `run_eval`, which tries the VM first and falls back to the tree-walker.
+The `vm`/`compiler` modules exist only under the `python`, `capi`, or `bench` features (cfg-gated
+in lib.rs) — a default-feature build, including the Rust CLI, always uses the tree-walker.
 
 Key correctness rules baked into the compiler/VM (violate these and specific test-suite groups
 regress):

{jsonatapy-2.2.8 → jsonatapy-2.2.10}/CHANGELOG.md

@@ -19,6 +19,244 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Security
 
+## [2.2.10] - 2026-09-24
+
+### Added
+- `SECURITY.md` security policy: security fixes ship as a new patch release of the latest
+  minor line (currently 2.2.x) with no backports, and vulnerabilities are reported privately
+  through the repository's Security tab rather than in public issues. (#171)
+- Benchmark tables gain a per-row **jsonata-core (pure Rust)** column, measured by a new
+  `benchmarks/rust` harness that evaluates this project's engine as a Rust library with no
+  Python boundary. The column previously labelled `jsonatapy (rust)` is relabelled
+  `jsonatapy (json I/O)`: it was always the `evaluate_json` path of the same engine, not a
+  separate Rust implementation. (#162)
+- The README's performance section now shows an auto-generated chart of the "Realistic
+  Workload" benchmarks, regenerated alongside `docs/performance.md` on each release. (#165)
+- `CONTRIBUTORS.md`. (#167)
+
+### Changed
+- Updated Rust dependencies: `simd-json` 0.18.0 → 0.18.1 (#163), `indexmap` 2.14.0 → 2.14.2
+  (#168), and `clap` 4.6.6 → 4.6.7, used only by the `jsonata` CLI (#169).
+- CodeQL now runs through GitHub's CodeQL default setup, covering Rust, Python, C/C++,
+  JavaScript/TypeScript and GitHub Actions, instead of CodeQL jobs in the Security Scanning
+  workflow. (#170, #171)
+- The Security Scanning workflow now audits the resolved `uv.lock` with `pip-audit`, not just
+  the packages installed on the runner, and fails on a vulnerable locked dependency. It also
+  lists `cargo-audit` warnings such as yanked crates, without failing the build on them. (#170)
+
+### Deprecated
+
+### Removed
+
+### Fixed
+- The default docs URL (`/stable/`) served the previous release's performance page: the
+  release job deployed docs from the release tag, which never contains that release's own
+  benchmark numbers. Release docs now take `docs/performance.md` from `main` after the
+  benchmark job records it, and the docs workflow can republish the released docs line
+  without a new release. (#164)
+- Resolved all 18 open CodeQL code-quality alerts in the benchmark and test scripts, and
+  implemented the previously stubbed `test_compile_invalid_expression` test. (#170)
+
+### Security
+- `Cargo.lock`: `chacha20` 0.10.1 → 0.10.2. 0.10.1 was yanked; it reaches the build through
+  `rand` and was compiled into the 2.2.9 Python wheels and CLI binaries. (#170)
+- `uv.lock`: `anyio` 4.14.1 → 4.15.1 (CVE-2026-63374, CVE-2026-64847, CVE-2026-63349),
+  `cryptography` 49.0.0 → 50.0.1 (PYSEC-2026-3552), and `mkdocs-material` 9.7.6 → 9.7.7
+  (PYSEC-2026-3864). These are development and documentation dependencies only; the published
+  `jsonatapy` package has no Python dependencies and was not affected. (#170)
+
+## [2.2.9] "Perform-ata" - 2026-08-31
+
+### Changed
+- Lambda values now carry their closure directly — `JValue::Lambda(Rc<StoredLambda>)`
+  instead of a `lambda_id` name tag resolved through a per-scope side table (#157).
+  The `Rc` provides the closure's lifetime, so the side table (`Scope.lambdas`),
+  the escape-analysis GC (`extract_lambda_ids`/`collect_lambda_ids` walking every
+  block/lambda result, `pop_scope_preserving_lambdas`) and the dual-map handling in
+  `unbind`/`clear_current_scope` are gone, along with the O(result size) walk on
+  every scope pop. Recursion is late-bound letrec: a closure defined as
+  `$f := function ...` records its own name and binds it to itself at each
+  invocation, so no `Rc` cycles exist and closures cannot leak (guarded by a
+  live-count test). Free-variable capture remains a by-value snapshot at
+  definition time, now applied uniformly to lambda-valued variables too.
+  Behavioral fixes (all matching jsonata-js, pinned in
+  `tests/lambda_closure_suite.rs`): a transform bound to a variable is callable
+  and pipeable (`$t := |...|...|; $t(x)`, `x ~> $t`); a partial application
+  escaping the scope that defined its target function works; an alias
+  (`$g := $f`) survives `$f` being rebound; calling a name rebound to a
+  non-function raises T1006 instead of silently invoking the stale lambda; a
+  closure captured inside another escaping closure's environment no longer
+  dangles. Function equality is now closure identity rather than id-string
+  equality. Remaining known divergences from jsonata-js's live-frame capture
+  are documented in the same suite's `divergent_from_reference` module.
+- Partial application is a typed representation instead of a stringly-typed
+  protocol: `StoredLambda` carries an optional `PartialApplication { target,
+  bound_args, placeholder_positions, total_args }`, replacing the
+  `"__partial_call:name:bool:n"` marker-string body that was parsed at every
+  invocation and the `__bound_arg_N` / `__placeholder_positions` /
+  `__total_args` / `__partial_target` values smuggled through `captured_env`.
+  A user-defined target is a captured closure (`PartialTarget::Lambda`);
+  builtins/host functions stay name-resolved at call time
+  (`PartialTarget::Named`), preserving call-time shadowing. Partials no longer
+  snapshot the entire environment at creation (the old
+  `capture_current_environment()` call was only ever a smuggling container),
+  and one behavior corner now matches jsonata-js: rebinding a user function
