ci(rust): bump jaq-core from 2.2.1 to 3.1.1

[dependabot]

Bumps jaq-core from 2.2.1 to 3.1.1.

Release notes

Sourced from jaq-core's releases.

3.1.1

This release features a new man page that is now generated by jaq itself. Apart from demonstrating jaq's XHTML processing capabilities, this serves to lift jaq's build dependency on Pandoc (01mf02/jaq#442). To quote@​alerque, jaq's Arch Linux package maintainer: "For any other project I'd say this was an absurd way to work around not wanting to use a standard tool. I guess for this project to dog food itself is ... chaotic genius?" This comment alone was nearly worth the endeavour.

Furthermore, this release makes it possible to disable a few dependencies when using jaq via its API (#448, thanks to @​kleinesfilmroellchen!), and handles broken pipes more gracefully 01mf02/jaq#445.

New Contributors

• @​kleinesfilmroellchen made their first contribution in 01mf02/jaq#448

Full Changelog: 01mf02/jaq@v3.1.0...v3.1.1

3.1

This release adds support for jq's input_filename filter --- thanks to @​a-n-d-r-e-w-l01mf02/jaq#432! Furthermore, at places where jaq accepted filters like .a["b"], it now also accepts (equivalent) filters such as .a.["b"] (note the added dot after .a). 01mf02/jaq#423 Finally, this release corrects the indexing of arrays with an empty array, which previously panicked 01mf02/jaq#439. Thanks to @​leeewee for spotting this!

API

The biggest change in this release is that calls to halt in jq filters can now be handled by users of the jaq API, instead of forcing a termination of the process. Thanks to @​a-n-d-r-e-w-l01mf02/jaq#433! This has a few implications:

• The signature of jaq_all::data::run had to be changed, resulting in a new major version of jaq-all.
• To preserve semantic versioning stability guarantees, the jaq_core::unwrap_valr function still terminates the current process if halt is called, but only if the std feature is enabled --- otherwise, unwrap_valr panics! You need to take action to prevent panics if all of the following conditions hold:
  1. you use jaq_core::unwrap_valr,
  2. you have disabled the std feature in jaq_core, and
  3. you run filters that may call halt.

Furthermore, this version makes it possible to clone definitions, which can speed up compiling many different jq filters. 01mf02/jaq#430

Full Changelog: 01mf02/jaq@v3.0.0...v3.1.0

3.0

jaq is a jq clone with focus on correctness, speed, and simplicity.

The most outstanding change in jaq 3.0 is its multi-format support, allowing you to read and write several data formats such as YAML, CBOR, TOML, XML, CSV, TSV, and of course JSON. That means that among others, jaq can convert data from one format into another, while transforming data with a jq filter. This effectively makes it into a "Pandoc for structured data". Achieving this has been the main focus of the NLnet-founded "Polyglot jaq" project, which has been successfully finished. A huge thanks to NLnet for supporting jaq and, more generally, free software!

Other large user-facing changes include:

• Manual: jaq now has a full jq and jaq reference manual. This was a monumental effort into which I poured a lot of love, and I hope that you enjoy reading it as much as I enjoyed putting easter eggs into it. Bonus: You also get a man page. (For package maintainers: Man page build instructions can be found in docs/README.md.)
• Byte strings: You can now read strings that contain arbitrary contents, including invalid UTF-8 sequences. (When a string is read from a file, this takes only constant time, thanks to memory mapping.) You can then mark these strings as byte strings via tobytes, allowing you to index/slice them in constant time. This allows you to process arbitrary binary data efficiently with jaq --- as proof of concept, I implemented a little TAR decoder.
• Arbitrary values as object keys: Where jq supports only strings as object keys, jaq supports arbitrary values as object keys.
• Compatibility improvements: Although this release adds many new features to jaq that do not exist in jq, this release still increases compatibility with jq. For example, jaq now supports path/1 and many other path-related filters.

API:

• New jaq-all crate for easier "batteries-included" jaq usage
• Passing arbitrary data to native filters
• Optional thread-safe jaq_json::Val when enabling the sync feature, allowing for multithreaded usage of values, e.g. running multiple filters in parallel on the same value

... (truncated)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[opieter-aws]

@strandly-the-agent review this major version upgrade. Do we need or want this? Clearly it beaks CI.

[strandly-the-agent]

Verdict: close this PR — it can never go green, and Dependabot can't fix it. Recommend @dependabot ignore this major version (reopenable later).

Answering your questions directly:

• Need it? No. cargo audit is clean on jaq 2.2.1 (the Security-audit leg passes), and jaq 3's headline safety win — halt no longer killing the host process — is already covered by our sandbox stubs in src/commands/jq.rs:44.
• Why CI breaks: the PR bumps only jaq-core → 3.1.1, but jaq-std 2.1.2 and jaq-json 1.1.3 still pin jaq-core ^2, so both 2.2.1 and 3.1.1 end up in the graph and jq.rs fails with 15 type-mismatch errors (reproduced locally). Same dead end as #15/#4, which this superseded — this will recur every jaq-core release until we ignore the major or migrate.
• Want it? Mildly, eventually — upstream focus is 3.x and it brings jq-compat fixes. I tested the real path: a coordinated jaq-core 3 + jaq-std 3 + jaq-json 2 bump resolves cleanly but leaves ~22 compile errors, all confined to src/commands/jq.rs (258 lines). A small manual migration PR — happy to open it if you want jaq 3; otherwise ignoring the major costs us nothing today.

Evidence & migration details

Verification ledger

• ✅ Reviewed head d7b6d59 vs base 6fecd79; diff is Cargo.toml (jaq-core = "2" → "3") + Cargo.lock only.
• ✅ Lockfile on this PR contains bothjaq-core 2.2.1 (via jaq-std/jaq-json) and jaq-core 3.1.1 (via strands-shell) — the dual-version graph is visible in the Cargo.lock diff.
• ✅ cargo check --workspace on the PR head: 15 errors, e.g. rustc: "there are multiple different versions of crate jaq_core in the dependency graph" (expected jaq_core 2.2.1::Native<Val>, found 3.1.1::Native<Val> at jq.rs:74).
• ✅ cargo check with the coordinated bump (jaq-core = "3", jaq-std = "3", jaq-json = "2"): resolves and builds deps fine, 22 errors, all in src/commands/jq.rs — no other file in the workspace touches jaq.
• ✅ crates.io index: the coherent jaq-3 stack is jaq-core 3.1.1 + jaq-std 3.0.3 + jaq-json 2.0.3.
• ⚠️ Unchecked: whether the jaq#439 empty-array-indexing panic (fixed in 3.1) is reachable through our jq builtin on 2.2.1 — my repro build hit a sandbox disk limit. If it is reachable, it's a user-triggerable panic and would strengthen the "want" case.

What the migration actually involves (from the 22 errors)

• jaq_core::Native<V> → Native<D: DataT> (use JustLut<Val>); the halt_error/env stub plumbing and Compiler generics change accordingly.
• jaq_json::Val: From<serde_json::Value> is gone in jaq-json 2 — the serde interop moved (feature renamed serde_json → serde, now via serde_core), so input/output conversion needs rewriting.
• filter.run(...) moved (compile::Filter now wraps it; roughly filter.id.run(lut, ...)).
• All confined to run_filter() in src/commands/jq.rs; existing jq integration tests in tests/shell_integration.rs cover the behavior, so regressions would surface.

Config note (why this keeps happening)

dependabot.yml deliberately leaves majors ungrouped for attribution, which is right in general — but lockstep crate families like jaq-* can never pass CI solo. A cargo groups entry matching jaq-* for major updates would at least produce one coherent candidate PR; it still can't write the jq.rs code changes, so the manual migration PR remains the actual path either way.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

[dependabot]

Bumps jaq-core from 2.2.1 to 3.1.1.

