jsonatapy 2.2.9__tar.gz → 2.2.10__tar.gz

{jsonatapy-2.2.9 → jsonatapy-2.2.10}/CHANGELOG.md

@@ -19,6 +19,52 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Security
 
+## [2.2.10] - 2026-09-24
+
+### Added
+- `SECURITY.md` security policy: security fixes ship as a new patch release of the latest
+  minor line (currently 2.2.x) with no backports, and vulnerabilities are reported privately
+  through the repository's Security tab rather than in public issues. (#171)
+- Benchmark tables gain a per-row **jsonata-core (pure Rust)** column, measured by a new
+  `benchmarks/rust` harness that evaluates this project's engine as a Rust library with no
+  Python boundary. The column previously labelled `jsonatapy (rust)` is relabelled
+  `jsonatapy (json I/O)`: it was always the `evaluate_json` path of the same engine, not a
+  separate Rust implementation. (#162)
+- The README's performance section now shows an auto-generated chart of the "Realistic
+  Workload" benchmarks, regenerated alongside `docs/performance.md` on each release. (#165)
+- `CONTRIBUTORS.md`. (#167)
+
+### Changed
+- Updated Rust dependencies: `simd-json` 0.18.0 → 0.18.1 (#163), `indexmap` 2.14.0 → 2.14.2
+  (#168), and `clap` 4.6.6 → 4.6.7, used only by the `jsonata` CLI (#169).
+- CodeQL now runs through GitHub's CodeQL default setup, covering Rust, Python, C/C++,
+  JavaScript/TypeScript and GitHub Actions, instead of CodeQL jobs in the Security Scanning
+  workflow. (#170, #171)
+- The Security Scanning workflow now audits the resolved `uv.lock` with `pip-audit`, not just
+  the packages installed on the runner, and fails on a vulnerable locked dependency. It also
+  lists `cargo-audit` warnings such as yanked crates, without failing the build on them. (#170)
+
+### Deprecated
+
+### Removed
+
+### Fixed
+- The default docs URL (`/stable/`) served the previous release's performance page: the
+  release job deployed docs from the release tag, which never contains that release's own
+  benchmark numbers. Release docs now take `docs/performance.md` from `main` after the
+  benchmark job records it, and the docs workflow can republish the released docs line
+  without a new release. (#164)
+- Resolved all 18 open CodeQL code-quality alerts in the benchmark and test scripts, and
+  implemented the previously stubbed `test_compile_invalid_expression` test. (#170)
+
+### Security
+- `Cargo.lock`: `chacha20` 0.10.1 → 0.10.2. 0.10.1 was yanked; it reaches the build through
+  `rand` and was compiled into the 2.2.9 Python wheels and CLI binaries. (#170)
+- `uv.lock`: `anyio` 4.14.1 → 4.15.1 (CVE-2026-63374, CVE-2026-64847, CVE-2026-63349),
+  `cryptography` 49.0.0 → 50.0.1 (PYSEC-2026-3552), and `mkdocs-material` 9.7.6 → 9.7.7
+  (PYSEC-2026-3864). These are development and documentation dependencies only; the published
+  `jsonatapy` package has no Python dependencies and was not affected. (#170)
+
 ## [2.2.9] "Perform-ata" - 2026-08-31
 
 ### Changed

jsonatapy-2.2.10/CONTRIBUTORS.md

@@ -0,0 +1,2 @@
+# Contributors
+- [Maria](https://github.com/Tangerinedream13)

{jsonatapy-2.2.9 → jsonatapy-2.2.10}/Cargo.lock

@@ -189,9 +189,9 @@ checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
 
 [[package]]
 name = "chacha20"
-version = "0.10.1"
+version = "0.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d524456ba66e72eb8b115ff89e01e497f8e6d11d78b70b1aa13c0fbd97540a81"
+checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06"
 dependencies = [
  "cfg-if",
  "cpufeatures",
@@ -240,9 +240,9 @@ dependencies = [
 