+  after partially applying it no longer changes what the partial calls
+  (pinned in `tests/lambda_closure_suite.rs` with eight other partial pins).
+
+### Added
+- `jsonata_set_limits` on the C ABI: wall-clock timeout (D1012), max AST recursion
+  depth (D1011), and max sequence length (D2015) — the same three guardrails the
+  Python bindings expose. C embedders previously had no way to bound a runaway
+  expression at all (the cleanup review's finding); 0 = unlimited, resettable per
+  handle. Covered by the C/C++ smoke tests and a Rust-side capi test.
+- `jsonata_core::Expression` — a compile-once API for Rust callers that runs
+  compilable expressions on the bytecode VM, exactly like the Python and C
+  bindings always have. Until now the VM was unreachable from the pure-Rust
+  surface: `Evaluator` always tree-walks, so Rust (and CLI) callers silently
+  got the slower path. `Expression::compile(src)?.evaluate(&data)` lowers to
+  bytecode lazily and falls back to the tree-walker for non-compilable
+  expressions; bindings and host functions still go through `Evaluator`. The
+  dispatch now lives in one place (`expression::run_compiled`), shared by the
+  Rust API, the Python bindings' `run_eval`, and the C ABI (which previously
+  carried a hand-copied duplicate of it), and the CLI uses it when no `--arg`
+  bindings are given. The `vm`/`compiler` modules are unconditionally compiled
+  again (the cfg gates added earlier in this cycle are gone — the default
+  build now has a real consumer).
+
+### Changed
+- Python→Rust data conversion — the cost that dominates `evaluate(dict)` on array-heavy
+  inputs — is faster on two fronts. `lazy::convert` now dispatches on the exact type object
+  and iterates lists via borrowed references instead of pyo3's instance-check chain
+  (subclasses still take the original chain, so semantics, error types included, are
+  unchanged; pinned by `tests/python/test_convert_fastpath.py`). And the published wheels
+  now use mimalloc as the global allocator (new opt-in `mimalloc` cargo feature, enabled in
+  `pyproject.toml`), roughly halving the per-list/per-object allocation cost that JValue's
+  Rc-per-container representation makes the conversion floor. Measured together on the
+  benchmark suite's shapes: "Nested Array Access" (`data[1][1][1][1]`, the one row where
+  jsonata-js was still ahead) drops ~35% (12.0µs → 7.8µs on the dev container), the four
+  `lazy_check.py` gate rows drop 10–17%, and string-heavy conversion roughly halves. The
+  structural fix for the nested-array row — lazy list views — remains deferred (see the
+  2026-07-12 lazy-views spec's Limitations).
+- The `vm` and `compiler` modules (the bytecode pipeline) are now cfg-gated on the features
+  that actually consume them (`python`, `capi`, `bench`) — they were compiled but unreachable
+  in a default-feature build, producing 12 permanent dead-code warnings that CI's
+  `--all-features` clippy never saw. A default `cargo build` is now warning-clean, and both
+  modules carry a header note naming their consumers. List and dict *subclasses* now take the
+  boundary converter's fast path too (`PyList_Check`/`PyDict_Check`; iteration was already
+  C-level for them, so behavior is unchanged), which let the duplicate slow-path container
+  loops be deleted.
+
+### Changed (evaluator internals)
+- The vestigial `*_is_explicit_null` plumbing is gone: since the null/undefined split
+  (#32) a runtime `JValue::Null` is always an explicit null, yet the flags were still
+  computed and threaded through ~20 signatures — nine arithmetic/comparison wrapper
+  methods, the `CompiledExpr::ExplicitNull` variant (now `Literal(Null)`), a
+  `PushExplicitNull` instruction, and per-instruction bool pairs on the VM's
+  arithmetic/comparison opcodes — with both terminal consumers ignoring them (~200
+  lines removed). Arithmetic and ordered comparison now have exactly one
+  implementation each, shared by the tree-walker, the compiled path, and the VM; as
+  part of that, the compiled/VM paths' T2010/T2009 error texts now match the
+  tree-walker's richer messages ("Cannot compare X and Y", operator symbol in T2009)
+  instead of the generic "Type mismatch in comparison" — same codes, better text, and
+  the two engines no longer disagree. `Evaluator::is_truthy` likewise now delegates to
+  the shared `compiled_is_truthy` instead of maintaining a twin (#111 had to be fixed
+  in both).
+- More single-definition consolidation: the two verbatim 45-line signature-error
+  translation blocks (direct vs TCO lambda invocation) are one `coerce_lambda_args`
+  helper; the five copies of jsonata-js's `hofFuncArgs` argument shaping are two
+  helpers (`hof_array_call_args` for $map/$filter/$single, `hof_object_call_args` for
+  $sift/$each); the six copy-pasted encoding builtin arms share `unary_string_encoding`.
+  `signature.rs` dropped its dead `return_type` field and test-only constructors, and
+  a builtin signature that fails to parse now panics at cache build instead of leaving
+  that builtin silently unvalidated. `ast_transform.rs`'s 157-line module header — a
+  stale task journal whose ~20 line references were all wrong — is a 30-line statement
+  of the actual recursion/drop invariants, and `push_ast_node_children`'s leaf arm
+  lists every variant explicitly instead of `_ => {}`, so a future `AstNode` variant
+  cannot silently opt out of the stack-overflow-on-drop guard.
+- Five hand-maintained parallel lists of builtin names (the pure set, the arity table,
+  the compilable set, the signature table, and a test's own literal copy) are one
+  sorted `builtins::BUILTINS` spec table; `is_pure_builtin`, `is_compilable_builtin`,
+  `builtin_arity`, and `signature::builtin_signature` all derive from it, and the
