[dependabot]

Bumps the cargo group with 3 updates in the / directory: dua-core, ruby-prism and jsonschema.

Updates dua-core from 4.2.0 to 5.0.1

Release notes

Sourced from dua-core's releases.

dua-core v5.0.1

Bug Fixes

• fall back when macOS bulk directory reads are unavailable The new implementation can have a performance impact if the bulk reads are turned off, but this can be controlled with configuration so shouldn't be a problem. Also, it's for old systems.

  PowerPC and macOS before 10.10 do not provide getattrlistbulk, so unconditional native directory enumeration leaves dua-core consumers with an undefined symbol at link time.

  Select bulk reads from the target architecture and deployment version in build.rs. Respect MACOSX_DEPLOYMENT_TARGET, otherwise query the target compiler's default; unknown versions and architectures use ordinary directory reads. Keep the existing macOS entry/metadata API and preserve requested APFS clone metadata in the fallback.

  Review identified an unused 64 KiB allocation per directory in fallback builds. Make that buffer zero-sized, avoiding the heap allocation while keeping the shared reader layout and fallback behavior.

  Also omit clock_gettime before macOS 10.12, leaving the metadata probe's existing missing-clock behavior in place.

• avoid reading past HEADER_SIZE in Windows ReadDir::entry_at FILE_ID_BOTH_DIR_INFO has a 104-byte fixed header (HEADER_SIZE) followed by FileName: [u16; 1] (2 bytes) and 6 bytes of trailing alignment padding (size_of::<FILE_ID_BOTH_DIR_INFO>() == 112).

Commit Statistics

• 4 commits contributed to the release.
• 10 days passed between releases.
• 2 commits were understood as conventional.
• 1 unique issue was worked on: #417

Commit Details

• #417
  • Fall back when macOS bulk directory reads are unavailable (67c8576)
• Uncategorized
  • Merge pull request #418 from Byron/conditional-bulk-macos (fb5d863)
  • Merge pull request #416 from kiranani/fix-windows-entry-at-oob-read (48c91c7)
  • Avoid reading past HEADER_SIZE in Windows ReadDir::entry_at (b5ef287)

dua-core v5.0.0

... (truncated)

Commits

• 467f3ec Release dua-core v5.0.1
• fb5d863 Merge pull request #418 from Byron/conditional-bulk-macos
• 67c8576 fix(dua-core): fall back when macOS bulk directory reads are unavailable (#417)
• 48c91c7 Merge pull request #416 from kiranani/fix-windows-entry-at-oob-read
• b5ef287 fix(dua-core): avoid reading past HEADER_SIZE in Windows ReadDir::entry_at
• 9ccf20f Merge pull request #415 from Rajvira10/fix/marked-path-display-width
• 3ab91b4 review
• d8a9376 Fix marked-pane alignment for wide Unicode paths
• 45a2649 Release dua-cli v2.46.0
• 8225b10 prepare changelog prior to dua-cli release
• Additional commits viewable in compare view

Updates ruby-prism from 1.9.0 to 2.0.0

Release notes

Sourced from ruby-prism's releases.

v2.0.0

Highlights

• Significant performance and memory usage improvements.
• Precompiled platform-specific variants on rubygems.org.
• Many documentation improvements, including a new playground.
• Prism now ships accurate and complete RBS and RBI definitions.
• The license is now owned by the Ruby developers.
• Prism now ships an official C++ interface.

