deps(deps): bump jsonschema from 0.47.0 to 0.54.0

[dependabot]

Bumps jsonschema from 0.47.0 to 0.54.0.

Release notes

Sourced from jsonschema's releases.

[Rust] Release 0.54.0

Added

• backend = SerdeJson on #[jsonschema::validator], generating a validator that reads serde_json::Value.
• PreparedDocument::unsatisfiable_pointers, listing every subschema no value satisfies.

Changed

• Canonicalization of unevaluated* beside dependentSchemas or if/then/else, which kept the document Raw.
• Canonicalization of not over patternProperties, which kept the document Raw.

Performance

• validate and iter_errors check each assertion keyword with the is_valid path and build an error only for a failing one.
• evaluate holds its output tree in one allocation instead of one per node.
• A pattern of ^\S*$ scans bytes instead of decoding every character.
• validate on properties beside a two-name required confirms both names in the pass that checks the properties, instead of looking each up first.
• A string enum compares an option's length and first and last eight bytes before its full text.
• A JSON Pointer segment is scanned for ~ and / eight bytes at a time before it is copied.
• Canonicalization cloning leaves per intersection and the definition map per settled target.

Fixed

• type: array with items and minItems/maxItems checking the built-in length bound even when a custom keyword overrides minItems or maxItems, so the bound was evaluated twice.
• A custom keyword overriding type, required or maxLength not replacing the built-in check for that keyword.
• A custom keyword overriding items, minLength, properties or additionalProperties leaving its sibling keywords unchecked.
• #[jsonschema::validator] generated code that named serde_json directly, so it needed the consumer crate to depend on serde_json too.
• Canonicalization of not over an object with properties, patternProperties and additionalProperties, which applied additionalProperties to the keys listed in properties.

[Python] Release 0.54.0

Performance

• validate and iter_errors check each assertion keyword with the is_valid path and build an error only for a failing one.
• evaluate holds its output tree in one allocation instead of one per node.
• A pattern of ^\S*$ scans bytes instead of decoding every character.
• validate on properties beside a two-name required confirms both names in the pass that checks the properties, instead of looking each up first.
• A string enum compares an option's length and first and last eight bytes before its full text.
• A JSON Pointer segment is scanned for ~ and / eight bytes at a time before it is copied.
• Faster validating objects against object-heavy schemas.
• Canonicalization cloning leaves per intersection and the definition map per settled target.

Changed

• Canonicalization of unevaluated* beside dependentSchemas or if/then/else, which kept the document Raw.
• Canonicalization of not over patternProperties, which kept the document Raw.

Fixed

• Canonicalization of not over an object with properties, patternProperties and additionalProperties, which applied additionalProperties to the keys listed in properties.

... (truncated)

Changelog

Sourced from jsonschema's changelog.

[0.54.0] - 2026-09-06

Added

• backend = SerdeJson on #[jsonschema::validator], generating a validator that reads serde_json::Value.
• PreparedDocument::unsatisfiable_pointers, listing every subschema no value satisfies.

Changed

• Canonicalization of unevaluated* beside dependentSchemas or if/then/else, which kept the document Raw.
• Canonicalization of not over patternProperties, which kept the document Raw.

Performance

• validate and iter_errors check each assertion keyword with the is_valid path and build an error only for a failing one.
• evaluate holds its output tree in one allocation instead of one per node.
• A pattern of ^\S*$ scans bytes instead of decoding every character.
• validate on properties beside a two-name required confirms both names in the pass that checks the properties, instead of looking each up first.
• A string enum compares an option's length and first and last eight bytes before its full text.
• A JSON Pointer segment is scanned for ~ and / eight bytes at a time before it is copied.
• Canonicalization cloning leaves per intersection and the definition map per settled target.

Fixed

• type: array with items and minItems/maxItems checking the built-in length bound even when a custom keyword overrides minItems or maxItems, so the bound was evaluated twice.
• A custom keyword overriding type, required or maxLength not replacing the built-in check for that keyword.
• A custom keyword overriding items, minLength, properties or additionalProperties leaving its sibling keywords unchecked.
• #[jsonschema::validator] generated code that named serde_json directly, so it needed the consumer crate to depend on serde_json too.
• Canonicalization of not over an object with properties, patternProperties and additionalProperties, which applied additionalProperties to the keys listed in properties.

[0.53.0] - 2026-09-02

Added

• Location::segments, iterating the segments without collecting them.
• CanonicalizeOptions::prepare, canonicalizing any number of a document's subschemas by JSON Pointer, with the document indexed once.
• CLI: the --at POINTER flag of jsonschema canonicalize, canonicalizing only the subschema at that pointer without breaking its references into the rest of the document.
• CLI: jsonschema canonicalize reads YAML schemas (.yaml/.yml) as well as JSON.
• canonical::{ArrayView, IntegerView, NumberView, ObjectView, StringView, TypedGroupView}, the payload types of CanonicalView, so consumers can name them in signatures.

