Upgrade Blaze to b2a390d819afd33f27dc17541703f37c228d58cf

[jviotti]

Signed-off-by: Juan Cruz Viotti jv@jviotti.com

[cubic-dev-ai]

1 issue found across 38 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="src/utils.h">

<violation number="1" location="src/utils.h:186">
P2: Checking `annotation.is_null()` drops valid `null` annotation values from trace output; use the entry type to decide whether to print annotation details.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

P2: Checking annotation.is_null() drops valid null annotation values from trace output; use the entry type to decide whether to print annotation details.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At src/utils.h, line 186:

<comment>Checking `annotation.is_null()` drops valid `null` annotation values from trace output; use the entry type to decide whether to print annotation details.</comment>

<file context>
@@ -175,13 +183,13 @@ inline auto print(const sourcemeta::blaze::TraceOutput &output,
     stream << " (" << entry.name << ")\n";
 
-    if (entry.annotation.has_value()) {
+    if (!entry.annotation.is_null()) {
       stream << "   value ";
 
</file context>

Suggested change

	if (!entry.annotation.is_null()) {
	if (entry.type == sourcemeta::blaze::TraceOutput::EntryType::Annotation) {

[augmentcode]

🤖 Augment PR Summary

Summary: Updates vendored Blaze/Core to newer commits, bringing evaluator/output refactors plus new Core utilities.

Changes:

• Bump Blaze and Core revisions in DEPENDENCIES (and Blaze’s vendored dependency list).
• Refactor Blaze evaluator into a header/templated dispatch implementation and simplify evaluator build sources.
• Switch Blaze TraceOutput from an iterable collector to a streaming callback-based tracer; update CLI validate/metaschema to pass a printing callback instead of calling print().
• Adjust/optimize SimpleOutput masking and trace buffering behavior.
• Rename Blaze type stringification helper to type_name in describe output.
• Upgrade Core: add a SemVer component/library, and rework HTML support around a streaming HTMLWriter/HTMLBuffer with new escape append helpers.
• Improve JSON Pointer utilities (resolve_from fast-path/reserve, and to_pointer parsing changes).

Technical Notes: Trace-mode output is now emitted during evaluation via a callback, changing how callers stream/format trace entries.

_{🤖 Was this summary useful? React with 👍 or 👎}

[augmentcode]

Review completed. 3 suggestions posted.

Comment augment review to trigger a new review at any time.

[augmentcode]

TraceOutput::Entry stores evaluate_path by reference, but in this branch it binds to the local effective_evaluate_path; if a callback stores the Entry (or takes references to its fields) it can dangle immediately after operator() returns. This looks like a potential UAF footgun unless the API explicitly guarantees entries never escape the callback.

Severity: medium

Other Locations

• vendor/blaze/src/output/include/sourcemeta/blaze/output_trace.h:66

_{🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.}

[augmentcode]

The !entry.annotation.is_null() guard will suppress output for an annotation whose actual value is JSON null; since EntryType::Annotation exists, relying on nullness here may hide real annotation entries.

Severity: low

_{🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.}

[augmentcode]

After HTMLBuffer::str() runs, cursor_ becomes null, so later append() calls will restart writing at the beginning of buffer_ (overwriting prior content) rather than appending. If str() is ever used mid-build (e.g., for incremental writes), this can corrupt output.

Severity: medium

_{🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.}