deps(deps): bump jsonschema from 0.47.0 to 0.49.4

[dependabot]

Bumps jsonschema from 0.47.0 to 0.49.4.

Release notes

Sourced from jsonschema's releases.

[Python] Release 0.49.4

Added

• Canonicalization of not a string format, which the string leaf carries as barred formats.
• Canonicalization of not an existential demand, which an array fails exactly when no element matches.
• Canonicalization of not a string value set, which the string leaf carries as excluded values.
• Canonicalization of unevaluatedItems beside contains, where the elements it matches are evaluated and the tail admits either.
• Canonicalization of unevaluated* beside anyOf or oneOf, where every branch evaluating the same keys or indexes pins what is left over.
• Canonicalization of not an array element schema, which an array fails exactly when one element violates it.
• CanonicalSchema.intersect, the values both schemas admit.
• CanonicalSchema.negate, the values a schema rejects.
• CanonicalSchema.definition, one reference target by URI.

Fixed

• An integer past i64 admitted by a fractional bound f64 rounds it onto, such as -10000000000000000000000000 under {"maximum": -10000000000000000000000000.1}.
• An integer past 2^53 admitted by a bound f64 rounds onto it, such as 9007199254740992 under {"minimum": 9007199254740993}.
• A contains subschema beside both minContains and maxContains overwriting a sibling keyword of the same name, such as items.

Performance

• CanonicalSchema hashing and equality cost the node instead of the whole document.

[Ruby] Release 0.49.4

[0.49.4] - 2026-08-04

Added

• Canonicalization of not a string format, which the string leaf carries as barred formats.
• Canonicalization of not an existential demand, which an array fails exactly when no element matches.
• Canonicalization of not a string value set, which the string leaf carries as excluded values.
• Canonicalization of unevaluatedItems beside contains, where the elements it matches are evaluated and the tail admits either.
• Canonicalization of unevaluated* beside anyOf or oneOf, where every branch evaluating the same keys or indexes pins what is left over.
• Canonicalization of not an array element schema, which an array fails exactly when one element violates it.
• CanonicalSchema#intersect, the values both schemas admit.
• CanonicalSchema#negate, the values a schema rejects.
• CanonicalSchema#definition, one reference target by URI.

Fixed

• An integer past i64 admitted by a fractional bound f64 rounds it onto, such as -10000000000000000000000000 under {"maximum": -10000000000000000000000000.1}.
• An integer past 2^53 admitted by a bound f64 rounds onto it, such as 9007199254740992 under {"minimum": 9007199254740993}.
• A contains subschema beside both minContains and maxContains overwriting a sibling keyword of the same name, such as items.

Performance

• CanonicalSchema hashing and equality cost the node instead of the whole document.

[Rust] Release 0.49.4

Added

... (truncated)

Changelog

Sourced from jsonschema's changelog.

[0.49.4] - 2026-08-04

Added

• Canonicalization of not a string format, which the string leaf carries as barred formats.
• Canonicalization of not an existential demand, which an array fails exactly when no element matches.
• Canonicalization of not a string value set, which the string leaf carries as excluded values.
• Canonicalization of unevaluatedItems beside contains, where the elements it matches are evaluated and the tail admits either.
• Canonicalization of unevaluated* beside anyOf or oneOf, where every branch evaluating the same keys or indexes pins what is left over.
• Canonicalization of not an array element schema, which an array fails exactly when one element violates it.
• CanonicalSchema::intersect, the values both schemas admit.
• CanonicalSchema::negate, the values a schema rejects.
• CanonicalSchema::definition, one reference target by URI.

Fixed

• An integer past i64 admitted by a fractional bound f64 rounds it onto, such as -10000000000000000000000000 under {"maximum": -10000000000000000000000000.1}.
• An integer past 2^53 admitted by a bound f64 rounds onto it, such as 9007199254740992 under {"minimum": 9007199254740993}.
• A contains subschema beside both minContains and maxContains overwriting a sibling keyword of the same name, such as items.

Performance

• CanonicalSchema hashing and equality cost the node instead of the whole document.

[0.49.3] - 2026-08-02

Added

• Canonicalization of a recursive schema with no finite witness, which now folds to false.
• Canonicalization of $dynamicRef and $recursiveRef, which resolve through the dynamic scope and stay symbolic like any other reference. A dangling $dynamicRef errors rather than staying Raw.
• Canonicalization of minContains under uniqueItems, where a demand asking for more matches than its own schema has distinct values now folds to false.
• Canonicalization of a Draft 4 patternProperties coverage closed by additionalProperties: false, spelled as the closed map it was parsed from.
• Canonicalization of a oneOf whose branches repeat, where a repeated branch can never contribute exactly one match.
• Canonicalization of a $ref whose target is an empty schema, which now folds to false.
• Canonicalization of unevaluatedItems beside allOf, where every branch must pass and so the indexes they evaluate are known without the instance.
• Canonicalization of unevaluatedProperties beside allOf, where every branch must pass and so what they evaluate is known without the instance.
• Canonicalization of a Draft 4 type list holding integer beside other types with enum, which previously modeled only when spelled as an allOf.
• Canonicalization of patternProperties patterns matching finitely many keys, such as ^a$ and ^(a|b)$.
• Canonicalization of unevaluatedProperties and unevaluatedItems when no in-place applicator sits beside them.

