deps(deps): bump jsonschema from 0.47.0 to 0.49.9

[dependabot]

Bumps jsonschema from 0.47.0 to 0.49.9.

Release notes

Sourced from jsonschema's releases.

[Python] Release 0.49.9

Added

• Canonicalization of a oneOf whose branches name object targets a required constant tells apart, which degrades to a union.

Changed

• CanonicalSchema.to_json_schema on a definition emits only the definitions that one names, not the whole document's.

Fixed

• Canonicalization running without end on a conjunction over unions; past a ceiling on the meets it takes, the document stays unmodeled.

[Ruby] Release 0.49.9

Added

• Canonicalization of a oneOf whose branches name object targets a required constant tells apart, which degrades to a union.

Changed

• CanonicalSchema#to_json_schema on a definition emits only the definitions that one names, not the whole document's.

Fixed

• Canonicalization running without end on a conjunction over unions; past a ceiling on the meets it takes, the document stays unmodeled.

[Rust] Release 0.49.9

Added

• Canonicalization of a oneOf whose branches name object targets a required constant tells apart, which degrades to a union.

Changed

• CanonicalSchema::to_json_schema on a definition emits only the definitions that one names, not the whole document's.

Fixed

• Canonicalization running without end on a conjunction over unions; past a ceiling on the meets it takes, the document stays unmodeled.

[Python] Release 0.49.8

Performance

• Up to 380x faster canonicalization of a oneOf whose overlapping branches carry many properties, which no longer removes shared regions the exactly-one spelling discards.

Fixed

• Draft detection treating the version-less http://json-schema.org/schema meta-schema URI as a custom dialect, where it names the current draft.
• A patternProperties entry matching every key leaving additionalProperties: false spelled as a key constraint, where it forbids nothing.

[Ruby] Release 0.49.8

... (truncated)

Changelog

Sourced from jsonschema's changelog.

[0.49.9] - 2026-08-09

Added

• Canonicalization of a oneOf whose branches name object targets a required constant tells apart, which degrades to a union.

Changed

• CanonicalSchema::to_json_schema on a definition emits only the definitions that one names, not the whole document's.

Fixed

• Canonicalization running without end on a conjunction over unions; past a ceiling on the meets it takes, the document stays unmodeled.

[0.49.8] - 2026-08-08

Performance

• Up to 380x faster canonicalization of a oneOf whose overlapping branches carry many properties, which no longer removes shared regions the exactly-one spelling discards.

Fixed

• Draft detection treating the version-less http://json-schema.org/schema meta-schema URI as a custom dialect, where it names the current draft.
• A patternProperties entry matching every key leaving additionalProperties: false spelled as a key constraint, where it forbids nothing.
• unevaluatedProperties/unevaluatedItems set to true forcing the whole document to stay unmodeled beside an unresolved applicator, where the keyword rejects nothing regardless of the evaluated set.
• unevaluatedProperties/unevaluatedItems beside a $ref forcing the whole document to stay unmodeled, where the reference's own evaluated properties or items are known once it is resolved.

[0.49.7] - 2026-08-07

Added

• CanonicalizeOptions::with_retriever to fetch external resources absent from the registry.
• CanonicalizeOptions::with_base_uri to resolve relative references in the root schema.
• Canonicalization of a oneOf whose branches name disjoint targets, which degrades to a union.
• Canonicalization of a vacuous patternProperties entry beside schema-valued additionalProperties, where matching keys escape its value constraint.
• Canonicalization of a Draft 4 closed pattern map with a reference nested under a property.
• Canonicalization of Draft 4 closed pattern maps that meet through an applicator.
• The complement of a reference back to a target already being negated, which stays symbolic instead of declining.
• CanonicalSchema::definition resolving # to the document the handle was read against.

Performance

• Up to 150x faster canonicalization of not over a union of many branches.
• 2% faster emission of canonical schemas, which no longer formats copied string values.
• 5% faster emission of canonical schemas, which no longer formats object keys while copying them.
• Up to 12% faster canonicalization of schemas that repeatedly intersect the same branches.
• 13% faster canonicalization of a non-dynamic OpenAPI document, which no longer scans every schema object for dynamic references.
• Faster canonicalization of schemas with local $defs references, which avoid decoding unescaped definition names.
• 23% faster canonicalization of an object whose keys a finite property-name set spells.
• 3% faster intersection of schemas where one side constrains nothing.