 [[package]]
 name = "clap"
-version = "4.6.6"
+version = "4.6.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "473c7e07f409a8d772161724aa8db6a765a2532a70f9667eeb7b49d3d02fbdca"
+checksum = "aa8876b300ab35ba921adea3dfd70157a46249b33f95c9084ae5709785478946"
 dependencies = [
  "clap_builder",
  "clap_derive",
@@ -250,9 +250,9 @@ dependencies = [
 
 [[package]]
 name = "clap_builder"
-version = "4.6.6"
+version = "4.6.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7b48fea5a88e9ae728a2dcbedbfc0e730f7d60da42e1cb049a83c9fb8b789889"
+checksum = "ec0797fb7aeb1406c84efac526901f7ec3ead2124f946b494e72879d4b54704d"
 dependencies = [
  "anstream",
  "anstyle",
@@ -262,9 +262,9 @@ dependencies = [
 
 [[package]]
 name = "clap_derive"
-version = "4.6.4"
+version = "4.6.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d012d2b9d65aca7f18f4d9878a045bc17899bba951561ba5ec3c2ba1eed9a061"
+checksum = "f9c751b79415d4e559e3d1fcf128e09e720eb673a06d26cf6f392d37d75b66e0"
 dependencies = [
  "heck",
  "proc-macro2",
@@ -544,9 +544,9 @@ dependencies = [
 
 [[package]]
 name = "indexmap"
-version = "2.14.0"
+version = "2.14.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d466e9454f08e4a911e14806c24e16fba1b4c121d1ea474396f396069cf949d9"
+checksum = "cc4e190f5d26ca7051642629da2c52fc03bde85a03197c99408dcd291734c855"
 dependencies = [
  "equivalent",
  "hashbrown 0.17.1",
@@ -586,7 +586,7 @@ dependencies = [
 
 [[package]]
 name = "jsonata-core"
-version = "2.2.9"
+version = "2.2.10"
 dependencies = [
  "assert_cmd",
  "base64",
@@ -1132,9 +1132,9 @@ checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"
 
 [[package]]
 name = "simd-json"
-version = "0.18.0"
+version = "0.18.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5b4c2bab24c48682e93509b5afc39f1f6ef2fbc1ebccab917c8b0534b3007ae4"
+checksum = "6ebe141eb4a23ecc4d5de93fa5b139ac65dc07c38037a2fe9a8fb7c9d36bd832"
 dependencies = [
  "halfbrown",
  "ref-cast",

{jsonatapy-2.2.9 → jsonatapy-2.2.10}/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "jsonata-core"
-version = "2.2.9"
+version = "2.2.10"
 edition = "2021"
 authors = ["txjmb <txjmb@users.noreply.github.com>"]
 description = "High-performance Rust implementation of JSONata query and transformation language"

{jsonatapy-2.2.9 → jsonatapy-2.2.10}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: jsonatapy
-Version: 2.2.9
+Version: 2.2.10
 Classifier: Development Status :: 5 - Production/Stable
 Classifier: Intended Audience :: Developers
 Classifier: License :: OSI Approved :: MIT License
@@ -66,7 +66,26 @@ Project-URL: Repository, https://github.com/txjmb/jsonata-core
 [![JSONata conformance](https://img.shields.io/badge/JSONata%20conformance-1686%2F1686-brightgreen.svg)](https://github.com/jsonata-js/jsonata/tree/master/test/test-suite)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
 