Release notes

Sourced from jaq-core's releases.

3.1.1

This release features a new man page that is now generated by jaq itself. Apart from demonstrating jaq's XHTML processing capabilities, this serves to lift jaq's build dependency on Pandoc (01mf02/jaq#442). To quote@​alerque, jaq's Arch Linux package maintainer: "For any other project I'd say this was an absurd way to work around not wanting to use a standard tool. I guess for this project to dog food itself is ... chaotic genius?" This comment alone was nearly worth the endeavour.

Furthermore, this release makes it possible to disable a few dependencies when using jaq via its API (#448, thanks to @​kleinesfilmroellchen!), and handles broken pipes more gracefully 01mf02/jaq#445.

New Contributors

• @​kleinesfilmroellchen made their first contribution in 01mf02/jaq#448

Full Changelog: 01mf02/jaq@v3.1.0...v3.1.1

3.1

This release adds support for jq's input_filename filter --- thanks to @​a-n-d-r-e-w-l01mf02/jaq#432! Furthermore, at places where jaq accepted filters like .a["b"], it now also accepts (equivalent) filters such as .a.["b"] (note the added dot after .a). 01mf02/jaq#423 Finally, this release corrects the indexing of arrays with an empty array, which previously panicked 01mf02/jaq#439. Thanks to @​leeewee for spotting this!

API

The biggest change in this release is that calls to halt in jq filters can now be handled by users of the jaq API, instead of forcing a termination of the process. Thanks to @​a-n-d-r-e-w-l01mf02/jaq#433! This has a few implications:

• The signature of jaq_all::data::run had to be changed, resulting in a new major version of jaq-all.
• To preserve semantic versioning stability guarantees, the jaq_core::unwrap_valr function still terminates the current process if halt is called, but only if the std feature is enabled --- otherwise, unwrap_valr panics! You need to take action to prevent panics if all of the following conditions hold:
  1. you use jaq_core::unwrap_valr,
  2. you have disabled the std feature in jaq_core, and
  3. you run filters that may call halt.

Furthermore, this version makes it possible to clone definitions, which can speed up compiling many different jq filters. 01mf02/jaq#430

Full Changelog: 01mf02/jaq@v3.0.0...v3.1.0

3.0

jaq is a jq clone with focus on correctness, speed, and simplicity.

The most outstanding change in jaq 3.0 is its multi-format support, allowing you to read and write several data formats such as YAML, CBOR, TOML, XML, CSV, TSV, and of course JSON. That means that among others, jaq can convert data from one format into another, while transforming data with a jq filter. This effectively makes it into a "Pandoc for structured data". Achieving this has been the main focus of the NLnet-founded "Polyglot jaq" project, which has been successfully finished. A huge thanks to NLnet for supporting jaq and, more generally, free software!

Other large user-facing changes include:

• Manual: jaq now has a full jq and jaq reference manual. This was a monumental effort into which I poured a lot of love, and I hope that you enjoy reading it as much as I enjoyed putting easter eggs into it. Bonus: You also get a man page. (For package maintainers: Man page build instructions can be found in docs/README.md.)
• Byte strings: You can now read strings that contain arbitrary contents, including invalid UTF-8 sequences. (When a string is read from a file, this takes only constant time, thanks to memory mapping.) You can then mark these strings as byte strings via tobytes, allowing you to index/slice them in constant time. This allows you to process arbitrary binary data efficiently with jaq --- as proof of concept, I implemented a little TAR decoder.
• Arbitrary values as object keys: Where jq supports only strings as object keys, jaq supports arbitrary values as object keys.
• Compatibility improvements: Although this release adds many new features to jaq that do not exist in jq, this release still increases compatibility with jq. For example, jaq now supports path/1 and many other path-related filters.

API:

• New jaq-all crate for easier "batteries-included" jaq usage
• Passing arbitrary data to native filters
• Optional thread-safe jaq_json::Val when enabling the sync feature, allowing for multithreaded usage of values, e.g. running multiple filters in parallel on the same value

... (truncated)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[opieter-aws]

@strandly-the-agent review this major version upgrade. Do we need or want this? Clearly it beaks CI.

[strandly-the-agent]

Verdict: close this PR — it can never go green, and Dependabot can't fix it. Recommend @dependabot ignore this major version (reopenable later).

Answering your questions directly:

• Need it? No. cargo audit is clean on jaq 2.2.1 (the Security-audit leg passes), and jaq 3's headline safety win — halt no longer killing the host process — is already covered by our sandbox stubs in src/commands/jq.rs:44.
• Why CI breaks: the PR bumps only jaq-core → 3.1.1, but jaq-std 2.1.2 and jaq-json 1.1.3 still pin jaq-core ^2, so both 2.2.1 and 3.1.1 end up in the graph and jq.rs fails with 15 type-mismatch errors (reproduced locally). Same dead end as #15/#4, which this superseded — this will recur every jaq-core release until we ignore the major or migrate.
• Want it? Mildly, eventually — upstream focus is 3.x and it brings jq-compat fixes. I tested the real path: a coordinated jaq-core 3 + jaq-std 3 + jaq-json 2 bump resolves cleanly but leaves ~22 compile errors, all confined to src/commands/jq.rs (258 lines). A small manual migration PR — happy to open it if you want jaq 3; otherwise ignoring the major costs us nothing today.

Evidence & migration details

Verification ledger

• ✅ Reviewed head d7b6d59 vs base 6fecd79; diff is Cargo.toml (jaq-core = "2" → "3") + Cargo.lock only.
• ✅ Lockfile on this PR contains bothjaq-core 2.2.1 (via jaq-std/jaq-json) and jaq-core 3.1.1 (via strands-shell) — the dual-version graph is visible in the Cargo.lock diff.
• ✅ cargo check --workspace on the PR head: 15 errors, e.g. rustc: "there are multiple different versions of crate jaq_core in the dependency graph" (expected jaq_core 2.2.1::Native<Val>, found 3.1.1::Native<Val> at jq.rs:74).
• ✅ cargo check with the coordinated bump (jaq-core = "3", jaq-std = "3", jaq-json = "2"): resolves and builds deps fine, 22 errors, all in src/commands/jq.rs — no other file in the workspace touches jaq.
• ✅ crates.io index: the coherent jaq-3 stack is jaq-core 3.1.1 + jaq-std 3.0.3 + jaq-json 2.0.3.
• ⚠️ Unchecked: whether the jaq#439 empty-array-indexing panic (fixed in 3.1) is reachable through our jq builtin on 2.2.1 — my repro build hit a sandbox disk limit. If it is reachable, it's a user-triggerable panic and would strengthen the "want" case.

What the migration actually involves (from the 22 errors)

• jaq_core::Native<V> → Native<D: DataT> (use JustLut<Val>); the halt_error/env stub plumbing and Compiler generics change accordingly.
• jaq_json::Val: From<serde_json::Value> is gone in jaq-json 2 — the serde interop moved (feature renamed serde_json → serde, now via serde_core), so input/output conversion needs rewriting.
• filter.run(...) moved (compile::Filter now wraps it; roughly filter.id.run(lut, ...)).
• All confined to run_filter() in src/commands/jq.rs; existing jq integration tests in tests/shell_integration.rs cover the behavior, so regressions would surface.

Config note (why this keeps happening)

dependabot.yml deliberately leaves majors ungrouped for attribution, which is right in general — but lockstep crate families like jaq-* can never pass CI solo. A cargo groups entry matching jaq-* for major updates would at least produce one coherent candidate PR; it still can't write the jq.rs code changes, so the manual migration PR remains the actual path either way.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

[dependabot]

Bumps jaq-core from 2.2.1 to 3.1.1.