+  jsonata-js fixture drift tests still police the data. Adding a builtin is now one
+  row plus its dispatch arm. Membership and values are unchanged (the table was
+  generated mechanically from the lists it replaces).
+- The bare-`AstNode::Name` arm of `evaluate_internal_impl` — a private field-access
+  copy that had drifted (kept nulls, never flattened, no tuple or lazy-dict handling)
+  and that instrumentation shows no expression in any suite reaches — now delegates
+  to `compiled_field_step`, the semantics owner for a single field step.
+
+### Deprecated
+
+### Removed
+- Repository hygiene: the checked-in `rustup-init.exe` (12.9 MB Windows installer that
+  dominated clone size and permanently tripped the file-size lint), the orphaned root
+  `node_modules/jsonata/` copy (~830 KB; nothing referenced it — the benchmark harness
+  installs its own under `benchmarks/javascript/`, and the reference implementation is the
+  `tests/jsonata-js` submodule), and the stale `src/parser/README.md` (every structural
+  claim in it — line counts, ranges, even the crate name in its example — was wrong).
+- Dead code that survived the 2.2.8 builtins consolidation: `functions::numeric::{max,
+  min, average}` and `functions::object::{keys, lookup}` had no callers and encoded
+  pre-#109 semantics the engine no longer has (`Null` instead of `Undefined` on empty
+  input, no nested-array recursion) — a trap for anyone fixing a `$max`/`$lookup` bug in
+  the wrong place. Their tests, which pinned the wrong behavior, went with them. Also
+  removed the unused `datetime::parse_iso8601`. Technically these were `pub` items of the
+  crate, so strict semver would call this a breaking change; they were never used by the
+  engine itself.
+
+### Fixed
+- Two families of tree-walker drift found by unifying the remaining field-extraction
+  loops onto `compiled_field_step` (each pinned on BOTH engines in
+  `tests/python/test_field_step_and_arraygroup.py` with jsonata-js reference outputs):
+  the single-step-Name fast path skipped null-valued fields and returned Null on empty
+  (`p` over `[{"p":null},{"p":2}]` was `2` on the tree-walker, `[null,2]` on the VM and
+  in the reference — the engines disagreed); and the `.[...]` array-group constructor
+  kept undefined elements as null (`foo.blah.[baz]` gave `[[..],[null],[null]]` instead
+  of `[[..],[],[]]`, masked downstream by that null-skip), while its empty results
+  conflated "constructed empty array over a single value" (kept: `{"a":1}.[b]` is `[]`)
+  with "mapped over an empty array" (undefined: `emptyarr.[b]`). Both tree-walker
+  Name-step loops (the fast path and the general step loop's inner loop) now delegate
+  to `compiled_field_step`, deleting ~100 lines of drifted copies; the reference
+  suite's `array-constructor/case013`/`case014` now pass by the correct route. The
+  fast path's tuple branch (a third copy, with the same null-skip drift) is deleted
+  outright — tuple streams fall through to the general step loop's single tuple
+  implementation, and `$#$i.p` over `[{"p":null},{"p":2}]` is now `[null,2]` on both
+  engines, matching the reference.
+- Errors carry their JSONata spec code at the front of the message again: the
+  `FunctionError` wrapping used to bury codes behind prose prefixes ("Runtime
+  error: D3030: Cannot convert 'x' to number"), so the C ABI, the Rust CLI, and
+  the Python CLI each grew a different classifier and disagreed on whether the
+  same error was coded. The inner message now passes through unwrapped
+  ("D3030: ..."), `EvaluatorError::code()` / `evaluator::error_code_prefix` is
+  the one definition of "coded error" (prefix-anchored), and the C ABI and both
+  CLIs classify with it — the same failure now presents identically in every
+  binary. The C ABI's mid-string code scan is retired (it existed only to see
+  through the now-removed prose prefixes).
+- Number stringification now matches jsonata-js exactly (verified against the pinned
+  reference with a 307-case randomized differential over scalars, containers,
+  prettified output, and `&` concatenation). Three divergences fixed: non-integers
+  were truncated to 14 significant digits instead of rounded to 15 (`$string(1/3)`
+  was `0.33333333333333`, now `0.333333333333333` — the old formatter counted the
+  `0` of a leading `0.` as significant); integer-valued floats above 2^53 printed
+  their exact i64 digits instead of the float's shortest round-trip decimal; and
+  numbers nested in containers went through serde with different rules again.
+  `$string` now stringifies through its own writer implementing the reference's
+  replacer (functions → `""`, non-integers → `toPrecision(15)`), and one
+  `value::js_number_to_string` defines JS number printing (plain digits in
+  [1e-6, 1e21), exponential with `+` outside, `-0` as `0`) for `$string`, concat,
+  `Display`, and `$join`. Pinned by `tests/python/test_number_stringification.py`.
+- `$var.field` over an array containing nested-array elements now recurses into
+  them like jsonata-js's `lookup`: `($v := [[{"p":1}],{"p":2}]; $v.p)` is `[1,2]`
+  (previously `2` — the tree-walker's two-step fast path hand-rolled its mapping
+  loop and silently skipped non-object elements; it now delegates to the shared
+  field step). Found while consolidating the seven divergent field-extraction
+  loops the cleanup review flagged; pinned by `tests/python/test_var_field_nested.py`.
+- Regex literals now honor the `m` (multiline) flag in `$match` and the `~>`
+  chain-pipe, matching `$split`/`$replace` and jsonata-js — the two paths
+  previously translated only `i` (see `tests/python/test_regex_flags.py`).
+
+### Security
+
 ## [2.2.8] "Conform-ata" - 2026-08-25
 