-> ### ⚠️ Upgrading to 2.2.8 "Conform-ata" — please test before you deploy
+<!-- BEGIN generated performance chart -->
+<!-- Regenerated from the latest benchmark run by
+     benchmarks/python/generate_readme_chart.py. Do not hand-edit this block
+     or the SVGs it points at; edit the generator instead. -->
+<a href="https://txjmb.github.io/jsonata-core/stable/performance/">
+  <picture>
+    <source media="(prefers-color-scheme: dark)"
+            srcset="https://raw.githubusercontent.com/txjmb/jsonata-core/main/docs/assets/realistic-workload-dark.svg">
+    <img width="880"
+         alt="Realistic-workload benchmark on a 100-product dataset, lower is better: jsonatapy is 7.5x faster than the jsonata-js reference on the geometric mean of 5 e-commerce queries, and the pure-Rust jsonata-core engine is faster still."
+         src="https://raw.githubusercontent.com/txjmb/jsonata-core/main/docs/assets/realistic-workload-light.svg">
+  </picture>
+</a>
+
+*Click the chart for the full category-by-category tables, including jsonata-python
+and jsonata-rs, which are left off the chart because at 68 ms–9 s they would
+flatten everything else into a sliver.*
+<!-- END generated performance chart -->
+
+> ### ⚠️ Upgrading to 2.2.8 "Conform-ata"+ — please test before you deploy
 >
 > 2.2.8 is primarily a **conformance** release: it corrects a number of places where this
 > library disagreed with the jsonata-js reference. These issues were found during routine quality checks and documentation improvements.  The test harness was inadvertently missing some edge cases.  Many of those corrections **change the
@@ -97,7 +116,7 @@ JSONata implementation in Python, so the goal was to port JSONata to Rust (with
 for Python) and see how fast it could go. The answer: faster than V8 for most expression
 workloads, and faster than the next pure-Rust implementation.  The rust versions are published on crates.io, and the python wheels on pypi.  There is also a command-line binary and Python command-line available (works great with uvx) for use in scripting.  The Python library is also usable in a command-line fashion, and a C-compatible library is available for those who want to easily use jsonata in C/C++.
 
-Many, many thanks to the incredible work of all the maintainers of the [JSONata](https://github.com/jsonata-js/jsonata) reference library.  JSONata is a very powerful, well-designed, and useful language that has made an impact on many projects.  This project leverages their outstanding work to extend that capability to Python and Rust and would not be possible without that project.  The implementation in Rust was strongly influenced by their implementation.  The 1600+ (1686/1686 passing for last build of this project) tests they created provided the scaffolding and validation for all of this project.  This project will continue to follow and be a derivative of the reference project as the JSONata reference library evolves.
+Many, many thanks to the incredible work of all the maintainers of the [JSONata](https://github.com/jsonata-js/jsonata) reference library.  JSONata is a very powerful, well-designed, expressive and useful language that has made an impact on many projects.  This project leverages their outstanding work to extend that capability to Python and Rust and would not be possible without that project.  The implementation in Rust was strongly influenced by their implementation.  The 1600+ (1686/1686 passing for last build of this project) tests they created provided the scaffolding and validation for all of this project.  This project will continue to follow and be a derivative of the reference project as the JSONata reference library evolves.
 
 Release versions will follow the reference jsonata-js project major and minor release numbers, but not necessarily patches.  This will make it easier for adopters of this library to understand each release's JSONata API compatibility.  As an example, 2.2.8 should be compliant with 2.2.x jsonata-js tests, but may have fixes specific to this library.  If a patch release for jsonata-js is relevant for this project, it will be included in a patch release that may or may not follow the patch numbers of the upstream project.  "Major" versions of this library that don't include any updates to follow jsonata-js conformance will be "named" in release notes/changelog.
 