Added

• Support for parsing Ruby 4.1 syntax:
  • Add support for &nil to declare that a method accepts no block.
  • Thoroughly implement void value expression check.
  • Allow trailing commas in method signatures like def foo(a,); end.
  • Reject END { break } and END { next }.
  • a /b/ no longer warns about ambiguous /.
• version: "nearest" is now supported. It behaves similarly to version: "current" but will not raise when the version is unsupported, instead falling back to the nearest syntax version prism currently supports.
• raise_error was added as a valid option. Prism will raise a SyntaxError when given syntax-invalid code. When true is given, prism decides the formatting (tty?, NO_COLOR, etc.). If you need a specific style, :plain, :style, and :color are also supported values.
• Added Prism::ParseResult#continuable to check if the parsed source can become valid by appending more code.
• Prism.find takes a Method, UnboundMethod, Proc, or Thread::Backtrace::Location and returns the associated prism AST node.
• ForwardingSuperNode now has keyword_loc.
• Allow pattern matching with prism nodes to match on location slices, like node in Prism::StringNode[content: "foo"].
• Prism.parse_file and similar now accept anything responding to to_path (like Pathname) directly.
• attach_comments was added as a valid option. Each comment is attached to the node that ends latest on the comment's line before it, otherwise to the innermost node that contains it (or to that node's statements, if only whitespace and comments come between the comment and the statements), otherwise to the top-level statements. The attached comments are available through Node#comments and through pm_node_comments_size and pm_node_comment in the C API, as well as pm_parser_comment_attachment, pm_parser_comment_ranges_size, and pm_parser_comment_range, which expose the attachments grouped by node. When the option is set, the comments on the parse result are sorted by start offset.
• StringQuery#keyword? was added to check if the string query matches a keyword.
• Source#checksum was added to retrieve the checksum of the source content.

Changed

Note that for this major version, almost every change listed below is breaking.

• Prism now defaults to version: "nearest" instead of version: "latest", so code is parsed with the syntax of the running Ruby (or the closest version prism supports). Pass version: "latest" to keep the previous behavior.
• MissingNode has been replaced by ErrorRecoveryNode. ErrorRecoveryNode wraps unexpected nodes, so when walking syntax-invalid code you will now only need to handle this one specific node type.
• Some fields were renamed for consistency. Previous names are aliased and will continue to work in the Ruby layer.
  • InNode#{in,then}_loc -> InNode#{in,then}_keyword_loc
  • MatchPredicateNode#operator_loc -> MatchPredicateNode#keyword_loc
  • UnlessNode#keyword_loc -> UnlessNode#unless_keyword_loc
  • UntilNode#{keyword,closing}_loc -> UntilNode#{until,end}_keyword_loc
  • WhenNode#keyword_loc -> WhenNode#when_keyword_loc
  • WhileNode#{keyword,closing}_loc -> WhileNode#{while,end}_keyword_loc
• Optional locations like StringNode#closing_loc in 'foo that were empty for syntax-invalid code will now be nil instead.
• Prism.lex now returns an array of tokens instead of an array of [token, internal_parse_state]. Previous access like token[0] or token.first to extract the actual token will continue to work. Additionally the following tokens were changed:
  • PARENTHESIS_LEFT was split up into PARENTHESIS_LEFT and PARENTHESIS_LEFT_GROUPING.
  • BRACE_LEFT was split up into BRACE_LEFT, BRACE_LEFT_ARGUMENT, and BRACE_LEFT_HASH.
  • BACKTICK was split up into BACKTICK and XSTRING_BACKTICK.
  • NEWLINE was split up into NEWLINE and NEWLINE_TERMINATOR.
  • WORDS_SEP was split up into WORDS_SEP and WORDS_SEP_IMPLICIT.

... (truncated)

Changelog

Sourced from ruby-prism's changelog.

[2.0.0] - 2026-10-21

Highlights

• Significant performance and memory usage improvements.
• Precompiled platform-specific variants on rubygems.org.
• Many documentation improvements, including a new playground.
• Prism now ships accurate and complete RBS and RBI definitions.
• The license is now owned by the Ruby developers.
• Prism now ships an official C++ interface.

