This release majorly rehauls the way in which JSON Schema reference resolution is configured.
It does so in a way that should be backwards compatible, preserving old behavior whilst emitting deprecation warnings.
jsonschema.RefResolver is now deprecated in favor of the new referencing library.
referencing will begin in beta, but already is more compliant than the existing $ref support.
This change is a culmination of a meaningful chunk of work to make $ref resolution more flexible and more correct.
Backwards compatibility should be preserved for existing code which uses RefResolver, though doing so is again now deprecated, and all such use cases should be doable using the new APIs.
Please file issues on the referencing tracker if there is functionality missing from it, or here on the jsonschema issue tracker if you have issues with existing code not functioning the same, or with figuring out how to change it to use referencing.
In particular, this referencing change includes a change concerning automatic retrieval of remote references (retrieving http://foo/bar automatically within a schema).
This behavior has always been a potential security risk and counter to the recommendations of the JSON Schema specifications; it has survived this long essentially only for backwards compatibility reasons, and now explicitly produces warnings.
The referencing library itself will not automatically retrieve references if you interact directly with it, so the deprecated behavior is only triggered if you fully rely on the default $ref resolution behavior and also include remote references in your schema, which will still be retrieved during the deprecation period (after which they will become an error).
Support for Python 3.7 has been dropped, as it is nearing end-of-life.
This should not be a "visible" change in the sense that requires-python has been updated, so users using 3.7 should still receive v4.17.3 when installing the library.
On draft 2019-09, unevaluatedItems now properly does not consider items to be evaluated by an additionalItems schema if items is missing from the schema, as the specification says in this case that additionalItems must be completely ignored.
Fix the date format checker on Python 3.11 (when format assertion behavior is enabled), where it was too liberal (#1076).
Speed up validation of unevaluatedProperties (#1075).
Deprecations
jsonschema.RefResolver -- see above for details on the replacement
jsonschema.RefResolutionError -- see above for details on the replacement
relying on automatic resolution of remote references -- see above for details on the replacement
importing jsonschema.ErrorTree -- instead import it via jsonschema.exceptions.ErrorTree
importing jsonschema.FormatError -- instead import it via jsonschema.exceptions.FormatError
This release majorly rehauls the way in which JSON Schema reference resolution is configured.
It does so in a way that should be backwards compatible, preserving old behavior whilst emitting deprecation warnings.
jsonschema.RefResolver is now deprecated in favor of the new referencing library <https://github.com/python-jsonschema/referencing/>_.
referencing will begin in beta, but already is more compliant than the existing $ref support.
This change is a culmination of a meaningful chunk of work to make $ref resolution more flexible and more correct.
Backwards compatibility should be preserved for existing code which uses RefResolver, though doing so is again now deprecated, and all such use cases should be doable using the new APIs.
Please file issues on the referencing tracker if there is functionality missing from it, or here on the jsonschema issue tracker if you have issues with existing code not functioning the same, or with figuring out how to change it to use referencing.
In particular, this referencing change includes a change concerning automatic retrieval of remote references (retrieving http://foo/bar automatically within a schema).
This behavior has always been a potential security risk and counter to the recommendations of the JSON Schema specifications; it has survived this long essentially only for backwards compatibility reasons, and now explicitly produces warnings.
The referencing library itself will not automatically retrieve references if you interact directly with it, so the deprecated behavior is only triggered if you fully rely on the default $ref resolution behavior and also include remote references in your schema, which will still be retrieved during the deprecation period (after which they will become an error).
Support for Python 3.7 has been dropped, as it is nearing end-of-life.
This should not be a "visible" change in the sense that requires-python has been updated, so users using 3.7 should still receive v4.17.3 when installing the library.
On draft 2019-09, unevaluatedItems now properly does not consider items to be evaluated by an additionalItems schema if items is missing from the schema, as the specification says in this case that additionalItems must be completely ignored.
Fix the date format checker on Python 3.11 (when format assertion behavior is enabled), where it was too liberal (#1076).
Speed up validation of unevaluatedProperties (#1075).
Deprecations
jsonschema.RefResolver -- see above for details on the replacement
jsonschema.RefResolutionError -- see above for details on the replacement
relying on automatic resolution of remote references -- see above for details on the replacement
importing jsonschema.ErrorTree -- instead import it via jsonschema.exceptions.ErrorTree
importing jsonschema.FormatError -- instead import it via jsonschema.exceptions.FormatError
Commits
1fe3f9f Merge pull request #1111 from python-jsonschema/pre-commit-ci-update-config
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
dependabot[bot]
commented
1 year ago
Bumps jsonschema from 4.17.3 to 4.18.0.
Release notes
Sourced from jsonschema's releases.
... (truncated)
Changelog
Sourced from jsonschema's changelog.
Commits
1fe3f9fMerge pull request #1111 from python-jsonschema/pre-commit-ci-update-confige2998b7[pre-commit.ci] pre-commit autoupdate32fe8b1Merge pull request #1109 from python-jsonschema/pre-commit-ci-update-configea26319[pre-commit.ci] pre-commit autoupdateeb8255aMerge pull request #1104 from python-jsonschema/pre-commit-ci-update-config743fe39[pre-commit.ci] pre-commit autoupdated35f2c2Only use a default (remote retrieving registry) when none is provided.685578aMassage coverage numbers again.1240e68Don't uselessly recombine registries each time we recurse into subschemas.b62bcfbAdd Unlicense to the allowed non-GPL license audit list.Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)