... (truncated)

Commits

• 07484f9 chore(ruby): Release 0.49.9
• 4aba49f chore(python): Release 0.49.9
• 4ad1722 chore(rust): Release 0.49.9
• 0f114ee fix: Canonicalization running without end on a conjunction over unions; past ...
• 8d4d60c chore: CanonicalSchema::to_json_schema on a definition emits only the defin...
• bed4553 feat: Canonicalization of a oneOf whose branches name object targets a requ...
• 0c310f4 chore(ruby): Release 0.49.8
• bd6836d chore(python): Release 0.49.8
• 71de156 chore(rust): Release 0.49.8
• a90819b feat: Extend support for unevaluated* keywords in canonicalization
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: rust. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[github-actions]

🔍 The Case of Pull Request #784

Schema Sets

• ecommerce
• reference

Schema Set ecommerce

Plain-English Readout

• Holmes (evidence investigation): The Holmes report is unavailable because the workflow finished without a readable holmes-report.json artifact.
• Watson (independent verification): The Watson report is unavailable because the workflow finished without a readable watson-report.json artifact.
• Moriarty (trend forecast): The Moriarty forecast is unavailable because the workflow finished without a readable moriarty-report.json artifact.

Suggested next actions

1. Regenerate the HOLMES artifacts and make sure holmes-report.json is uploaded before trusting this PR summary.
2. Regenerate the WATSON artifacts and make sure watson-report.json is uploaded before trusting this PR summary.
3. Regenerate the MORIARTY artifacts and make sure moriarty-report.json is uploaded before trusting this PR summary.

🕵️ SHA-lock HOLMES full report for ecommerce (click to expand)

Report unavailable for holmes: readable holmes-report.md artifact not found.

🩺 Dr. WATSON full report for ecommerce (click to expand)

Report unavailable for watson: readable watson-report.md artifact not found.

🔮 Professor MORIARTY full report for ecommerce (click to expand)

Report unavailable for moriarty: readable moriarty-report.md artifact not found.

---

Schema Set reference

Plain-English Readout

• Holmes (evidence investigation): The Holmes report is unavailable because the workflow finished without a readable holmes-report.json artifact.
• Watson (independent verification): The Watson report is unavailable because the workflow finished without a readable watson-report.json artifact.
• Moriarty (trend forecast): The Moriarty forecast is unavailable because the workflow finished without a readable moriarty-report.json artifact.

Suggested next actions

1. Regenerate the HOLMES artifacts and make sure holmes-report.json is uploaded before trusting this PR summary.
2. Regenerate the WATSON artifacts and make sure watson-report.json is uploaded before trusting this PR summary.
3. Regenerate the MORIARTY artifacts and make sure moriarty-report.json is uploaded before trusting this PR summary.

🕵️ SHA-lock HOLMES full report for reference (click to expand)

Report unavailable for holmes: readable holmes-report.md artifact not found.

🩺 Dr. WATSON full report for reference (click to expand)

Report unavailable for watson: readable watson-report.md artifact not found.

🔮 Professor MORIARTY full report for reference (click to expand)

Report unavailable for moriarty: readable moriarty-report.md artifact not found.

---

📚 Glossary (what the Holmes terms mean)

• HOLMES: Wesley’s main evidence investigation. It decides whether the cited proof is strong enough to justify shipping this commit.
• WATSON: An independent verification pass. It checks Holmes’s citations and score math instead of trusting them blindly.
• MORIARTY: A readiness forecast over time. It is advisory trend analysis, not the release gate itself.
• Schema coverage score (SCS): How much of the schema has direct supporting evidence across generated artifacts and cited proof.
• Test confidence index (TCI): How much test evidence exists for constraints, policies, relationships, and operations.
• Migration risk index (MRI): How risky the schema change is to roll out. Lower is better.
• Evidence trust: Whether the report is backed by exact citations, whole-file citations, or coarse references. Weak trust means the claim may be directionally right but not specific enough to trust blindly.
• Citation quality: A count of exact line-span citations versus whole-file or coarse references.
• ELEMENTARY: Ready to ship based on the current evidence.
• REQUIRES INVESTIGATION: More work or review is needed before shipping.
• YOU SHALL NOT PASS: Do not ship this change in its current state.

---

Machine-readable reports are grouped by schema set in workflow artifacts.

---

Filed at 221B Repository Street