Added

• Support for parsing Ruby 4.1 syntax:
  • Add support for &nil to declare that a method accepts no block.
  • Thoroughly implement void value expression check.
  • Allow trailing commas in method signatures like def foo(a,); end.
  • Reject END { break } and END { next }.
  • a /b/ no longer warns about ambiguous /.
• version: "nearest" is now supported. It behaves similarly to version: "current" but will not raise when the version is unsupported, instead falling back to the nearest syntax version prism currently supports.
• raise_error was added as a valid option. Prism will raise a SyntaxError when given syntax-invalid code. When true is given, prism decides the formatting (tty?, NO_COLOR, etc.). If you need a specific style, :plain, :style, and :color are also supported values.
• Added Prism::ParseResult#continuable to check if the parsed source can become valid by appending more code.
• Prism.find takes a Method, UnboundMethod, Proc, or Thread::Backtrace::Location and returns the associated prism AST node.
• ForwardingSuperNode now has keyword_loc.
• Allow pattern matching with prism nodes to match on location slices, like node in Prism::StringNode[content: "foo"].
• Prism.parse_file and similar now accept anything responding to to_path (like Pathname) directly.
• attach_comments was added as a valid option. Each comment is attached to the node that ends latest on the comment's line before it, otherwise to the innermost node that contains it (or to that node's statements, if only whitespace and comments come between the comment and the statements), otherwise to the top-level statements. The attached comments are available through Node#comments and through pm_node_comments_size and pm_node_comment in the C API, as well as pm_parser_comment_attachment, pm_parser_comment_ranges_size, and pm_parser_comment_range, which expose the attachments grouped by node. When the option is set, the comments on the parse result are sorted by start offset.
• StringQuery#keyword? was added to check if the string query matches a keyword.
• Source#checksum was added to retrieve the checksum of the source content.

Changed

Note that for this major version, almost every change listed below is breaking.

• Prism now defaults to version: "nearest" instead of version: "latest", so code is parsed with the syntax of the running Ruby (or the closest version prism supports). Pass version: "latest" to keep the previous behavior.
• MissingNode has been replaced by ErrorRecoveryNode. ErrorRecoveryNode wraps unexpected nodes, so when walking syntax-invalid code you will now only need to handle this one specific node type.
• Some fields were renamed for consistency. Previous names are aliased and will continue to work in the Ruby layer.
  • InNode#{in,then}_loc -> InNode#{in,then}_keyword_loc
  • MatchPredicateNode#operator_loc -> MatchPredicateNode#keyword_loc
  • UnlessNode#keyword_loc -> UnlessNode#unless_keyword_loc
  • UntilNode#{keyword,closing}_loc -> UntilNode#{until,end}_keyword_loc
  • WhenNode#keyword_loc -> WhenNode#when_keyword_loc
  • WhileNode#{keyword,closing}_loc -> WhileNode#{while,end}_keyword_loc
• Optional locations like StringNode#closing_loc in 'foo that were empty for syntax-invalid code will now be nil instead.
• Prism.lex now returns an array of tokens instead of an array of [token, internal_parse_state]. Previous access like token[0] or token.first to extract the actual token will continue to work. Additionally the following tokens were changed:
  • PARENTHESIS_LEFT was split up into PARENTHESIS_LEFT and PARENTHESIS_LEFT_GROUPING.
  • BRACE_LEFT was split up into BRACE_LEFT, BRACE_LEFT_ARGUMENT, and BRACE_LEFT_HASH.
  • BACKTICK was split up into BACKTICK and XSTRING_BACKTICK.
  • NEWLINE was split up into NEWLINE and NEWLINE_TERMINATOR.
  • WORDS_SEP was split up into WORDS_SEP and WORDS_SEP_IMPLICIT.

... (truncated)

Commits

• e272736 Bump to v2.0.0
• 57b8dbe Ship an official C++ interface
• bda3cff Use slice!(-n,n) instead of pop(n) to fix ractors
• 8adb155 Fix cygwin
• ab92f0e Serialize using post-order traversal
• 72da479 Fix printf format attribute on ucrt64-mingw gcc 16.3
• 4896c9f Expose pm_node_list_append and pm_parser_constant_insert
• ba48773 Make strings just a view into memory
• dd8b706 Avoid allocating when comparing magic comments
• 770e381 Default options start line to 1
• Additional commits viewable in compare view

Updates jsonschema from 0.58.5 to 0.60.1

Release notes

Sourced from jsonschema's releases.