Release notes

Sourced from jaq-core's releases.

3.1.1

This release features a new man page that is now generated by jaq itself. Apart from demonstrating jaq's XHTML processing capabilities, this serves to lift jaq's build dependency on Pandoc (01mf02/jaq#442). To quote@​alerque, jaq's Arch Linux package maintainer: "For any other project I'd say this was an absurd way to work around not wanting to use a standard tool. I guess for this project to dog food itself is ... chaotic genius?" This comment alone was nearly worth the endeavour.

Furthermore, this release makes it possible to disable a few dependencies when using jaq via its API (#448, thanks to @​kleinesfilmroellchen!), and handles broken pipes more gracefully 01mf02/jaq#445.

New Contributors

• @​kleinesfilmroellchen made their first contribution in 01mf02/jaq#448

Full Changelog: 01mf02/jaq@v3.1.0...v3.1.1

3.1

This release adds support for jq's input_filename filter --- thanks to @​a-n-d-r-e-w-l01mf02/jaq#432! Furthermore, at places where jaq accepted filters like .a["b"], it now also accepts (equivalent) filters such as .a.["b"] (note the added dot after .a). 01mf02/jaq#423 Finally, this release corrects the indexing of arrays with an empty array, which previously panicked 01mf02/jaq#439. Thanks to @​leeewee for spotting this!

API

The biggest change in this release is that calls to halt in jq filters can now be handled by users of the jaq API, instead of forcing a termination of the process. Thanks to @​a-n-d-r-e-w-l01mf02/jaq#433! This has a few implications:

• The signature of jaq_all::data::run had to be changed, resulting in a new major version of jaq-all.
• To preserve semantic versioning stability guarantees, the jaq_core::unwrap_valr function still terminates the current process if halt is called, but only if the std feature is enabled --- otherwise, unwrap_valr panics! You need to take action to prevent panics if all of the following conditions hold:
  1. you use jaq_core::unwrap_valr,
  2. you have disabled the std feature in jaq_core, and
  3. you run filters that may call halt.

Furthermore, this version makes it possible to clone definitions, which can speed up compiling many different jq filters. 01mf02/jaq#430

Full Changelog: 01mf02/jaq@v3.0.0...v3.1.0

3.0

jaq is a jq clone with focus on correctness, speed, and simplicity.

The most outstanding change in jaq 3.0 is its multi-format support, allowing you to read and write several data formats such as YAML, CBOR, TOML, XML, CSV, TSV, and of course JSON. That means that among others, jaq can convert data from one format into another, while transforming data with a jq filter. This effectively makes it into a "Pandoc for structured data". Achieving this has been the main focus of the NLnet-founded "Polyglot jaq" project, which has been successfully finished. A huge thanks to NLnet for supporting jaq and, more generally, free software!

Other large user-facing changes include:

• Manual: jaq now has a full jq and jaq reference manual. This was a monumental effort into which I poured a lot of love, and I hope that you enjoy reading it as much as I enjoyed putting easter eggs into it. Bonus: You also get a man page. (For package maintainers: Man page build instructions can be found in docs/README.md.)
• Byte strings: You can now read strings that contain arbitrary contents, including invalid UTF-8 sequences. (When a string is read from a file, this takes only constant time, thanks to memory mapping.) You can then mark these strings as byte strings via tobytes, allowing you to index/slice them in constant time. This allows you to process arbitrary binary data efficiently with jaq --- as proof of concept, I implemented a little TAR decoder.
• Arbitrary values as object keys: Where jq supports only strings as object keys, jaq supports arbitrary values as object keys.
• Compatibility improvements: Although this release adds many new features to jaq that do not exist in jq, this release still increases compatibility with jq. For example, jaq now supports path/1 and many other path-related filters.

API:

• New jaq-all crate for easier "batteries-included" jaq usage
• Passing arbitrary data to native filters
• Optional thread-safe jaq_json::Val when enabling the sync feature, allowing for multithreaded usage of values, e.g. running multiple filters in parallel on the same value

... (truncated)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[opieter-aws]

@strandly-the-agent review this major version upgrade. Do we need or want this? Clearly it beaks CI.

[strandly-the-agent]

Verdict: close this PR — it can never go green, and Dependabot can't fix it. Recommend @dependabot ignore this major version (reopenable later).

Answering your questions directly:

• Need it? No. cargo audit is clean on jaq 2.2.1 (the Security-audit leg passes), and jaq 3's headline safety win — halt no longer killing the host process — is already covered by our sandbox stubs in src/commands/jq.rs:44.
• Why CI breaks: the PR bumps only jaq-core → 3.1.1, but jaq-std 2.1.2 and jaq-json 1.1.3 still pin jaq-core ^2, so both 2.2.1 and 3.1.1 end up in the graph and jq.rs fails with 15 type-mismatch errors (reproduced locally). Same dead end as #15/#4, which this superseded — this will recur every jaq-core release until we ignore the major or migrate.
• Want it? Mildly, eventually — upstream focus is 3.x and it brings jq-compat fixes. I tested the real path: a coordinated jaq-core 3 + jaq-std 3 + jaq-json 2 bump resolves cleanly but leaves ~22 compile errors, all confined to src/commands/jq.rs (258 lines). A small manual migration PR — happy to open it if you want jaq 3; otherwise ignoring the major costs us nothing today.

Evidence & migration details

Verification ledger

• ✅ Reviewed head d7b6d59 vs base 6fecd79; diff is Cargo.toml (jaq-core = "2" → "3") + Cargo.lock only.
• ✅ Lockfile on this PR contains bothjaq-core 2.2.1 (via jaq-std/jaq-json) and jaq-core 3.1.1 (via strands-shell) — the dual-version graph is visible in the Cargo.lock diff.
• ✅ cargo check --workspace on the PR head: 15 errors, e.g. rustc: "there are multiple different versions of crate jaq_core in the dependency graph" (expected jaq_core 2.2.1::Native<Val>, found 3.1.1::Native<Val> at jq.rs:74).
• ✅ cargo check with the coordinated bump (jaq-core = "3", jaq-std = "3", jaq-json = "2"): resolves and builds deps fine, 22 errors, all in src/commands/jq.rs — no other file in the workspace touches jaq.
• ✅ crates.io index: the coherent jaq-3 stack is jaq-core 3.1.1 + jaq-std 3.0.3 + jaq-json 2.0.3.
• ⚠️ Unchecked: whether the jaq#439 empty-array-indexing panic (fixed in 3.1) is reachable through our jq builtin on 2.2.1 — my repro build hit a sandbox disk limit. If it is reachable, it's a user-triggerable panic and would strengthen the "want" case.

What the migration actually involves (from the 22 errors)

• jaq_core::Native<V> → Native<D: DataT> (use JustLut<Val>); the halt_error/env stub plumbing and Compiler generics change accordingly.
• jaq_json::Val: From<serde_json::Value> is gone in jaq-json 2 — the serde interop moved (feature renamed serde_json → serde, now via serde_core), so input/output conversion needs rewriting.
• filter.run(...) moved (compile::Filter now wraps it; roughly filter.id.run(lut, ...)).
• All confined to run_filter() in src/commands/jq.rs; existing jq integration tests in tests/shell_integration.rs cover the behavior, so regressions would surface.

Config note (why this keeps happening)

dependabot.yml deliberately leaves majors ungrouped for attribution, which is right in general — but lockstep crate families like jaq-* can never pass CI solo. A cargo groups entry matching jaq-* for major updates would at least produce one coherent candidate PR; it still can't write the jq.rs code changes, so the manual migration PR remains the actual path either way.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

[dependabot]

Bumps jaq-core from 2.2.1 to 3.1.1.

