[dependabot]

Bumps jsonschema from 0.47.0 to 0.58.5.

Release notes

Sourced from jsonschema's releases.

[CLI] Release 0.58.5

No release notes provided.

[Python] Release 0.58.5

Fixed

• canonicalize keeping a reference to a cycle of bare references under not or oneOf instead of treating it as accepting every value.
• Validator construction holding the GIL while it retrieves external resources over HTTP or from files.

[Ruby] Release 0.58.5

Fixed

• canonicalize keeping a reference to a cycle of bare references under not or oneOf instead of treating it as accepting every value.
• Validator construction holding the GVL while it retrieves external resources over HTTP or from files.

[Rust] Release 0.58.5

Fixed

• canonicalize keeping a reference to a cycle of bare references under not or oneOf instead of treating it as accepting every value.

[CLI] Release 0.58.4

No release notes provided.

[Python] Release 0.58.4

Fixed

• repr of a validator_for validator naming the default draft instead of the one $schema declares.
• unevaluatedProperties and unevaluatedItems beside a $recursiveRef ignoring what the reference target evaluates.
• unevaluatedProperties ignoring the configured regex engine and its limits for patternProperties.
• Absolute keyword location and schemaLocation of keywords a $ref JSON Pointer reaches through a subschema with its own $id.
• type, minItems and maxItems ignored beside items when the applicator vocabulary is disabled.
• Absolute keyword location and schemaLocation of keywords inside a nested $id resource counting from the document root.
• required beside properties ignored when the applicator vocabulary is disabled, and required, minContains and maxContains applied when the validation vocabulary is disabled.
• Absolute keyword location and evaluation output of type errors in a type-only items subschema pointing at items instead of the failing element's type.
• Absolute keyword location of patternProperties annotations missing its JSON Pointer fragment.
• Evaluation output of type: array beside schema-form items omitting passing type, minItems and maxItems units and nesting failing ones under items.
• Evaluation output schemaLocation and absolute keyword location of $ref, $dynamicRef and $recursiveRef nodes not pointing at the reference target.
• Evaluation output schemaLocation URIs not percent-encoding their fragment, such as a space in a property name.
• Absolute keyword location of errors and annotations from a whole subschema, such as false, missing its JSON Pointer fragment.
• Absolute keyword location of required, minContains and maxContains errors pointing at a sibling keyword.
• Evaluation annotations from $ref siblings in Draft 4, 6 and 7 schemas.
• Masked additionalItems messages counting allowed items instead of extra ones, and "1 items" in masked unevaluatedItems messages.
• $dynamicRef and $recursiveRef resolving in the dynamic scope of another path to the same schema, depending on property order.
• unevaluatedProperties and unevaluatedItems ignoring what then or else evaluates when if is true or false.
• Stack overflow when building validators for long $ref chains.
• format: "regex" and meta-schema validation rejecting escaped punctuation such as \- in patterns.
• Build errors for an invalid patternProperties regex reporting the subschema instead of the pattern and its location.

[Ruby] Release 0.58.4

Fixed

... (truncated)

Changelog

Sourced from jsonschema's changelog.

[0.58.5] - 2026-10-02

Fixed

• canonicalize keeping a reference to a cycle of bare references under not or oneOf instead of treating it as accepting every value.

[0.58.4] - 2026-10-01

Fixed

• Validator::draft returning the default draft instead of the one $schema declares.
• unevaluatedProperties and unevaluatedItems beside a $recursiveRef ignoring what the reference target evaluates.
• unevaluatedProperties ignoring the configured regex engine and its limits for patternProperties.
• Absolute keyword location and schemaLocation of keywords a $ref JSON Pointer reaches through a subschema with its own $id.
• type, minItems and maxItems ignored beside items when the applicator vocabulary is disabled.
• Absolute keyword location and schemaLocation of keywords inside a nested $id resource counting from the document root.
• required beside properties ignored when the applicator vocabulary is disabled, and required, minContains and maxContains applied when the validation vocabulary is disabled.
• Absolute keyword location and evaluation output of type errors in a type-only items subschema pointing at items instead of the failing element's type.
• Absolute keyword location of patternProperties annotations missing its JSON Pointer fragment.
• Evaluation output of type: array beside schema-form items omitting passing type, minItems and maxItems units and nesting failing ones under items.
• Evaluation output schemaLocation and absolute keyword location of $ref, $dynamicRef and $recursiveRef nodes not pointing at the reference target.
• Evaluation output schemaLocation URIs not percent-encoding their fragment, such as a space in a property name.
• Absolute keyword location of errors and annotations from a whole subschema, such as false, missing its JSON Pointer fragment.
• Absolute keyword location of required, minContains and maxContains errors pointing at a sibling keyword.
• Evaluation annotations from $ref siblings in Draft 4, 6 and 7 schemas.
• Masked additionalItems messages counting allowed items instead of extra ones, and "1 items" in masked unevaluatedItems messages.
• $dynamicRef and $recursiveRef resolving in the dynamic scope of another path to the same schema, depending on property order.
• unevaluatedProperties and unevaluatedItems ignoring what then or else evaluates when if is true or false.
• Stack overflow when building validators for long $ref chains.
• format: "regex" and meta-schema validation rejecting escaped punctuation such as \- in patterns.
• Build errors for an invalid patternProperties regex reporting the subschema instead of the pattern and its location.