[Python] Release 0.60.1

Fixed

• Wrong results in type: integer, const, enum, uniqueItems, multipleOf, minimum, maximum, exclusiveMinimum and exclusiveMaximum for numbers with exponents past one million, such as 1e-2000000.

Performance

• Validation of numbers with many digits or large exponents in const, enum, uniqueItems, type: integer, multipleOf, minimum, maximum, exclusiveMinimum and exclusiveMaximum taking time growing faster than the square of the digit count, instead of at most the square.
• Validation of numbers with more than ten thousand digits, written or implied by their exponent, taking time linear in their written length instead of quadratic in their digit count.

[Rust] Release 0.60.1

• Panic on numbers past f64 in const, enum, minimum, maximum, exclusiveMinimum, exclusiveMaximum and type: integer when another crate in the build enables serde_json/arbitrary_precision while the arbitrary-precision feature is off. #1790
• #[jsonschema::validator] panicking during expansion, or generating code that panics, on schema numbers past f64 when another crate in the build enables serde_json/arbitrary_precision while the arbitrary-precision feature is off. Such numbers are compile errors, as without that serde_json feature. #1790
• const, enum and uniqueItems treating objects with the same members in a different key order as unequal when another crate in the build enables serde_json/preserve_order. #1791
• Wrong results in type: integer, const, enum, uniqueItems, multipleOf, minimum, maximum, exclusiveMinimum and exclusiveMaximum for numbers with exponents past one million, such as 1e-2000000, with the arbitrary-precision feature.
• #[jsonschema::validator] rejecting multipleOf with a positive divisor below the smallest f64, such as 1e-400, with the arbitrary-precision feature.

Performance

• Validation of numbers with many digits or large exponents in const, enum, uniqueItems, type: integer, multipleOf, minimum, maximum, exclusiveMinimum and exclusiveMaximum with the arbitrary-precision feature taking time growing faster than the square of the digit count, instead of at most the square.
• Validation of numbers with more than ten thousand digits, written or implied by their exponent, with the arbitrary-precision feature taking time linear in their written length instead of quadratic in their digit count.

[Ruby] Release 0.60.1

Fixed

• Wrong results in type: integer, const, enum, uniqueItems, multipleOf, minimum, maximum, exclusiveMinimum and exclusiveMaximum for numbers with exponents past one million, such as 1e-2000000.

Performance

• Validation of numbers with many digits or large exponents in const, enum, uniqueItems, type: integer, multipleOf, minimum, maximum, exclusiveMinimum and exclusiveMaximum taking time growing faster than the square of the digit count, instead of at most the square.
• Validation of numbers with more than ten thousand digits, written or implied by their exponent, taking time linear in their written length instead of quadratic in their digit count.

[Python] Release 0.60.0

Added

• Support for Python 3.15.

Changed

• Update pyo3 to 0.30.
• canonicalize and canonical.find_unsatisfiable take schema positionally only, like bundle and dereference.

Fixed

• Type stubs rejecting valid usage: dict | bool schemas, ReferencingError in except, match on error kinds.
• import jsonschema_rs.canonical.json and import jsonschema_rs.canonical.schema raising ModuleNotFoundError.
• inspect.signature of validator and Evaluation methods missing self.
• ValidationErrorKind reporting builtins as its module.
• validator_for returning instances that fail isinstance checks against Validator and draft classes.

... (truncated)

Changelog

Sourced from jsonschema's changelog.