Release notes

Sourced from jaq-core's releases.

3.1.1

This release features a new man page that is now generated by jaq itself. Apart from demonstrating jaq's XHTML processing capabilities, this serves to lift jaq's build dependency on Pandoc (01mf02/jaq#442). To quote@​alerque, jaq's Arch Linux package maintainer: "For any other project I'd say this was an absurd way to work around not wanting to use a standard tool. I guess for this project to dog food itself is ... chaotic genius?" This comment alone was nearly worth the endeavour.

Furthermore, this release makes it possible to disable a few dependencies when using jaq via its API (#448, thanks to @​kleinesfilmroellchen!), and handles broken pipes more gracefully 01mf02/jaq#445.

New Contributors

• @​kleinesfilmroellchen made their first contribution in 01mf02/jaq#448

Full Changelog: 01mf02/jaq@v3.1.0...v3.1.1

3.1

This release adds support for jq's input_filename filter --- thanks to @​a-n-d-r-e-w-l01mf02/jaq#432! Furthermore, at places where jaq accepted filters like .a["b"], it now also accepts (equivalent) filters such as .a.["b"] (note the added dot after .a). 01mf02/jaq#423 Finally, this release corrects the indexing of arrays with an empty array, which previously panicked 01mf02/jaq#439. Thanks to @​leeewee for spotting this!

API

The biggest change in this release is that calls to halt in jq filters can now be handled by users of the jaq API, instead of forcing a termination of the process. Thanks to @​a-n-d-r-e-w-l01mf02/jaq#433! This has a few implications:

• The signature of jaq_all::data::run had to be changed, resulting in a new major version of jaq-all.
• To preserve semantic versioning stability guarantees, the jaq_core::unwrap_valr function still terminates the current process if halt is called, but only if the std feature is enabled --- otherwise, unwrap_valr panics! You need to take action to prevent panics if all of the following conditions hold:
  1. you use jaq_core::unwrap_valr,
  2. you have disabled the std feature in jaq_core, and
  3. you run filters that may call halt.

Furthermore, this version makes it possible to clone definitions, which can speed up compiling many different jq filters. 01mf02/jaq#430

Full Changelog: 01mf02/jaq@v3.0.0...v3.1.0

3.0

jaq is a jq clone with focus on correctness, speed, and simplicity.

The most outstanding change in jaq 3.0 is its multi-format support, allowing you to read and write several data formats such as YAML, CBOR, TOML, XML, CSV, TSV, and of course JSON. That means that among others, jaq can convert data from one format into another, while transforming data with a jq filter. This effectively makes it into a "Pandoc for structured data". Achieving this has been the main focus of the NLnet-founded "Polyglot jaq" project, which has been successfully finished. A huge thanks to NLnet for supporting jaq and, more generally, free software!

Other large user-facing changes include:

• Manual: jaq now has a full jq and jaq reference manual. This was a monumental effort into which I poured a lot of love, and I hope that you enjoy reading it as much as I enjoyed putting easter eggs into it. Bonus: You also get a man page. (For package maintainers: Man page build instructions can be found in docs/README.md.)
• Byte strings: You can now read strings that contain arbitrary contents, including invalid UTF-8 sequences. (When a string is read from a file, this takes only constant time, thanks to memory mapping.) You can then mark these strings as byte strings via tobytes, allowing you to index/slice them in constant time. This allows you to process arbitrary binary data efficiently with jaq --- as proof of concept, I implemented a little TAR decoder.
• Arbitrary values as object keys: Where jq supports only strings as object keys, jaq supports arbitrary values as object keys.
• Compatibility improvements: Although this release adds many new features to jaq that do not exist in jq, this release still increases compatibility with jq. For example, jaq now supports path/1 and many other path-related filters.

API:

• New jaq-all crate for easier "batteries-included" jaq usage
• Passing arbitrary data to native filters
• Optional thread-safe jaq_json::Val when enabling the sync feature, allowing for multithreaded usage of values, e.g. running multiple filters in parallel on the same value

... (truncated)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[opieter-aws]

@strandly-the-agent review this major version upgrade. Do we need or want this? Clearly it beaks CI.

[strandly-the-agent]

Verdict: close this PR — it can never go green, and Dependabot can't fix it. Recommend @dependabot ignore this major version (reopenable later).

Answering your questions directly:

• Need it? No. cargo audit is clean on jaq 2.2.1 (the Security-audit leg passes), and jaq 3's headline safety win — halt no longer killing the host process — is already covered by our sandbox stubs in src/commands/jq.rs:44.
• Why CI breaks: the PR bumps only jaq-core → 3.1.1, but jaq-std 2.1.2 and jaq-json 1.1.3 still pin jaq-core ^2, so both 2.2.1 and 3.1.1 end up in the graph and jq.rs fails with 15 type-mismatch errors (reproduced locally). Same dead end as #15/#4, which this superseded — this will recur every jaq-core release until we ignore the major or migrate.
• Want it? Mildly, eventually — upstream focus is 3.x and it brings jq-compat fixes. I tested the real path: a coordinated jaq-core 3 + jaq-std 3 + jaq-json 2 bump resolves cleanly but leaves ~22 compile errors, all confined to src/commands/jq.rs (258 lines). A small manual migration PR — happy to open it if you want jaq 3; otherwise ignoring the major costs us nothing today.

Evidence & migration details

Verification ledger

• ✅ Reviewed head d7b6d59 vs base 6fecd79; diff is Cargo.toml (jaq-core = "2" → "3") + Cargo.lock only.
• ✅ Lockfile on this PR contains bothjaq-core 2.2.1 (via jaq-std/jaq-json) and jaq-core 3.1.1 (via strands-shell) — the dual-version graph is visible in the Cargo.lock diff.
• ✅ cargo check --workspace on the PR head: 15 errors, e.g. rustc: "there are multiple different versions of crate jaq_core in the dependency graph" (expected jaq_core 2.2.1::Native<Val>, found 3.1.1::Native<Val> at jq.rs:74).
• ✅ cargo check with the coordinated bump (jaq-core = "3", jaq-std = "3", jaq-json = "2"): resolves and builds deps fine, 22 errors, all in src/commands/jq.rs — no other file in the workspace touches jaq.
• ✅ crates.io index: the coherent jaq-3 stack is jaq-core 3.1.1 + jaq-std 3.0.3 + jaq-json 2.0.3.
• ⚠️ Unchecked: whether the jaq#439 empty-array-indexing panic (fixed in 3.1) is reachable through our jq builtin on 2.2.1 — my repro build hit a sandbox disk limit. If it is reachable, it's a user-triggerable panic and would strengthen the "want" case.

What the migration actually involves (from the 22 errors)

• jaq_core::Native<V> → Native<D: DataT> (use JustLut<Val>); the halt_error/env stub plumbing and Compiler generics change accordingly.
• jaq_json::Val: From<serde_json::Value> is gone in jaq-json 2 — the serde interop moved (feature renamed serde_json → serde, now via serde_core), so input/output conversion needs rewriting.
• filter.run(...) moved (compile::Filter now wraps it; roughly filter.id.run(lut, ...)).
• All confined to run_filter() in src/commands/jq.rs; existing jq integration tests in tests/shell_integration.rs cover the behavior, so regressions would surface.

Config note (why this keeps happening)

dependabot.yml deliberately leaves majors ungrouped for attribution, which is right in general — but lockstep crate families like jaq-* can never pass CI solo. A cargo groups entry matching jaq-* for major updates would at least produce one coherent candidate PR; it still can't write the jq.rs code changes, so the manual migration PR remains the actual path either way.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

[dependabot]

Bumps jaq-core from 2.2.1 to 3.1.1.