 Primarily a conformance release, with documentation work on the Rust crate alongside it. Most

jsonatapy-2.2.10/CONTRIBUTORS.md

@@ -0,0 +1,2 @@
+# Contributors
+- [Maria](https://github.com/Tangerinedream13)

{jsonatapy-2.2.8 → jsonatapy-2.2.10}/Cargo.lock

@@ -189,9 +189,9 @@ checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
 
 [[package]]
 name = "chacha20"
-version = "0.10.1"
+version = "0.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d524456ba66e72eb8b115ff89e01e497f8e6d11d78b70b1aa13c0fbd97540a81"
+checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06"
 dependencies = [
  "cfg-if",
  "cpufeatures",
@@ -240,9 +240,9 @@ dependencies = [
 
 [[package]]
 name = "clap"
-version = "4.6.6"
+version = "4.6.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "473c7e07f409a8d772161724aa8db6a765a2532a70f9667eeb7b49d3d02fbdca"
+checksum = "aa8876b300ab35ba921adea3dfd70157a46249b33f95c9084ae5709785478946"
 dependencies = [
  "clap_builder",
  "clap_derive",
@@ -250,9 +250,9 @@ dependencies = [
 
 [[package]]
 name = "clap_builder"
-version = "4.6.6"
+version = "4.6.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7b48fea5a88e9ae728a2dcbedbfc0e730f7d60da42e1cb049a83c9fb8b789889"
+checksum = "ec0797fb7aeb1406c84efac526901f7ec3ead2124f946b494e72879d4b54704d"
 dependencies = [
  "anstream",
  "anstyle",
@@ -262,9 +262,9 @@ dependencies = [
 