[0.60.1] - 2026-10-23

Fixed

• Panic on numbers past f64 in const, enum, minimum, maximum, exclusiveMinimum, exclusiveMaximum and type: integer when another crate in the build enables serde_json/arbitrary_precision while the arbitrary-precision feature is off. #1790
• #[jsonschema::validator] panicking during expansion, or generating code that panics, on schema numbers past f64 when another crate in the build enables serde_json/arbitrary_precision while the arbitrary-precision feature is off. Such numbers are compile errors, as without that serde_json feature. #1790
• const, enum and uniqueItems treating objects with the same members in a different key order as unequal when another crate in the build enables serde_json/preserve_order. #1791
• Wrong results in type: integer, const, enum, uniqueItems, multipleOf, minimum, maximum, exclusiveMinimum and exclusiveMaximum for numbers with exponents past one million, such as 1e-2000000, with the arbitrary-precision feature.
• #[jsonschema::validator] rejecting multipleOf with a positive divisor below the smallest f64, such as 1e-400, with the arbitrary-precision feature.

Performance

• Validation of numbers with many digits or large exponents in const, enum, uniqueItems, type: integer, multipleOf, minimum, maximum, exclusiveMinimum and exclusiveMaximum with the arbitrary-precision feature taking time growing faster than the square of the digit count, instead of at most the square.
• Validation of numbers with more than ten thousand digits, written or implied by their exponent, with the arbitrary-precision feature taking time linear in their written length instead of quadratic in their digit count.

[0.60.0] - 2026-10-22

Changed

• ValidationErrorKind::Enum and ValidationErrorKind::Constant holding their values as Arc<Value> shared with the validator, instead of a copy per error. #1777

Performance

• Validation with unfinished regex matches running each such match once instead of once per run, and comparing errors across runs in linear time instead of quadratic. #1784
• items and additionalProperties looking up a single-keyword subschema once per array or object instead of once per value.
• is_valid and validate reading fewer cache lines per subschema, by keeping error locations apart from validators.
• is_valid on recursive schemas caching only $ref results that took many steps to compute, instead of every one.
• Error evaluation paths taking memory linear in the $ref nesting depth, not quadratic. #1778

[0.59.0] - 2026-10-16

Added

• CLI: - as a path reads the schema or an instance from stdin.
• CLI: -V as the version flag; -v stays as an alias.

Changed

• CLI: Exit status 3 for errors that prevent a verdict and 2 for usage errors, so 1 always means an invalid instance or schema.
• CLI: Errors print to stderr instead of stdout.
• CLI: --version prints jsonschema-cli <VERSION> instead of Version: <VERSION>.

Fixed

• CLI: Panic when stdout is closed early, as in jsonschema-cli validate ... | head.
• CLI: Missing file path in the error for an unreadable instance in text output.
• CLI: jsonschema-cli bundle, jsonschema-cli dereference and jsonschema-cli canonicalize truncating the --output file when the write fails partway.
• CLI: jsonschema-cli validate --help describing --offline in terms of --resource, which validate does not accept.
• CLI: Error and warning messages suggesting jsonschema commands instead of the installed jsonschema-cli binary.
• Canonicalizing several subschemas of one prepared document, where a $ref in a later output could point at another subschema.

... (truncated)

Commits

• e9af61d chore(ruby): Release 0.60.1
• 8aa123d chore(python): Release 0.60.1
• 4eb7a64 chore(rust): Release 0.60.1
• 4e90b95 perf: Single scan for the exponent in the digit budget check
• f990b96 fix: Wrong results for numbers past the exponent cap with arbitrary-precision
• c221db8 perf: Super-quadratic conversion of large numbers to fractions with arbitrary...
• 9f3b332 fix: Object equality depending on key order when serde_json preserve_order is...
• a5eb859 fix: Panic on numbers past f64 when serde_json arbitrary_precision is enabled...
• dd3169e chore(python): Release 0.60.0
• edbbbea chore(ruby): Release 0.60.0
• Additional commits viewable in compare view

[dduugg]

@dependabot rebase

[dduugg]

@dependabot rebase

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.