v0.26.2

[0.26.2] - 2026-10-31

Security fix: CVE-2026-117680 / GHSA-cvmg-hgv6-jqcp. All users validating untrusted data against schemas with pattern or patternProperties should upgrade.

When a regex exhausted its backtracking budget, the match was reported as a non-match. Data that matches a pattern only after heavy backtracking could then skip patternProperties subschemas, be validated by additionalProperties instead, or pass a not: {pattern: ...} deny-list.

An exhausted budget is now an indeterminate result: validation stops and returns a JSV.ValidationError with a single error of kind indeterminate_pattern, which combinators cannot invert. Such data is now always rejected, even when it would match. If valid data gets rejected this way, rewrite the pattern without nested quantifiers or overlapping alternatives.

minLength and maxLength now count Unicode code points instead of grapheme clusters, as required by the specification. For instance "é" written as e followed by U+0301 now has a length of 2.

🐛 Bug Fixes

• Count minLength and maxLength in code points (#151) (Lars Hesel Christensen)
• Fail validation when a regex exhausts its backtracking budget (lud)

⚡ Performance

• Keep a single cast stack per data level (lud)
• Zip array items with their schemas without streams (#153) (Lars Hesel Christensen)

🧪 Testing

• Updated JSON Schema test suite (lud)
• Run stderr capturing tests synchronously (lud)