@@ -137,10 +156,10 @@ let result = Evaluator::new().evaluate(&ast, &data)?;
 ```toml
 # Cargo.toml
 [dependencies]
-jsonata-core = "2.2.8"          # pure Rust, no Python dependency
+jsonata-core = "2.2.9"          # pure Rust, no Python dependency
 
 # Optional: disable SIMD for constrained targets
-jsonata-core = { version = "2.2.8", default-features = false }
+jsonata-core = { version = "2.2.9", default-features = false }
 ```
 
 ---
@@ -225,7 +244,9 @@ See [official JSONata docs](https://docs.jsonata.org/) for the full language ref
 
 ## Performance
 
-`jsonata-core` passes **1682/1682** JSONata reference tests and is the fastest JSONata
+
+
+`jsonata-core` passes **1686/1686** JSONata reference tests and is the fastest JSONata
 implementation available in either Rust or Python:
 
 - **~6x faster on average** than the JavaScript reference implementation (V8), across all

{jsonatapy-2.2.9 → jsonatapy-2.2.10}/README.md

@@ -17,7 +17,26 @@
 [![JSONata conformance](https://img.shields.io/badge/JSONata%20conformance-1686%2F1686-brightgreen.svg)](https://github.com/jsonata-js/jsonata/tree/master/test/test-suite)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
 
-> ### ⚠️ Upgrading to 2.2.8 "Conform-ata" — please test before you deploy
+<!-- BEGIN generated performance chart -->
+<!-- Regenerated from the latest benchmark run by
+     benchmarks/python/generate_readme_chart.py. Do not hand-edit this block
+     or the SVGs it points at; edit the generator instead. -->
+<a href="https://txjmb.github.io/jsonata-core/stable/performance/">
+  <picture>
+    <source media="(prefers-color-scheme: dark)"
+            srcset="https://raw.githubusercontent.com/txjmb/jsonata-core/main/docs/assets/realistic-workload-dark.svg">
+    <img width="880"
+         alt="Realistic-workload benchmark on a 100-product dataset, lower is better: jsonatapy is 7.5x faster than the jsonata-js reference on the geometric mean of 5 e-commerce queries, and the pure-Rust jsonata-core engine is faster still."
+         src="https://raw.githubusercontent.com/txjmb/jsonata-core/main/docs/assets/realistic-workload-light.svg">
+  </picture>
+</a>
+
+*Click the chart for the full category-by-category tables, including jsonata-python
+and jsonata-rs, which are left off the chart because at 68 ms–9 s they would
+flatten everything else into a sliver.*
+<!-- END generated performance chart -->
+
+> ### ⚠️ Upgrading to 2.2.8 "Conform-ata"+ — please test before you deploy
 >
 > 2.2.8 is primarily a **conformance** release: it corrects a number of places where this
 > library disagreed with the jsonata-js reference. These issues were found during routine quality checks and documentation improvements.  The test harness was inadvertently missing some edge cases.  Many of those corrections **change the
@@ -48,7 +67,7 @@ JSONata implementation in Python, so the goal was to port JSONata to Rust (with
 for Python) and see how fast it could go. The answer: faster than V8 for most expression
 workloads, and faster than the next pure-Rust implementation.  The rust versions are published on crates.io, and the python wheels on pypi.  There is also a command-line binary and Python command-line available (works great with uvx) for use in scripting.  The Python library is also usable in a command-line fashion, and a C-compatible library is available for those who want to easily use jsonata in C/C++.
 
-Many, many thanks to the incredible work of all the maintainers of the [JSONata](https://github.com/jsonata-js/jsonata) reference library.  JSONata is a very powerful, well-designed, and useful language that has made an impact on many projects.  This project leverages their outstanding work to extend that capability to Python and Rust and would not be possible without that project.  The implementation in Rust was strongly influenced by their implementation.  The 1600+ (1686/1686 passing for last build of this project) tests they created provided the scaffolding and validation for all of this project.  This project will continue to follow and be a derivative of the reference project as the JSONata reference library evolves.
+Many, many thanks to the incredible work of all the maintainers of the [JSONata](https://github.com/jsonata-js/jsonata) reference library.  JSONata is a very powerful, well-designed, expressive and useful language that has made an impact on many projects.  This project leverages their outstanding work to extend that capability to Python and Rust and would not be possible without that project.  The implementation in Rust was strongly influenced by their implementation.  The 1600+ (1686/1686 passing for last build of this project) tests they created provided the scaffolding and validation for all of this project.  This project will continue to follow and be a derivative of the reference project as the JSONata reference library evolves.
 