Release notes

Sourced from jaq-core's releases.

3.1.1

This release features a new man page that is now generated by jaq itself. Apart from demonstrating jaq's XHTML processing capabilities, this serves to lift jaq's build dependency on Pandoc (01mf02/jaq#442). To quote@​alerque, jaq's Arch Linux package maintainer: "For any other project I'd say this was an absurd way to work around not wanting to use a standard tool. I guess for this project to dog food itself is ... chaotic genius?" This comment alone was nearly worth the endeavour.

Furthermore, this release makes it possible to disable a few dependencies when using jaq via its API (#448, thanks to @​kleinesfilmroellchen!), and handles broken pipes more gracefully 01mf02/jaq#445.

New Contributors

• @​kleinesfilmroellchen made their first contribution in 01mf02/jaq#448

Full Changelog: 01mf02/jaq@v3.1.0...v3.1.1

3.1

This release adds support for jq's input_filename filter --- thanks to @​a-n-d-r-e-w-l01mf02/jaq#432! Furthermore, at places where jaq accepted filters like .a["b"], it now also accepts (equivalent) filters such as .a.["b"] (note the added dot after .a). 01mf02/jaq#423 Finally, this release corrects the indexing of arrays with an empty array, which previously panicked 01mf02/jaq#439. Thanks to @​leeewee for spotting this!

API

The biggest change in this release is that calls to halt in jq filters can now be handled by users of the jaq API, instead of forcing a termination of the process. Thanks to @​a-n-d-r-e-w-l01mf02/jaq#433! This has a few implications:

• The signature of jaq_all::data::run had to be changed, resulting in a new major version of jaq-all.
• To preserve semantic versioning stability guarantees, the jaq_core::unwrap_valr function still terminates the current process if halt is called, but only if the std feature is enabled --- otherwise, unwrap_valr panics! You need to take action to prevent panics if all of the following conditions hold:
  1. you use jaq_core::unwrap_valr,
  2. you have disabled the std feature in jaq_core, and
  3. you run filters that may call halt.

Furthermore, this version makes it possible to clone definitions, which can speed up compiling many different jq filters. 01mf02/jaq#430

Full Changelog: 01mf02/jaq@v3.0.0...v3.1.0

3.0

jaq is a jq clone with focus on correctness, speed, and simplicity.

The most outstanding change in jaq 3.0 is its multi-format support, allowing you to read and write several data formats such as YAML, CBOR, TOML, XML, CSV, TSV, and of course JSON. That means that among others, jaq can convert data from one format into another, while transforming data with a jq filter. This effectively makes it into a "Pandoc for structured data". Achieving this has been the main focus of the NLnet-founded "Polyglot jaq" project, which has been successfully finished. A huge thanks to NLnet for supporting jaq and, more generally, free software!

Other large user-facing changes include:

• Manual: jaq now has a full jq and jaq reference manual. This was a monumental effort into which I poured a lot of love, and I hope that you enjoy reading it as much as I enjoyed putting easter eggs into it. Bonus: You also get a man page. (For package maintainers: Man page build instructions can be found in docs/README.md.)
• Byte strings: You can now read strings that contain arbitrary contents, including invalid UTF-8 sequences. (When a string is read from a file, this takes only constant time, thanks to memory mapping.) You can then mark these strings as byte strings via tobytes, allowing you to index/slice them in constant time. This allows you to process arbitrary binary data efficiently with jaq --- as proof of concept, I implemented a little TAR decoder.
• Arbitrary values as object keys: Where jq supports only strings as object keys, jaq supports arbitrary values as object keys.
• Compatibility improvements: Although this release adds many new features to jaq that do not exist in jq, this release still increases compatibility with jq. For example, jaq now supports path/1 and many other path-related filters.

API:

• New jaq-all crate for easier "batteries-included" jaq usage
• Passing arbitrary data to native filters
• Optional thread-safe jaq_json::Val when enabling the sync feature, allowing for multithreaded usage of values, e.g. running multiple filters in parallel on the same value

... (truncated)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[opieter-aws]

@strandly-the-agent review this major version upgrade. Do we need or want this? Clearly it beaks CI.

[strandly-the-agent]

Verdict: close this PR — it can never go green, and Dependabot can't fix it. Recommend @dependabot ignore this major version (reopenable later).

Answering your questions directly:

• Need it? No. cargo audit is clean on jaq 2.2.1 (the Security-audit leg passes), and jaq 3's headline safety win — halt no longer killing the host process — is already covered by our sandbox stubs in src/commands/jq.rs:44.
• Why CI breaks: the PR bumps only jaq-core → 3.1.1, but jaq-std 2.1.2 and jaq-json 1.1.3 still pin jaq-core ^2, so both 2.2.1 and 3.1.1 end up in the graph and jq.rs fails with 15 type-mismatch errors (reproduced locally). Same dead end as #15/#4, which this superseded — this will recur every jaq-core release until we ignore the major or migrate.
• Want it? Mildly, eventually — upstream focus is 3.x and it brings jq-compat fixes. I tested the real path: a coordinated jaq-core 3 + jaq-std 3 + jaq-json 2 bump resolves cleanly but leaves ~22 compile errors, all confined to src/commands/jq.rs (258 lines). A small manual migration PR — happy to open it if you want jaq 3; otherwise ignoring the major costs us nothing today.

Evidence & migration details

Verification ledger

• ✅ Reviewed head d7b6d59 vs base 6fecd79; diff is Cargo.toml (jaq-core = "2" → "3") + Cargo.lock only.
• ✅ Lockfile on this PR contains bothjaq-core 2.2.1 (via jaq-std/jaq-json) and jaq-core 3.1.1 (via strands-shell) — the dual-version graph is visible in the Cargo.lock diff.
• ✅ cargo check --workspace on the PR head: 15 errors, e.g. rustc: "there are multiple different versions of crate jaq_core in the dependency graph" (expected jaq_core 2.2.1::Native<Val>, found 3.1.1::Native<Val> at jq.rs:74).
• ✅ cargo check with the coordinated bump (jaq-core = "3", jaq-std = "3", jaq-json = "2"): resolves and builds deps fine, 22 errors, all in src/commands/jq.rs — no other file in the workspace touches jaq.
• ✅ crates.io index: the coherent jaq-3 stack is jaq-core 3.1.1 + jaq-std 3.0.3 + jaq-json 2.0.3.
• ⚠️ Unchecked: whether the jaq#439 empty-array-indexing panic (fixed in 3.1) is reachable through our jq builtin on 2.2.1 — my repro build hit a sandbox disk limit. If it is reachable, it's a user-triggerable panic and would strengthen the "want" case.

What the migration actually involves (from the 22 errors)

• jaq_core::Native<V> → Native<D: DataT> (use JustLut<Val>); the halt_error/env stub plumbing and Compiler generics change accordingly.
• jaq_json::Val: From<serde_json::Value> is gone in jaq-json 2 — the serde interop moved (feature renamed serde_json → serde, now via serde_core), so input/output conversion needs rewriting.
• filter.run(...) moved (compile::Filter now wraps it; roughly filter.id.run(lut, ...)).
• All confined to run_filter() in src/commands/jq.rs; existing jq integration tests in tests/shell_integration.rs cover the behavior, so regressions would surface.

Config note (why this keeps happening)

dependabot.yml deliberately leaves majors ungrouped for attribution, which is right in general — but lockstep crate families like jaq-* can never pass CI solo. A cargo groups entry matching jaq-* for major updates would at least produce one coherent candidate PR; it still can't write the jq.rs code changes, so the manual migration PR remains the actual path either way.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

[dependabot]

Bumps jaq-core from 2.2.1 to 3.1.1.