 [[package]]
 name = "clap_derive"
-version = "4.6.4"
+version = "4.6.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d012d2b9d65aca7f18f4d9878a045bc17899bba951561ba5ec3c2ba1eed9a061"
+checksum = "f9c751b79415d4e559e3d1fcf128e09e720eb673a06d26cf6f392d37d75b66e0"
 dependencies = [
  "heck",
  "proc-macro2",
@@ -544,9 +544,9 @@ dependencies = [
 
 [[package]]
 name = "indexmap"
-version = "2.14.0"
+version = "2.14.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d466e9454f08e4a911e14806c24e16fba1b4c121d1ea474396f396069cf949d9"
+checksum = "cc4e190f5d26ca7051642629da2c52fc03bde85a03197c99408dcd291734c855"
 dependencies = [
  "equivalent",
  "hashbrown 0.17.1",
@@ -586,7 +586,7 @@ dependencies = [
 
 [[package]]
 name = "jsonata-core"
-version = "2.2.8"
+version = "2.2.10"
 dependencies = [
  "assert_cmd",
  "base64",
@@ -594,6 +594,7 @@ dependencies = [
  "clap",
  "criterion",
  "indexmap",
+ "mimalloc",
  "num-traits",
  "percent-encoding",
  "predicates",
@@ -614,6 +615,15 @@ version = "0.2.186"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "68ab91017fe16c622486840e4c83c9a37afeff978bd239b5293d61ece587de66"
 
+[[package]]
+name = "libmimalloc-sys"
+version = "0.1.49"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6a45a52f43e1c16f667ccfe4dd8c85b7f7c204fd5e3bf46c5b0db9a5c3c0b8e9"
+dependencies = [
+ "cc",
+]
+
 [[package]]
 name = "linux-raw-sys"
 version = "0.12.1"
@@ -632,6 +642,15 @@ version = "2.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"
 
+[[package]]
+name = "mimalloc"
+version = "0.1.52"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2d4139bb28d14ad1facf21d5eb8825051b326e172d216b39f6d31df53cc97862"
+dependencies = [
+ "libmimalloc-sys",
+]
+
 [[package]]
 name = "normalize-line-endings"
 version = "0.3.0"
@@ -1113,9 +1132,9 @@ checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"
 
 [[package]]
 name = "simd-json"
-version = "0.18.0"
+version = "0.18.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5b4c2bab24c48682e93509b5afc39f1f6ef2fbc1ebccab917c8b0534b3007ae4"
+checksum = "6ebe141eb4a23ecc4d5de93fa5b139ac65dc07c38037a2fe9a8fb7c9d36bd832"
 dependencies = [
  "halfbrown",
  "ref-cast",

{jsonatapy-2.2.8 → jsonatapy-2.2.10}/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "jsonata-core"
-version = "2.2.8"
+version = "2.2.10"
 edition = "2021"
 authors = ["txjmb <txjmb@users.noreply.github.com>"]
 description = "High-performance Rust implementation of JSONata query and transformation language"
@@ -29,7 +29,6 @@ exclude = [
     "CLAUDE.MD",
     "pyproject.toml",
     "uv.lock",
-    "rustup-init.exe",
 ]
 
 [lib]
@@ -56,6 +55,7 @@ rand = "0.10"
 stacker = "0.1"
 simd-json = { version = "0.18", optional = true }
 clap = { version = "4.6", features = ["derive"], optional = true }
+mimalloc = { version = "0.1.52", optional = true }
 
 [features]
 default = ["simd"]
@@ -64,6 +64,7 @@ python = ["dep:pyo3"]
 cli = ["dep:clap"]
 bench = []   # exposes _bench facade for Criterion benchmarks
 capi = []
+mimalloc = ["dep:mimalloc"]
 
 [dev-dependencies]
 criterion = "0.8"

{jsonatapy-2.2.8 → jsonatapy-2.2.10}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: jsonatapy
-Version: 2.2.8
+Version: 2.2.10
 Classifier: Development Status :: 5 - Production/Stable
 Classifier: Intended Audience :: Developers
 Classifier: License :: OSI Approved :: MIT License
@@ -66,7 +66,26 @@ Project-URL: Repository, https://github.com/txjmb/jsonata-core
 [![JSONata conformance](https://img.shields.io/badge/JSONata%20conformance-1686%2F1686-brightgreen.svg)](https://github.com/jsonata-js/jsonata/tree/master/test/test-suite)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
 