[0.58.3] - 2026-09-30

Fixed

• Keywords of a subschema declaring a Draft 2019-09+ $schema under a Draft 4, 6 or 7 root being ignored.
• Evaluation annotations including those from subschemas of a failing schema (a failing schema produces no annotations).
• Embedded resources declaring their own $schema being checked against the root's meta-schema.

[0.58.2] - 2026-09-28

Fixed

• $dynamicRef targets in another document resolving relative references and reporting absolute keyword locations against the referencing document.
• $ref to an $anchor or fragment $id validating against another anchor in the same document. #1668
• schema_path of errors under a $ref or $dynamicRef to a named schema pointing at the resource root instead of that schema.

[0.58.1] - 2026-09-26

... (truncated)

Commits

• 21a061d chore(rust): Release 0.58.5
• 6c28049 chore: Migrate to the Ruby::gc_* API of magnus 0.9
• 4cfb109 build(deps): update magnus requirement from 0.8 to 0.9
• c0799ca docs: Update readme files
• e9d1f7a build: Pin the gem documentation link to its release tag
• a91b882 docs: Document the offline option
• baa41b6 docs: Wrap long code lines in the Python README
• f21bb64 docs: Tighten the Ruby README
• fbe8de1 docs: Tighten the Python README
• 6f9e4e7 fix: Release the GIL and GVL while retrieving external resources
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: rust. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Repository: flyingrobots/wesley/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: 40ed5af4-bf6c-4044-abea-06905634a713

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-06T12:51:36.846805Z	08f7698	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

🔍 The Case of Pull Request #844

Schema Sets

• ecommerce
• reference

Schema Set ecommerce

Plain-English Readout

• Holmes (evidence investigation): The Holmes report is unavailable because the workflow finished without a readable holmes-report.json artifact.
• Watson (independent verification): The Watson report is unavailable because the workflow finished without a readable watson-report.json artifact.
• Moriarty (trend forecast): The Moriarty forecast is unavailable because the workflow finished without a readable moriarty-report.json artifact.

Suggested next actions

1. Regenerate the HOLMES artifacts and make sure holmes-report.json is uploaded before trusting this PR summary.
2. Regenerate the WATSON artifacts and make sure watson-report.json is uploaded before trusting this PR summary.
3. Regenerate the MORIARTY artifacts and make sure moriarty-report.json is uploaded before trusting this PR summary.

🕵️ SHA-lock HOLMES full report for ecommerce (click to expand)

Report unavailable for holmes: readable holmes-report.md artifact not found.

🩺 Dr. WATSON full report for ecommerce (click to expand)

Report unavailable for watson: readable watson-report.md artifact not found.

🔮 Professor MORIARTY full report for ecommerce (click to expand)

Report unavailable for moriarty: readable moriarty-report.md artifact not found.

---

Schema Set reference

Plain-English Readout

• Holmes (evidence investigation): The Holmes report is unavailable because the workflow finished without a readable holmes-report.json artifact.
• Watson (independent verification): The Watson report is unavailable because the workflow finished without a readable watson-report.json artifact.
• Moriarty (trend forecast): The Moriarty forecast is unavailable because the workflow finished without a readable moriarty-report.json artifact.

Suggested next actions

1. Regenerate the HOLMES artifacts and make sure holmes-report.json is uploaded before trusting this PR summary.
2. Regenerate the WATSON artifacts and make sure watson-report.json is uploaded before trusting this PR summary.
3. Regenerate the MORIARTY artifacts and make sure moriarty-report.json is uploaded before trusting this PR summary.

🕵️ SHA-lock HOLMES full report for reference (click to expand)

Report unavailable for holmes: readable holmes-report.md artifact not found.

🩺 Dr. WATSON full report for reference (click to expand)

Report unavailable for watson: readable watson-report.md artifact not found.

🔮 Professor MORIARTY full report for reference (click to expand)

Report unavailable for moriarty: readable moriarty-report.md artifact not found.

---

📚 Glossary (what the Holmes terms mean)

• HOLMES: Wesley’s main evidence investigation. It decides whether the cited proof is strong enough to justify shipping this commit.
• WATSON: An independent verification pass. It checks Holmes’s citations and score math instead of trusting them blindly.
• MORIARTY: A readiness forecast over time. It is advisory trend analysis, not the release gate itself.
• Schema coverage score (SCS): How much of the schema has direct supporting evidence across generated artifacts and cited proof.
• Test confidence index (TCI): How much test evidence exists for constraints, policies, relationships, and operations.
• Migration risk index (MRI): How risky the schema change is to roll out. Lower is better.
• Evidence trust: Whether the report is backed by exact citations, whole-file citations, or coarse references. Weak trust means the claim may be directionally right but not specific enough to trust blindly.
• Citation quality: A count of exact line-span citations versus whole-file or coarse references.
• ELEMENTARY: Ready to ship based on the current evidence.
• REQUIRES INVESTIGATION: More work or review is needed before shipping.
• YOU SHALL NOT PASS: Do not ship this change in its current state.

---

Machine-readable reports are grouped by schema set in workflow artifacts.

---

Filed at 221B Repository Street