.github/workflows/ci.yml

@@ -2,44 +2,41 @@ name: CI
 
 on:
   push:
+    branches-ignore:
+      - "wip*"
+    tags:
+      - "v*"
   pull_request:
-  release:
-    types: [published]
   schedule:
     # Daily at 3:21
     - cron: "21 3 * * *"
+  workflow_dispatch:
 
-env:
-  PIP_DISABLE_PIP_VERSION_CHECK: "1"
-  PIP_NO_PYTHON_VERSION_WARNING: "1"
+permissions: {}
 
 jobs:
-  pre-commit:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
-        with:
-          python-version: "3.x"
-      - uses: pre-commit/action@v3.0.0
-
   list:
     runs-on: ubuntu-latest
     outputs:
       noxenvs: ${{ steps.noxenvs-matrix.outputs.noxenvs }}
     steps:
       - uses: actions/checkout@v4
-      - name: Set up nox
-        uses: wntrblm/nox@2023.04.22
+        with:
+          persist-credentials: false
+      - name: Set up uv
+        uses: astral-sh/setup-uv@f0ec1fc3b38f5e7cd731bb6ce540c5af426746bb
+        with:
+          enable-cache: ${{ github.ref_type != 'tag' }} # zizmor: ignore[cache-poisoning]
       - id: noxenvs-matrix
         run: |
           echo >>$GITHUB_OUTPUT noxenvs=$(
-            nox --list-sessions --json | jq '[.[].session]'
+            uvx nox --list-sessions --json | jq '[.[].session]'
           )
 
   ci:
     needs: list
     runs-on: ${{ matrix.os }}
+
     strategy:
       fail-fast: false
       matrix:
@@ -48,12 +45,24 @@ jobs:
         posargs: [""]
         include:
           - os: ubuntu-latest
-            noxenv: "tests-3.11(format)"
+            noxenv: "tests-3.13(format)"
             posargs: coverage github
           - os: ubuntu-latest
-            noxenv: "tests-3.11(no-extras)"
+            noxenv: "tests-3.13(no-extras)"
             posargs: coverage github
         exclude:
+          - os: macos-latest
+            noxenv: "docs(dirhtml)"
+          - os: macos-latest
+            noxenv: "docs(doctest)"
+          - os: macos-latest
+            noxenv: "docs(linkcheck)"
+          - os: macos-latest
+            noxenv: "docs(man)"
+          - os: macos-latest
+            noxenv: "docs(spelling)"
+          - os: macos-latest
+            noxenv: "docs(style)"
           - os: windows-latest
             noxenv: "docs(dirhtml)"
           - os: windows-latest
@@ -67,6 +76,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - name: Install dependencies
         run: sudo apt-get update && sudo apt-get install -y libenchant-2-dev
         if: runner.os == 'Linux' && startsWith(matrix.noxenv, 'docs')
@@ -77,27 +88,32 @@ jobs:
         uses: actions/setup-python@v5
         with:
           python-version: |
-            3.8
             3.9
             3.10
             3.11
             3.12
-            pypy3.10
+            3.13
+            pypy3.11
           allow-prereleases: true
-      - name: Set up nox
-        uses: wntrblm/nox@2023.04.22
       - name: Enable UTF-8 on Windows
         run: echo "PYTHONUTF8=1" >> $env:GITHUB_ENV
         if: runner.os == 'Windows' && startsWith(matrix.noxenv, 'tests')
+
+      - name: Set up uv
+        uses: astral-sh/setup-uv@f0ec1fc3b38f5e7cd731bb6ce540c5af426746bb
+        with:
+          enable-cache: true
+
       - name: Run nox
-        run: nox -s "${{ matrix.noxenv }}" -- ${{ matrix.posargs }}
+        run: uvx nox -s "${{ matrix.noxenv }}" -- ${{ matrix.posargs }} # zizmor: ignore[template-injection]
 