-> ### ⚠️ Upgrading to 2.2.8 "Conform-ata" — please test before you deploy
+<!-- BEGIN generated performance chart -->
+<!-- Regenerated from the latest benchmark run by
+     benchmarks/python/generate_readme_chart.py. Do not hand-edit this block
+     or the SVGs it points at; edit the generator instead. -->
+<a href="https://txjmb.github.io/jsonata-core/stable/performance/">
+  <picture>
+    <source media="(prefers-color-scheme: dark)"
+            srcset="https://raw.githubusercontent.com/txjmb/jsonata-core/main/docs/assets/realistic-workload-dark.svg">
+    <img width="880"
+         alt="Realistic-workload benchmark on a 100-product dataset, lower is better: jsonatapy is 7.5x faster than the jsonata-js reference on the geometric mean of 5 e-commerce queries, and the pure-Rust jsonata-core engine is faster still."
+         src="https://raw.githubusercontent.com/txjmb/jsonata-core/main/docs/assets/realistic-workload-light.svg">
+  </picture>
+</a>
+
+*Click the chart for the full category-by-category tables, including jsonata-python
+and jsonata-rs, which are left off the chart because at 68 ms–9 s they would
+flatten everything else into a sliver.*
+<!-- END generated performance chart -->
+
+> ### ⚠️ Upgrading to 2.2.8 "Conform-ata"+ — please test before you deploy
 >
 > 2.2.8 is primarily a **conformance** release: it corrects a number of places where this
 > library disagreed with the jsonata-js reference. These issues were found during routine quality checks and documentation improvements.  The test harness was inadvertently missing some edge cases.  Many of those corrections **change the
@@ -97,7 +116,7 @@ JSONata implementation in Python, so the goal was to port JSONata to Rust (with
 for Python) and see how fast it could go. The answer: faster than V8 for most expression
 workloads, and faster than the next pure-Rust implementation.  The rust versions are published on crates.io, and the python wheels on pypi.  There is also a command-line binary and Python command-line available (works great with uvx) for use in scripting.  The Python library is also usable in a command-line fashion, and a C-compatible library is available for those who want to easily use jsonata in C/C++.
 
-Many, many thanks to the incredible work of all the maintainers of the [JSONata](https://github.com/jsonata-js/jsonata) reference library.  JSONata is a very powerful, well-designed, and useful language that has made an impact on many projects.  This project leverages their outstanding work to extend that capability to Python and Rust and would not be possible without that project.  The implementation in Rust was strongly influenced by their implementation.  The 1600+ (1686/1686 passing for last build of this project) tests they created provided the scaffolding and validation for all of this project.  This project will continue to follow and be a derivative of the reference project as the JSONata reference library evolves.
+Many, many thanks to the incredible work of all the maintainers of the [JSONata](https://github.com/jsonata-js/jsonata) reference library.  JSONata is a very powerful, well-designed, expressive and useful language that has made an impact on many projects.  This project leverages their outstanding work to extend that capability to Python and Rust and would not be possible without that project.  The implementation in Rust was strongly influenced by their implementation.  The 1600+ (1686/1686 passing for last build of this project) tests they created provided the scaffolding and validation for all of this project.  This project will continue to follow and be a derivative of the reference project as the JSONata reference library evolves.
 
 Release versions will follow the reference jsonata-js project major and minor release numbers, but not necessarily patches.  This will make it easier for adopters of this library to understand each release's JSONata API compatibility.  As an example, 2.2.8 should be compliant with 2.2.x jsonata-js tests, but may have fixes specific to this library.  If a patch release for jsonata-js is relevant for this project, it will be included in a patch release that may or may not follow the patch numbers of the upstream project.  "Major" versions of this library that don't include any updates to follow jsonata-js conformance will be "named" in release notes/changelog.
 
@@ -137,10 +156,10 @@ let result = Evaluator::new().evaluate(&ast, &data)?;
 ```toml
 # Cargo.toml
 [dependencies]
-jsonata-core = "2.2.8"          # pure Rust, no Python dependency
+jsonata-core = "2.2.9"          # pure Rust, no Python dependency
 
 # Optional: disable SIMD for constrained targets
-jsonata-core = { version = "2.2.8", default-features = false }
+jsonata-core = { version = "2.2.9", default-features = false }
 ```
 
 ---
@@ -225,7 +244,9 @@ See [official JSONata docs](https://docs.jsonata.org/) for the full language ref
 
 ## Performance
 
-`jsonata-core` passes **1682/1682** JSONata reference tests and is the fastest JSONata
+
+
+`jsonata-core` passes **1686/1686** JSONata reference tests and is the fastest JSONata
 implementation available in either Rust or Python:
 
 - **~6x faster on average** than the JavaScript reference implementation (V8), across all