Release notes

Sourced from jaq-core's releases.

3.1.1

This release features a new man page that is now generated by jaq itself. Apart from demonstrating jaq's XHTML processing capabilities, this serves to lift jaq's build dependency on Pandoc (01mf02/jaq#442). To quote@​alerque, jaq's Arch Linux package maintainer: "For any other project I'd say this was an absurd way to work around not wanting to use a standard tool. I guess for this project to dog food itself is ... chaotic genius?" This comment alone was nearly worth the endeavour.

Furthermore, this release makes it possible to disable a few dependencies when using jaq via its API (#448, thanks to @​kleinesfilmroellchen!), and handles broken pipes more gracefully 01mf02/jaq#445.

New Contributors

• @​kleinesfilmroellchen made their first contribution in 01mf02/jaq#448

Full Changelog: 01mf02/jaq@v3.1.0...v3.1.1

3.1

This release adds support for jq's input_filename filter --- thanks to @​a-n-d-r-e-w-l01mf02/jaq#432! Furthermore, at places where jaq accepted filters like .a["b"], it now also accepts (equivalent) filters such as .a.["b"] (note the added dot after .a). 01mf02/jaq#423 Finally, this release corrects the indexing of arrays with an empty array, which previously panicked 01mf02/jaq#439. Thanks to @​leeewee for spotting this!

API

The biggest change in this release is that calls to halt in jq filters can now be handled by users of the jaq API, instead of forcing a termination of the process. Thanks to @​a-n-d-r-e-w-l01mf02/jaq#433! This has a few implications:

• The signature of jaq_all::data::run had to be changed, resulting in a new major version of jaq-all.
• To preserve semantic versioning stability guarantees, the jaq_core::unwrap_valr function still terminates the current process if halt is called, but only if the std feature is enabled --- otherwise, unwrap_valr panics! You need to take action to prevent panics if all of the following conditions hold:
  1. you use jaq_core::unwrap_valr,
  2. you have disabled the std feature in jaq_core, and
  3. you run filters that may call halt.

Furthermore, this version makes it possible to clone definitions, which can speed up compiling many different jq filters. 01mf02/jaq#430

Full Changelog: 01mf02/jaq@v3.0.0...v3.1.0

3.0

jaq is a jq clone with focus on correctness, speed, and simplicity.

The most outstanding change in jaq 3.0 is its multi-format support, allowing you to read and write several data formats such as YAML, CBOR, TOML, XML, CSV, TSV, and of course JSON. That means that among others, jaq can convert data from one format into another, while transforming data with a jq filter. This effectively makes it into a "Pandoc for structured data". Achieving this has been the main focus of the NLnet-founded "Polyglot jaq" project, which has been successfully finished. A huge thanks to NLnet for supporting jaq and, more generally, free software!

Other large user-facing changes include:

• Manual: jaq now has a full jq and jaq reference manual. This was a monumental effort into which I poured a lot of love, and I hope that you enjoy reading it as much as I enjoyed putting easter eggs into it. Bonus: You also get a man page. (For package maintainers: Man page build instructions can be found in docs/README.md.)
• Byte strings: You can now read strings that contain arbitrary contents, including invalid UTF-8 sequences. (When a string is read from a file, this takes only constant time, thanks to memory mapping.) You can then mark these strings as byte strings via tobytes, allowing you to index/slice them in constant time. This allows you to process arbitrary binary data efficiently with jaq --- as proof of concept, I implemented a little TAR decoder.
• Arbitrary values as object keys: Where jq supports only strings as object keys, jaq supports arbitrary values as object keys.
• Compatibility improvements: Although this release adds many new features to jaq that do not exist in jq, this release still increases compatibility with jq. For example, jaq now supports path/1 and many other path-related filters.

API:

• New jaq-all crate for easier "batteries-included" jaq usage
• Passing arbitrary data to native filters
• Optional thread-safe jaq_json::Val when enabling the sync feature, allowing for multithreaded usage of values, e.g. running multiple filters in parallel on the same value

... (truncated)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[opieter-aws]

@strandly-the-agent review this major version upgrade. Do we need or want this? Clearly it beaks CI.

[strandly-the-agent]

Verdict: close this PR — it can never go green, and Dependabot can't fix it. Recommend @dependabot ignore this major version (reopenable later).

Answering your questions directly:

• Need it? No. cargo audit is clean on jaq 2.2.1 (the Security-audit leg passes), and jaq 3's headline safety win — halt no longer killing the host process — is already covered by our sandbox stubs in src/commands/jq.rs:44.
• Why CI breaks: the PR bumps only jaq-core → 3.1.1, but jaq-std 2.1.2 and jaq-json 1.1.3 still pin jaq-core ^2, so both 2.2.1 and 3.1.1 end up in the graph and jq.rs fails with 15 type-mismatch errors (reproduced locally). Same dead end as #15/#4, which this superseded — this will recur every jaq-core release until we ignore the major or migrate.
• Want it? Mildly, eventually — upstream focus is 3.x and it brings jq-compat fixes. I tested the real path: a coordinated jaq-core 3 + jaq-std 3 + jaq-json 2 bump resolves cleanly but leaves ~22 compile errors, all confined to src/commands/jq.rs (258 lines). A small manual migration PR — happy to open it if you want jaq 3; otherwise ignoring the major costs us nothing today.

Evidence & migration details

Verification ledger

• ✅ Reviewed head d7b6d59 vs base 6fecd79; diff is Cargo.toml (jaq-core = "2" → "3") + Cargo.lock only.
• ✅ Lockfile on this PR contains bothjaq-core 2.2.1 (via jaq-std/jaq-json) and jaq-core 3.1.1 (via strands-shell) — the dual-version graph is visible in the Cargo.lock diff.
• ✅ cargo check --workspace on the PR head: 15 errors, e.g. rustc: "there are multiple different versions of crate jaq_core in the dependency graph" (expected jaq_core 2.2.1::Native<Val>, found 3.1.1::Native<Val> at jq.rs:74).
• ✅ cargo check with the coordinated bump (jaq-core = "3", jaq-std = "3", jaq-json = "2"): resolves and builds deps fine, 22 errors, all in src/commands/jq.rs — no other file in the workspace touches jaq.
• ✅ crates.io index: the coherent jaq-3 stack is jaq-core 3.1.1 + jaq-std 3.0.3 + jaq-json 2.0.3.
• ⚠️ Unchecked: whether the jaq#439 empty-array-indexing panic (fixed in 3.1) is reachable through our jq builtin on 2.2.1 — my repro build hit a sandbox disk limit. If it is reachable, it's a user-triggerable panic and would strengthen the "want" case.

What the migration actually involves (from the 22 errors)

• jaq_core::Native<V> → Native<D: DataT> (use JustLut<Val>); the halt_error/env stub plumbing and Compiler generics change accordingly.
• jaq_json::Val: From<serde_json::Value> is gone in jaq-json 2 — the serde interop moved (feature renamed serde_json → serde, now via serde_core), so input/output conversion needs rewriting.
• filter.run(...) moved (compile::Filter now wraps it; roughly filter.id.run(lut, ...)).
• All confined to run_filter() in src/commands/jq.rs; existing jq integration tests in tests/shell_integration.rs cover the behavior, so regressions would surface.

Config note (why this keeps happening)

dependabot.yml deliberately leaves majors ungrouped for attribution, which is right in general — but lockstep crate families like jaq-* can never pass CI solo. A cargo groups entry matching jaq-* for major updates would at least produce one coherent candidate PR; it still can't write the jq.rs code changes, so the manual migration PR remains the actual path either way.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

[dependabot]

Bumps jaq-core from 2.2.1 to 3.1.1.