Fixed

• jsonschema-value failing to build with default-features = false.
• jsonschema-value failing to build for wasm32-unknown-unknown, which needs getrandom's wasm_js backend.
• Draft 4 type: integer accepting numbers written with an exponent, like 1e2.
• Draft 4 type: integer answering differently for the same number across representations.
• uniqueItems accepting 0 alongside -0.0 in arrays of more than 15 items.

Performance

... (truncated)

Commits

• e9d4660 chore(ruby): Release 0.54.0
• 9be6d4f chore(python): Release 0.54.0
• e369b9b chore(rust): Release 0.54.0
• ccf641b perf: Misc performance improvements
• 14f043c perf: validate and iter_errors check each assertion keyword with the `is_...
• 6905807 fix: Custom keywords overriding built-in ones
• 8295d5d fix: Fused array shape checking the length bound when a custom keyword overri...
• 269adb1 perf: evaluate holds its output tree in one allocation instead of one per node
• e8fbd47 perf: A pattern of ^\S*$ scans bytes instead of decoding every character
• 8c0827e fix: #[jsonschema::validator] generated code that named serde_json direct...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: rust. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[github-actions]

🔍 The Case of Pull Request #797

Schema Sets

• ecommerce
• reference

Schema Set ecommerce

Plain-English Readout

• Holmes (evidence investigation): The Holmes report is unavailable because the workflow finished without a readable holmes-report.json artifact.
• Watson (independent verification): The Watson report is unavailable because the workflow finished without a readable watson-report.json artifact.
• Moriarty (trend forecast): The Moriarty forecast is unavailable because the workflow finished without a readable moriarty-report.json artifact.

Suggested next actions

1. Regenerate the HOLMES artifacts and make sure holmes-report.json is uploaded before trusting this PR summary.
2. Regenerate the WATSON artifacts and make sure watson-report.json is uploaded before trusting this PR summary.
3. Regenerate the MORIARTY artifacts and make sure moriarty-report.json is uploaded before trusting this PR summary.

🕵️ SHA-lock HOLMES full report for ecommerce (click to expand)

Report unavailable for holmes: readable holmes-report.md artifact not found.

🩺 Dr. WATSON full report for ecommerce (click to expand)

Report unavailable for watson: readable watson-report.md artifact not found.

🔮 Professor MORIARTY full report for ecommerce (click to expand)

Report unavailable for moriarty: readable moriarty-report.md artifact not found.

---

Schema Set reference

Plain-English Readout

• Holmes (evidence investigation): The Holmes report is unavailable because the workflow finished without a readable holmes-report.json artifact.
• Watson (independent verification): The Watson report is unavailable because the workflow finished without a readable watson-report.json artifact.
• Moriarty (trend forecast): The Moriarty forecast is unavailable because the workflow finished without a readable moriarty-report.json artifact.

Suggested next actions

1. Regenerate the HOLMES artifacts and make sure holmes-report.json is uploaded before trusting this PR summary.
2. Regenerate the WATSON artifacts and make sure watson-report.json is uploaded before trusting this PR summary.
3. Regenerate the MORIARTY artifacts and make sure moriarty-report.json is uploaded before trusting this PR summary.

🕵️ SHA-lock HOLMES full report for reference (click to expand)

Report unavailable for holmes: readable holmes-report.md artifact not found.

🩺 Dr. WATSON full report for reference (click to expand)

Report unavailable for watson: readable watson-report.md artifact not found.

🔮 Professor MORIARTY full report for reference (click to expand)

Report unavailable for moriarty: readable moriarty-report.md artifact not found.

---

📚 Glossary (what the Holmes terms mean)

• HOLMES: Wesley’s main evidence investigation. It decides whether the cited proof is strong enough to justify shipping this commit.
• WATSON: An independent verification pass. It checks Holmes’s citations and score math instead of trusting them blindly.
• MORIARTY: A readiness forecast over time. It is advisory trend analysis, not the release gate itself.
• Schema coverage score (SCS): How much of the schema has direct supporting evidence across generated artifacts and cited proof.
• Test confidence index (TCI): How much test evidence exists for constraints, policies, relationships, and operations.
• Migration risk index (MRI): How risky the schema change is to roll out. Lower is better.
• Evidence trust: Whether the report is backed by exact citations, whole-file citations, or coarse references. Weak trust means the claim may be directionally right but not specific enough to trust blindly.
• Citation quality: A count of exact line-span citations versus whole-file or coarse references.
• ELEMENTARY: Ready to ship based on the current evidence.
• REQUIRES INVESTIGATION: More work or review is needed before shipping.
• YOU SHALL NOT PASS: Do not ship this change in its current state.

---

Machine-readable reports are grouped by schema set in workflow artifacts.

---

Filed at 221B Repository Street