{jsonatapy-2.2.8 → jsonatapy-2.2.10}/README.md

@@ -17,7 +17,26 @@
 [![JSONata conformance](https://img.shields.io/badge/JSONata%20conformance-1686%2F1686-brightgreen.svg)](https://github.com/jsonata-js/jsonata/tree/master/test/test-suite)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
 
-> ### ⚠️ Upgrading to 2.2.8 "Conform-ata" — please test before you deploy
+<!-- BEGIN generated performance chart -->
+<!-- Regenerated from the latest benchmark run by
+     benchmarks/python/generate_readme_chart.py. Do not hand-edit this block
+     or the SVGs it points at; edit the generator instead. -->
+<a href="https://txjmb.github.io/jsonata-core/stable/performance/">
+  <picture>
+    <source media="(prefers-color-scheme: dark)"
+            srcset="https://raw.githubusercontent.com/txjmb/jsonata-core/main/docs/assets/realistic-workload-dark.svg">
+    <img width="880"
+         alt="Realistic-workload benchmark on a 100-product dataset, lower is better: jsonatapy is 7.5x faster than the jsonata-js reference on the geometric mean of 5 e-commerce queries, and the pure-Rust jsonata-core engine is faster still."
+         src="https://raw.githubusercontent.com/txjmb/jsonata-core/main/docs/assets/realistic-workload-light.svg">
+  </picture>
+</a>
+
+*Click the chart for the full category-by-category tables, including jsonata-python
+and jsonata-rs, which are left off the chart because at 68 ms–9 s they would
+flatten everything else into a sliver.*
+<!-- END generated performance chart -->
+
+> ### ⚠️ Upgrading to 2.2.8 "Conform-ata"+ — please test before you deploy
 >
 > 2.2.8 is primarily a **conformance** release: it corrects a number of places where this
 > library disagreed with the jsonata-js reference. These issues were found during routine quality checks and documentation improvements.  The test harness was inadvertently missing some edge cases.  Many of those corrections **change the
@@ -48,7 +67,7 @@ JSONata implementation in Python, so the goal was to port JSONata to Rust (with
 for Python) and see how fast it could go. The answer: faster than V8 for most expression
 workloads, and faster than the next pure-Rust implementation.  The rust versions are published on crates.io, and the python wheels on pypi.  There is also a command-line binary and Python command-line available (works great with uvx) for use in scripting.  The Python library is also usable in a command-line fashion, and a C-compatible library is available for those who want to easily use jsonata in C/C++.
 
-Many, many thanks to the incredible work of all the maintainers of the [JSONata](https://github.com/jsonata-js/jsonata) reference library.  JSONata is a very powerful, well-designed, and useful language that has made an impact on many projects.  This project leverages their outstanding work to extend that capability to Python and Rust and would not be possible without that project.  The implementation in Rust was strongly influenced by their implementation.  The 1600+ (1686/1686 passing for last build of this project) tests they created provided the scaffolding and validation for all of this project.  This project will continue to follow and be a derivative of the reference project as the JSONata reference library evolves.
+Many, many thanks to the incredible work of all the maintainers of the [JSONata](https://github.com/jsonata-js/jsonata) reference library.  JSONata is a very powerful, well-designed, expressive and useful language that has made an impact on many projects.  This project leverages their outstanding work to extend that capability to Python and Rust and would not be possible without that project.  The implementation in Rust was strongly influenced by their implementation.  The 1600+ (1686/1686 passing for last build of this project) tests they created provided the scaffolding and validation for all of this project.  This project will continue to follow and be a derivative of the reference project as the JSONata reference library evolves.
 
 Release versions will follow the reference jsonata-js project major and minor release numbers, but not necessarily patches.  This will make it easier for adopters of this library to understand each release's JSONata API compatibility.  As an example, 2.2.8 should be compliant with 2.2.x jsonata-js tests, but may have fixes specific to this library.  If a patch release for jsonata-js is relevant for this project, it will be included in a patch release that may or may not follow the patch numbers of the upstream project.  "Major" versions of this library that don't include any updates to follow jsonata-js conformance will be "named" in release notes/changelog.
 