Release notes

Sourced from jaq-core's releases.

3.1.1

This release features a new man page that is now generated by jaq itself. Apart from demonstrating jaq's XHTML processing capabilities, this serves to lift jaq's build dependency on Pandoc (01mf02/jaq#442). To quote@​alerque, jaq's Arch Linux package maintainer: "For any other project I'd say this was an absurd way to work around not wanting to use a standard tool. I guess for this project to dog food itself is ... chaotic genius?" This comment alone was nearly worth the endeavour.

Furthermore, this release makes it possible to disable a few dependencies when using jaq via its API (#448, thanks to @​kleinesfilmroellchen!), and handles broken pipes more gracefully 01mf02/jaq#445.

New Contributors

• @​kleinesfilmroellchen made their first contribution in 01mf02/jaq#448

Full Changelog: 01mf02/jaq@v3.1.0...v3.1.1

3.1

This release adds support for jq's input_filename filter --- thanks to @​a-n-d-r-e-w-l01mf02/jaq#432! Furthermore, at places where jaq accepted filters like .a["b"], it now also accepts (equivalent) filters such as .a.["b"] (note the added dot after .a). 01mf02/jaq#423 Finally, this release corrects the indexing of arrays with an empty array, which previously panicked 01mf02/jaq#439. Thanks to @​leeewee for spotting this!

API

The biggest change in this release is that calls to halt in jq filters can now be handled by users of the jaq API, instead of forcing a termination of the process. Thanks to @​a-n-d-r-e-w-l01mf02/jaq#433! This has a few implications:

• The signature of jaq_all::data::run had to be changed, resulting in a new major version of jaq-all.
• To preserve semantic versioning stability guarantees, the jaq_core::unwrap_valr function still terminates the current process if halt is called, but only if the std feature is enabled --- otherwise, unwrap_valr panics! You need to take action to prevent panics if all of the following conditions hold:
  1. you use jaq_core::unwrap_valr,
  2. you have disabled the std feature in jaq_core, and
  3. you run filters that may call halt.

Furthermore, this version makes it possible to clone definitions, which can speed up compiling many different jq filters. 01mf02/jaq#430

Full Changelog: 01mf02/jaq@v3.0.0...v3.1.0

3.0

jaq is a jq clone with focus on correctness, speed, and simplicity.

The most outstanding change in jaq 3.0 is its multi-format support, allowing you to read and write several data formats such as YAML, CBOR, TOML, XML, CSV, TSV, and of course JSON. That means that among others, jaq can convert data from one format into another, while transforming data with a jq filter. This effectively makes it into a "Pandoc for structured data". Achieving this has been the main focus of the NLnet-founded "Polyglot jaq" project, which has been successfully finished. A huge thanks to NLnet for supporting jaq and, more generally, free software!

Other large user-facing changes include:

• Manual: jaq now has a full jq and jaq reference manual. This was a monumental effort into which I poured a lot of love, and I hope that you enjoy reading it as much as I enjoyed putting easter eggs into it. Bonus: You also get a man page. (For package maintainers: Man page build instructions can be found in docs/README.md.)
• Byte strings: You can now read strings that contain arbitrary contents, including invalid UTF-8 sequences. (When a string is read from a file, this takes only constant time, thanks to memory mapping.) You can then mark these strings as byte strings via tobytes, allowing you to index/slice them in constant time. This allows you to process arbitrary binary data efficiently with jaq --- as proof of concept, I implemented a little TAR decoder.
• Arbitrary values as object keys: Where jq supports only strings as object keys, jaq supports arbitrary values as object keys.
• Compatibility improvements: Although this release adds many new features to jaq that do not exist in jq, this release still increases compatibility with jq. For example, jaq now supports path/1 and many other path-related filters.

API:

• New jaq-all crate for easier "batteries-included" jaq usage
• Passing arbitrary data to native filters
• Optional thread-safe jaq_json::Val when enabling the sync feature, allowing for multithreaded usage of values, e.g. running multiple filters in parallel on the same value

... (truncated)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[opieter-aws]

@strandly-the-agent review this major version upgrade. Do we need or want this? Clearly it beaks CI.

[strandly-the-agent]

Verdict: close this PR — it can never go green, and Dependabot can't fix it. Recommend @dependabot ignore this major version (reopenable later).

Answering your questions directly:

• Need it? No. cargo audit is clean on jaq 2.2.1 (the Security-audit leg passes), and jaq 3's headline safety win — halt no longer killing the host process — is already covered by our sandbox stubs in src/commands/jq.rs:44.
• Why CI breaks: the PR bumps only jaq-core → 3.1.1, but jaq-std 2.1.2 and jaq-json 1.1.3 still pin jaq-core ^2, so both 2.2.1 and 3.1.1 end up in the graph and jq.rs fails with 15 type-mismatch errors (reproduced locally). Same dead end as #15/#4, which this superseded — this will recur every jaq-core release until we ignore the major or migrate.
• Want it? Mildly, eventually — upstream focus is 3.x and it brings jq-compat fixes. I tested the real path: a coordinated jaq-core 3 + jaq-std 3 + jaq-json 2 bump resolves cleanly but leaves ~22 compile errors, all confined to src/commands/jq.rs (258 lines). A small manual migration PR — happy to open it if you want jaq 3; otherwise ignoring the major costs us nothing today.

Evidence & migration details

Verification ledger

• ✅ Reviewed head d7b6d59 vs base 6fecd79; diff is Cargo.toml (jaq-core = "2" → "3") + Cargo.lock only.
• ✅ Lockfile on this PR contains bothjaq-core 2.2.1 (via jaq-std/jaq-json) and jaq-core 3.1.1 (via strands-shell) — the dual-version graph is visible in the Cargo.lock diff.
• ✅ cargo check --workspace on the PR head: 15 errors, e.g. rustc: "there are multiple different versions of crate jaq_core in the dependency graph" (expected jaq_core 2.2.1::Native<Val>, found 3.1.1::Native<Val> at jq.rs:74).
• ✅ cargo check with the coordinated bump (jaq-core = "3", jaq-std = "3", jaq-json = "2"): resolves and builds deps fine, 22 errors, all in src/commands/jq.rs — no other file in the workspace touches jaq.
• ✅ crates.io index: the coherent jaq-3 stack is jaq-core 3.1.1 + jaq-std 3.0.3 + jaq-json 2.0.3.
• ⚠️ Unchecked: whether the jaq#439 empty-array-indexing panic (fixed in 3.1) is reachable through our jq builtin on 2.2.1 — my repro build hit a sandbox disk limit. If it is reachable, it's a user-triggerable panic and would strengthen the "want" case.

What the migration actually involves (from the 22 errors)

• jaq_core::Native<V> → Native<D: DataT> (use JustLut<Val>); the halt_error/env stub plumbing and Compiler generics change accordingly.
• jaq_json::Val: From<serde_json::Value> is gone in jaq-json 2 — the serde interop moved (feature renamed serde_json → serde, now via serde_core), so input/output conversion needs rewriting.
• filter.run(...) moved (compile::Filter now wraps it; roughly filter.id.run(lut, ...)).
• All confined to run_filter() in src/commands/jq.rs; existing jq integration tests in tests/shell_integration.rs cover the behavior, so regressions would surface.

Config note (why this keeps happening)

dependabot.yml deliberately leaves majors ungrouped for attribution, which is right in general — but lockstep crate families like jaq-* can never pass CI solo. A cargo groups entry matching jaq-* for major updates would at least produce one coherent candidate PR; it still can't write the jq.rs code changes, so the manual migration PR remains the actual path either way.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

[dependabot]

Bumps jaq-core from 2.2.1 to 3.1.1.