Fixed

• additionalItems values that are not schemas silently ignored beside an array-form items (they should fail the build like additionalProperties).
• additionalItems beside a boolean items rejecting every instance, such as {"additionalItems": false, "items": false}.
• additionalItems beside a non-array items value failing schema compilation with an error blaming additionalItems (the keyword should be ignored).
• Draft 4 rejecting a size bound at or past 2^64, such as {"maxItems": 18446744073709551616}.
• An integer past the f64 range admitted by a fractional bound it exceeds, such as 1e400 under {"exclusiveMaximum": 0.1}.
• A $ref at the root of an $id-bearing subresource dropped as a self-reference when its pointer matched the one that reached that subresource.
• Canonicalization reusing one definition's body for a same-named definition in another resource, when the name spells a canonical URI.
• unevaluatedItems counting prefixItems as evaluating elements before Draft 2020-12, where it is not a keyword.

... (truncated)

Commits

• 89db44b chore(ruby): Release 0.49.4
• 6e2bc14 chore(python): Release 0.49.4
• 796a27e chore(rust): Release 0.49.4
• a35cc7e feat: Canonicalization of not a string format, which the string leaf carrie...
• b1d7f1a chore: Misc canonicalization improvements
• c8f7cc7 fix: An integer past 2^53 admitted by a bound f64 rounds onto it
• bc47249 perf: Cache intersections
• 5dd6483 feat: Canonicalization of not an existential demand, which an array fails e...
• 433adcd feat: Canonicalization of not a string value set, which the string leaf car...
• 4f0e406 test: Add fuzzing for canonicalization
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: rust. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[github-actions]

🔍 The Case of Pull Request #778

Schema Sets

• ecommerce
• reference

Schema Set ecommerce

Plain-English Readout

• Holmes (evidence investigation): The Holmes report is unavailable because the workflow finished without a readable holmes-report.json artifact.
• Watson (independent verification): The Watson report is unavailable because the workflow finished without a readable watson-report.json artifact.
• Moriarty (trend forecast): The Moriarty forecast is unavailable because the workflow finished without a readable moriarty-report.json artifact.

Suggested next actions

1. Regenerate the HOLMES artifacts and make sure holmes-report.json is uploaded before trusting this PR summary.
2. Regenerate the WATSON artifacts and make sure watson-report.json is uploaded before trusting this PR summary.
3. Regenerate the MORIARTY artifacts and make sure moriarty-report.json is uploaded before trusting this PR summary.

🕵️ SHA-lock HOLMES full report for ecommerce (click to expand)

Report unavailable for holmes: readable holmes-report.md artifact not found.

🩺 Dr. WATSON full report for ecommerce (click to expand)

Report unavailable for watson: readable watson-report.md artifact not found.

🔮 Professor MORIARTY full report for ecommerce (click to expand)

Report unavailable for moriarty: readable moriarty-report.md artifact not found.

---

Schema Set reference

Plain-English Readout

• Holmes (evidence investigation): The Holmes report is unavailable because the workflow finished without a readable holmes-report.json artifact.
• Watson (independent verification): The Watson report is unavailable because the workflow finished without a readable watson-report.json artifact.
• Moriarty (trend forecast): The Moriarty forecast is unavailable because the workflow finished without a readable moriarty-report.json artifact.

Suggested next actions

1. Regenerate the HOLMES artifacts and make sure holmes-report.json is uploaded before trusting this PR summary.
2. Regenerate the WATSON artifacts and make sure watson-report.json is uploaded before trusting this PR summary.
3. Regenerate the MORIARTY artifacts and make sure moriarty-report.json is uploaded before trusting this PR summary.

🕵️ SHA-lock HOLMES full report for reference (click to expand)

Report unavailable for holmes: readable holmes-report.md artifact not found.

🩺 Dr. WATSON full report for reference (click to expand)

Report unavailable for watson: readable watson-report.md artifact not found.

🔮 Professor MORIARTY full report for reference (click to expand)

Report unavailable for moriarty: readable moriarty-report.md artifact not found.

---

📚 Glossary (what the Holmes terms mean)

• HOLMES: Wesley’s main evidence investigation. It decides whether the cited proof is strong enough to justify shipping this commit.
• WATSON: An independent verification pass. It checks Holmes’s citations and score math instead of trusting them blindly.
• MORIARTY: A readiness forecast over time. It is advisory trend analysis, not the release gate itself.
• Schema coverage score (SCS): How much of the schema has direct supporting evidence across generated artifacts and cited proof.
• Test confidence index (TCI): How much test evidence exists for constraints, policies, relationships, and operations.
• Migration risk index (MRI): How risky the schema change is to roll out. Lower is better.
• Evidence trust: Whether the report is backed by exact citations, whole-file citations, or coarse references. Weak trust means the claim may be directionally right but not specific enough to trust blindly.
• Citation quality: A count of exact line-span citations versus whole-file or coarse references.
• ELEMENTARY: Ready to ship based on the current evidence.
• REQUIRES INVESTIGATION: More work or review is needed before shipping.
• YOU SHALL NOT PASS: Do not ship this change in its current state.

---

Machine-readable reports are grouped by schema set in workflow artifacts.

---

Filed at 221B Repository Street

[dependabot]

Superseded by #780.