@@ -88,10 +107,10 @@ let result = Evaluator::new().evaluate(&ast, &data)?;
 ```toml
 # Cargo.toml
 [dependencies]
-jsonata-core = "2.2.8"          # pure Rust, no Python dependency
+jsonata-core = "2.2.9"          # pure Rust, no Python dependency
 
 # Optional: disable SIMD for constrained targets
-jsonata-core = { version = "2.2.8", default-features = false }
+jsonata-core = { version = "2.2.9", default-features = false }
 ```
 
 ---
@@ -176,7 +195,9 @@ See [official JSONata docs](https://docs.jsonata.org/) for the full language ref
 
 ## Performance
 
-`jsonata-core` passes **1682/1682** JSONata reference tests and is the fastest JSONata
+
+
+`jsonata-core` passes **1686/1686** JSONata reference tests and is the fastest JSONata
 implementation available in either Rust or Python:
 
 - **~6x faster on average** than the JavaScript reference implementation (V8), across all

jsonatapy-2.2.10/SECURITY.md

@@ -0,0 +1,47 @@
+# Security Policy
+
+This policy covers the **jsonata-core** Rust crate, the **jsonatapy** Python
+package, the `jsonata` command-line tool, and the C API in `bindings/c`, all
+published from this repository.
+
+## Supported Versions
+
+Security fixes are released as a new patch version of the latest minor line,
+published to [crates.io](https://crates.io/crates/jsonata-core) and
+[PyPI](https://pypi.org/project/jsonatapy/). Older lines do not receive
+backports; upgrade to the latest release to pick up a fix.
+
+| Version | Supported |
+| ------- | --------- |
+| 2.2.x (latest patch) | ✅ |
+| < 2.2 | ❌ |
+
+## Reporting a Vulnerability
+
+**Please do not report security vulnerabilities through public GitHub issues,
+discussions, or pull requests.**
+
+Report them privately instead: go to the repository's
+[**Security** tab](https://github.com/txjmb/jsonata-core/security) and choose
+**Report a vulnerability**. Only the maintainers can see the report.
+
+Please include:
+
+- The affected component (Rust crate, Python package, CLI, or C API) and version
+- A minimal reproduction: the JSONata expression and input data that trigger
+  the issue
+- What happens (crash, hang, memory growth, wrong result) and what you expected
+- Your assessment of the impact, if you have one
+
+What to expect:
+
+- We aim to acknowledge your report within 5 business days, and will keep you
+  updated as we investigate.
+- If the report is accepted, we fix it in a new patch release, then publish a
+  GitHub Security Advisory and request a CVE where appropriate. We coordinate
+  the disclosure date with you and credit you in the advisory unless you prefer
+  to stay anonymous.
+- If the report is declined, we explain why.
+
+Please give us a reasonable chance to release a fix before disclosing the issue
+publicly.

{jsonatapy-2.2.8 → jsonatapy-2.2.10}/bindings/c/README.md

@@ -141,7 +141,13 @@ Rust library rebuilds with your project.)
    deliberately (e.g. a frozen `$now`, or a disabled `$eval`). `user_data`
    must outlive the handle. Registering a host function routes evaluation
    through the tree-walker, like variable bindings.
-8. **Panics:** internal engine panics are caught at the boundary and
+8. **Guardrails:** `jsonata_set_limits(expr, timeout_ms, max_stack_depth,
+   max_sequence_length)` bounds wall-clock time (D1012), AST recursion
+   depth (D1011), and query-result sequence length (D2015) for all
+   subsequent evaluations on that handle — the same three limits the
+   Python bindings expose. 0 means "unlimited" (the default); call again
+   to change or reset.
+9. **Panics:** internal engine panics are caught at the boundary and
    surface as errors prefixed `internal error:` — they will not abort
    your process.
 

{jsonatapy-2.2.8 → jsonatapy-2.2.10}/bindings/c/examples/smoke.c

@@ -112,6 +112,27 @@ int main(void) {
         jsonata_free_expr(e);
     }
 
+    /* evaluation guardrails */
+    {
+        JsonataExpr *e = jsonata_compile("$map([1..100000], function($x) { $x })");
+        CHECK(jsonata_set_limits(NULL, 0, 0, 0) == -1, "set_limits NULL handle -> -1");
+        CHECK(jsonata_set_limits(e, 0, 0, 10) == 0, "set_limits succeeds");
+        char *r = jsonata_evaluate(e, "{}");
+        char *err = take_error();
+        char *code = jsonata_last_error_code();
+        CHECK(r == NULL && err != NULL, "sequence limit -> NULL + message");
+        CHECK(code != NULL && strcmp(code, "D2015") == 0,
+              "sequence limit -> spec code D2015");
+        jsonata_free_string(err);
+        jsonata_free_string(code);
+        /* lifting the limit makes the same handle work again */
+        CHECK(jsonata_set_limits(e, 0, 0, 0) == 0, "set_limits reset succeeds");
+        char *r2 = jsonata_evaluate(e, "{}");
+        CHECK(r2 != NULL, "evaluate succeeds after limit reset");
+        jsonata_free_string(r2);
+        jsonata_free_expr(e);
+    }
+
     /* variable binding */
     {
         JsonataExpr *e = jsonata_compile("$sum($xs) + n");