Release notes

Sourced from jaq-core's releases.

3.1.1

This release features a new man page that is now generated by jaq itself. Apart from demonstrating jaq's XHTML processing capabilities, this serves to lift jaq's build dependency on Pandoc (01mf02/jaq#442). To quote@​alerque, jaq's Arch Linux package maintainer: "For any other project I'd say this was an absurd way to work around not wanting to use a standard tool. I guess for this project to dog food itself is ... chaotic genius?" This comment alone was nearly worth the endeavour.

Furthermore, this release makes it possible to disable a few dependencies when using jaq via its API (#448, thanks to @​kleinesfilmroellchen!), and handles broken pipes more gracefully 01mf02/jaq#445.

New Contributors

• @​kleinesfilmroellchen made their first contribution in 01mf02/jaq#448

Full Changelog: 01mf02/jaq@v3.1.0...v3.1.1

3.1

This release adds support for jq's input_filename filter --- thanks to @​a-n-d-r-e-w-l01mf02/jaq#432! Furthermore, at places where jaq accepted filters like .a["b"], it now also accepts (equivalent) filters such as .a.["b"] (note the added dot after .a). 01mf02/jaq#423 Finally, this release corrects the indexing of arrays with an empty array, which previously panicked 01mf02/jaq#439. Thanks to @​leeewee for spotting this!

API

The biggest change in this release is that calls to halt in jq filters can now be handled by users of the jaq API, instead of forcing a termination of the process. Thanks to @​a-n-d-r-e-w-l01mf02/jaq#433! This has a few implications:

• The signature of jaq_all::data::run had to be changed, resulting in a new major version of jaq-all.
• To preserve semantic versioning stability guarantees, the jaq_core::unwrap_valr function still terminates the current process if halt is called, but only if the std feature is enabled --- otherwise, unwrap_valr panics! You need to take action to prevent panics if all of the following conditions hold:
  1. you use jaq_core::unwrap_valr,
  2. you have disabled the std feature in jaq_core, and
  3. you run filters that may call halt.

Furthermore, this version makes it possible to clone definitions, which can speed up compiling many different jq filters. 01mf02/jaq#430

Full Changelog: 01mf02/jaq@v3.0.0...v3.1.0

3.0

jaq is a jq clone with focus on correctness, speed, and simplicity.

The most outstanding change in jaq 3.0 is its multi-format support, allowing you to read and write several data formats such as YAML, CBOR, TOML, XML, CSV, TSV, and of course JSON. That means that among others, jaq can convert data from one format into another, while transforming data with a jq filter. This effectively makes it into a "Pandoc for structured data". Achieving this has been the main focus of the NLnet-founded "Polyglot jaq" project, which has been successfully finished. A huge thanks to NLnet for supporting jaq and, more generally, free software!

Other large user-facing changes include:

• Manual: jaq now has a full jq and jaq reference manual. This was a monumental effort into which I poured a lot of love, and I hope that you enjoy reading it as much as I enjoyed putting easter eggs into it. Bonus: You also get a man page. (For package maintainers: Man page build instructions can be found in docs/README.md.)
• Byte strings: You can now read strings that contain arbitrary contents, including invalid UTF-8 sequences. (When a string is read from a file, this takes only constant time, thanks to memory mapping.) You can then mark these strings as byte strings via tobytes, allowing you to index/slice them in constant time. This allows you to process arbitrary binary data efficiently with jaq --- as proof of concept, I implemented a little TAR decoder.
• Arbitrary values as object keys: Where jq supports only strings as object keys, jaq supports arbitrary values as object keys.
• Compatibility improvements: Although this release adds many new features to jaq that do not exist in jq, this release still increases compatibility with jq. For example, jaq now supports path/1 and many other path-related filters.

API:

• New jaq-all crate for easier "batteries-included" jaq usage
• Passing arbitrary data to native filters
• Optional thread-safe jaq_json::Val when enabling the sync feature, allowing for multithreaded usage of values, e.g. running multiple filters in parallel on the same value

... (truncated)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[opieter-aws]

@strandly-the-agent review this major version upgrade. Do we need or want this? Clearly it beaks CI.

[strandly-the-agent]

Verdict: close this PR — it can never go green, and Dependabot can't fix it. Recommend @dependabot ignore this major version (reopenable later).

Answering your questions directly:

• Need it? No. cargo audit is clean on jaq 2.2.1 (the Security-audit leg passes), and jaq 3's headline safety win — halt no longer killing the host process — is already covered by our sandbox stubs in src/commands/jq.rs:44.
• Why CI breaks: the PR bumps only jaq-core → 3.1.1, but jaq-std 2.1.2 and jaq-json 1.1.3 still pin jaq-core ^2, so both 2.2.1 and 3.1.1 end up in the graph and jq.rs fails with 15 type-mismatch errors (reproduced locally). Same dead end as #15/#4, which this superseded — this will recur every jaq-core release until we ignore the major or migrate.
• Want it? Mildly, eventually — upstream focus is 3.x and it brings jq-compat fixes. I tested the real path: a coordinated jaq-core 3 + jaq-std 3 + jaq-json 2 bump resolves cleanly but leaves ~22 compile errors, all confined to src/commands/jq.rs (258 lines). A small manual migration PR — happy to open it if you want jaq 3; otherwise ignoring the major costs us nothing today.

Evidence & migration details

Verification ledger

• ✅ Reviewed head d7b6d59 vs base 6fecd79; diff is Cargo.toml (jaq-core = "2" → "3") + Cargo.lock only.
• ✅ Lockfile on this PR contains bothjaq-core 2.2.1 (via jaq-std/jaq-json) and jaq-core 3.1.1 (via strands-shell) — the dual-version graph is visible in the Cargo.lock diff.
• ✅ cargo check --workspace on the PR head: 15 errors, e.g. rustc: "there are multiple different versions of crate jaq_core in the dependency graph" (expected jaq_core 2.2.1::Native<Val>, found 3.1.1::Native<Val> at jq.rs:74).
• ✅ cargo check with the coordinated bump (jaq-core = "3", jaq-std = "3", jaq-json = "2"): resolves and builds deps fine, 22 errors, all in src/commands/jq.rs — no other file in the workspace touches jaq.
• ✅ crates.io index: the coherent jaq-3 stack is jaq-core 3.1.1 + jaq-std 3.0.3 + jaq-json 2.0.3.
• ⚠️ Unchecked: whether the jaq#439 empty-array-indexing panic (fixed in 3.1) is reachable through our jq builtin on 2.2.1 — my repro build hit a sandbox disk limit. If it is reachable, it's a user-triggerable panic and would strengthen the "want" case.

What the migration actually involves (from the 22 errors)

• jaq_core::Native<V> → Native<D: DataT> (use JustLut<Val>); the halt_error/env stub plumbing and Compiler generics change accordingly.
• jaq_json::Val: From<serde_json::Value> is gone in jaq-json 2 — the serde interop moved (feature renamed serde_json → serde, now via serde_core), so input/output conversion needs rewriting.
• filter.run(...) moved (compile::Filter now wraps it; roughly filter.id.run(lut, ...)).
• All confined to run_filter() in src/commands/jq.rs; existing jq integration tests in tests/shell_integration.rs cover the behavior, so regressions would surface.

Config note (why this keeps happening)

dependabot.yml deliberately leaves majors ungrouped for attribution, which is right in general — but lockstep crate families like jaq-* can never pass CI solo. A cargo groups entry matching jaq-* for major updates would at least produce one coherent candidate PR; it still can't write the jq.rs code changes, so the manual migration PR remains the actual path either way.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.