Bump jsonschema from 4.17.3 to 4.18.3

[dependabot]

Bumps jsonschema from 4.17.3 to 4.18.3.

Release notes

Sourced from jsonschema's releases.

v4.18.3

Full Changelog: python-jsonschema/jsonschema@v4.18.2...v4.18.3

v4.18.2

• Fix an additional regression with the deprecated jsonschema.RefResolver and pointer resolution.

Full Changelog: python-jsonschema/jsonschema@v4.18.1...v4.18.2

v4.18.1

• Fix a regression with jsonschema.RefResolver based resolution when used in combination with a custom validation dialect (via jsonschema.validators.create).

Full Changelog: python-jsonschema/jsonschema@v4.18.0...v4.18.1

v4.18.0

What's Changed

This release majorly rehauls the way in which JSON Schema reference resolution is configured. It does so in a way that should be backwards compatible, preserving old behavior whilst emitting deprecation warnings.

• jsonschema.RefResolver is now deprecated in favor of the new referencing library. referencing will begin in beta, but already is more compliant than the existing $ref support. This change is a culmination of a meaningful chunk of work to make $ref resolution more flexible and more correct. Backwards compatibility should be preserved for existing code which uses RefResolver, though doing so is again now deprecated, and all such use cases should be doable using the new APIs. Please file issues on the referencing tracker if there is functionality missing from it, or here on the jsonschema issue tracker if you have issues with existing code not functioning the same, or with figuring out how to change it to use referencing. In particular, this referencing change includes a change concerning automatic retrieval of remote references (retrieving http://foo/bar automatically within a schema). This behavior has always been a potential security risk and counter to the recommendations of the JSON Schema specifications; it has survived this long essentially only for backwards compatibility reasons, and now explicitly produces warnings. The referencing library itself will not automatically retrieve references if you interact directly with it, so the deprecated behavior is only triggered if you fully rely on the default $ref resolution behavior and also include remote references in your schema, which will still be retrieved during the deprecation period (after which they will become an error).
• Support for Python 3.7 has been dropped, as it is nearing end-of-life. This should not be a "visible" change in the sense that requires-python has been updated, so users using 3.7 should still receive v4.17.3 when installing the library.
• On draft 2019-09, unevaluatedItems now properly does not consider items to be evaluated by an additionalItems schema if items is missing from the schema, as the specification says in this case that additionalItems must be completely ignored.
• Fix the date format checker on Python 3.11 (when format assertion behavior is enabled), where it was too liberal (#1076).
• Speed up validation of unevaluatedProperties (#1075).

Deprecations

• jsonschema.RefResolver -- see above for details on the replacement
• jsonschema.RefResolutionError -- see above for details on the replacement
• relying on automatic resolution of remote references -- see above for details on the replacement
• importing jsonschema.ErrorTree -- instead import it via jsonschema.exceptions.ErrorTree
• importing jsonschema.FormatError -- instead import it via jsonschema.exceptions.FormatError

... (truncated)

Changelog

Sourced from jsonschema's changelog.

v4.18.3

• Properly preserve applicable_validators in extended validators. Specifically, validators extending early drafts where siblings of $ref were ignored will properly ignore siblings in the extended validator.

v4.18.2

• Fix an additional regression with the deprecated jsonschema.RefResolver and pointer resolution.

v4.18.1

• Fix a regression with jsonschema.RefResolver based resolution when used in combination with a custom validation dialect (via jsonschema.validators.create).

v4.18.0

This release majorly rehauls the way in which JSON Schema reference resolution is configured. It does so in a way that should be backwards compatible, preserving old behavior whilst emitting deprecation warnings.

• jsonschema.RefResolver is now deprecated in favor of the new referencing library <https://github.com/python-jsonschema/referencing/>_. referencing will begin in beta, but already is more compliant than the existing $ref support. This change is a culmination of a meaningful chunk of work to make $ref resolution more flexible and more correct. Backwards compatibility should be preserved for existing code which uses RefResolver, though doing so is again now deprecated, and all such use cases should be doable using the new APIs. Please file issues on the referencing tracker if there is functionality missing from it, or here on the jsonschema issue tracker if you have issues with existing code not functioning the same, or with figuring out how to change it to use referencing. In particular, this referencing change includes a change concerning automatic retrieval of remote references (retrieving http://foo/bar automatically within a schema). This behavior has always been a potential security risk and counter to the recommendations of the JSON Schema specifications; it has survived this long essentially only for backwards compatibility reasons, and now explicitly produces warnings. The referencing library itself will not automatically retrieve references if you interact directly with it, so the deprecated behavior is only triggered if you fully rely on the default $ref resolution behavior and also include remote references in your schema, which will still be retrieved during the deprecation period (after which they will become an error).
• Support for Python 3.7 has been dropped, as it is nearing end-of-life. This should not be a "visible" change in the sense that requires-python has been updated, so users using 3.7 should still receive v4.17.3 when installing the library.
• On draft 2019-09, unevaluatedItems now properly does not consider items to be evaluated by an additionalItems schema if items is missing from the schema, as the specification says in this case that additionalItems must be completely ignored.
• Fix the date format checker on Python 3.11 (when format assertion behavior is enabled), where it was too liberal (#1076).
• Speed up validation of unevaluatedProperties (#1075).

Deprecations

• jsonschema.RefResolver -- see above for details on the replacement
• jsonschema.RefResolutionError -- see above for details on the replacement
• relying on automatic resolution of remote references -- see above for details on the replacement
• importing jsonschema.ErrorTree -- instead import it via jsonschema.exceptions.ErrorTree
• importing jsonschema.FormatError -- instead import it via jsonschema.exceptions.FormatError

Commits

• f79bad5 Properly preserve applicable_validators in extended validators.
• 52c2419 Fix an additional regression with RefResolver and pointer resolution.
• 90ea779 Fix a regression with RefResolver-based resolution in newly created drafts
• 56d57e7 Merge pull request #1122 from python-jsonschema/pre-commit-ci-update-config
• 6edfe24 [pre-commit.ci] pre-commit autoupdate
• 273d4dd Twewak the build noxenv again.
• 4817d36 Don't use nox.session.create_tmp.
• 7046da1 Make everywhere use the newer attrs APIs.
• e30b48e Minor grammar fix.
• 1fe3f9f Merge pull request #1111 from python-jsonschema/pre-commit-ci-update-config
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[DMRobertson]

In #15899 (comment) I suggested waiting to see if jsonschema settles down. It looks like some regressions have been fixed so this might be safe to land now.