 Release versions will follow the reference jsonata-js project major and minor release numbers, but not necessarily patches.  This will make it easier for adopters of this library to understand each release's JSONata API compatibility.  As an example, 2.2.8 should be compliant with 2.2.x jsonata-js tests, but may have fixes specific to this library.  If a patch release for jsonata-js is relevant for this project, it will be included in a patch release that may or may not follow the patch numbers of the upstream project.  "Major" versions of this library that don't include any updates to follow jsonata-js conformance will be "named" in release notes/changelog.
 
@@ -88,10 +107,10 @@ let result = Evaluator::new().evaluate(&ast, &data)?;
 ```toml
 # Cargo.toml
 [dependencies]
-jsonata-core = "2.2.8"          # pure Rust, no Python dependency
+jsonata-core = "2.2.9"          # pure Rust, no Python dependency
 
 # Optional: disable SIMD for constrained targets
-jsonata-core = { version = "2.2.8", default-features = false }
+jsonata-core = { version = "2.2.9", default-features = false }
 ```
 
 ---
@@ -176,7 +195,9 @@ See [official JSONata docs](https://docs.jsonata.org/) for the full language ref
 
 ## Performance
 
-`jsonata-core` passes **1682/1682** JSONata reference tests and is the fastest JSONata
+
+
+`jsonata-core` passes **1686/1686** JSONata reference tests and is the fastest JSONata
 implementation available in either Rust or Python:
 
 - **~6x faster on average** than the JavaScript reference implementation (V8), across all

jsonatapy-2.2.10/SECURITY.md

@@ -0,0 +1,47 @@
+# Security Policy
+
+This policy covers the **jsonata-core** Rust crate, the **jsonatapy** Python
+package, the `jsonata` command-line tool, and the C API in `bindings/c`, all
+published from this repository.
+
+## Supported Versions
+
+Security fixes are released as a new patch version of the latest minor line,
+published to [crates.io](https://crates.io/crates/jsonata-core) and
+[PyPI](https://pypi.org/project/jsonatapy/). Older lines do not receive
+backports; upgrade to the latest release to pick up a fix.
+
+| Version | Supported |
+| ------- | --------- |
+| 2.2.x (latest patch) | ✅ |
+| < 2.2 | ❌ |
+
+## Reporting a Vulnerability
+
+**Please do not report security vulnerabilities through public GitHub issues,
+discussions, or pull requests.**
+
+Report them privately instead: go to the repository's
+[**Security** tab](https://github.com/txjmb/jsonata-core/security) and choose
+**Report a vulnerability**. Only the maintainers can see the report.
+
+Please include:
+
+- The affected component (Rust crate, Python package, CLI, or C API) and version
+- A minimal reproduction: the JSONata expression and input data that trigger
+  the issue
+- What happens (crash, hang, memory growth, wrong result) and what you expected
+- Your assessment of the impact, if you have one
+
+What to expect:
+
+- We aim to acknowledge your report within 5 business days, and will keep you
+  updated as we investigate.
+- If the report is accepted, we fix it in a new patch release, then publish a
+  GitHub Security Advisory and request a CVE where appropriate. We coordinate
+  the disclosure date with you and credit you in the advisory unless you prefer
+  to stay anonymous.
+- If the report is declined, we explain why.
+
+Please give us a reasonable chance to release a fix before disclosing the issue
+publicly.

{jsonatapy-2.2.9 → jsonatapy-2.2.10}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "maturin"
 
 [project]
 name = "jsonatapy"
-version = "2.2.9"
+version = "2.2.10"
 description = "High-performance Python/Rust implementation of JSONata query and transformation language"
 authors = [
     {name = "txjmb", email = "txjmb@users.noreply.github.com"}