   packaging:
     needs: ci
     runs-on: ubuntu-latest
     environment:
       name: PyPI
       url: https://pypi.org/p/jsonschema
+
     permissions:
       contents: write
       id-token: write
@@ -106,20 +122,21 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-      - name: Set up Python
-        uses: actions/setup-python@v5
+          persist-credentials: false
+      - name: Set up uv
+        uses: astral-sh/setup-uv@f0ec1fc3b38f5e7cd731bb6ce540c5af426746bb
         with:
-          python-version: "3.x"
-      - name: Install dependencies
-        run: python -m pip install build
-      - name: Create packages
-        run: python -m build .
+          enable-cache: true
+
+      - name: Build our distributions
+        run: uv run --with 'build[uv]' -m build --installer=uv
+
       - name: Publish to PyPI
         if: github.event_name == 'push' && startsWith(github.event.ref, 'refs/tags')
-        uses: pypa/gh-action-pypi-publish@release/v1
-      - name: Create a Release
+        uses: pypa/gh-action-pypi-publish@76f52bc884231f62b9a034ebfe128415bbaabdfc
+      - name: Create a GitHub Release
         if: github.event_name == 'push' && startsWith(github.event.ref, 'refs/tags')
-        uses: softprops/action-gh-release@v1
+        uses: softprops/action-gh-release@da05d552573ad5aba039eaac05058a918a7bf631
         with:
           files: |
             dist/*

.github/workflows/documentation-links.yml

@@ -1,6 +1,6 @@
 name: Read the Docs Pull Request Preview
 on:
-  pull_request_target:
+  pull_request_target: # zizmor: ignore[dangerous-triggers]
     types:
       - opened
 
@@ -11,6 +11,6 @@ jobs:
   documentation-links:
     runs-on: ubuntu-latest
     steps:
-      - uses: readthedocs/actions/preview@v1
+      - uses: readthedocs/actions/preview@b8bba1484329bda1a3abe986df7ebc80a8950333
         with:
           project-slug: "python-jsonschema"

.github/workflows/zizmor.yml

@@ -0,0 +1,35 @@
+name: GitHub Actions Security Analysis with zizmor 🌈
+
+on:
+  push:
+    branches: ["main"]
+  pull_request:
+    branches: ["**"]
+
+jobs:
+  zizmor:
+    name: Run zizmor
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@f0ec1fc3b38f5e7cd731bb6ce540c5af426746bb
+
+      - name: Run zizmor 🌈
+        run: uvx zizmor --format=sarif .github > results.sarif
+
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Upload SARIF file
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: results.sarif
+          category: zizmor

.gitignore

@@ -1,3 +1,9 @@
+/TODO*
+/dirhtml/
+_cache
+_static
+_templates
+
 # Byte-compiled / optimized / DLL files
 __pycache__/
 *.py[cod]
@@ -150,8 +156,3 @@ cython_debug/
 #  and can be added to the global gitignore or merged into this file.  For a more nuclear
 #  option (not recommended) you can uncomment the following to ignore the entire idea folder.
 #.idea/
-
-# User defined
-_cache
-_static
-_templates

.pre-commit-config.yaml

@@ -2,7 +2,7 @@ exclude: json/
 
 repos:
   - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v4.5.0
+    rev: v5.0.0
     hooks:
       - id: check-ast
       - id: check-json
@@ -16,16 +16,7 @@ repos:
         args: [--fix, lf]
       - id: trailing-whitespace
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: "v0.1.13"
+    rev: "v0.11.13"
     hooks:
       - id: ruff
         args: [--fix, --exit-non-zero-on-fix]
-  - repo: https://github.com/PyCQA/isort
-    rev: 5.13.2
-    hooks:
-      - id: isort
-  - repo: https://github.com/pre-commit/mirrors-prettier
-    rev: "v4.0.0-alpha.8"
-    hooks:
-      - id: prettier
-        exclude: "^jsonschema/benchmarks/issue232/issue.json$"

CHANGELOG.rst

@@ -1,3 +1,21 @@
+v4.24.0
+=======
+
+* Fix improper handling of ``unevaluatedProperties`` in the presence of ``additionalProperties`` (#1351).
+* Support for Python 3.8 has been dropped, as it is end-of-life.
+
+v4.23.0
+=======
+
+* Do not reorder dictionaries (schemas, instances) that are printed as part of validation errors.
+* Declare support for Py3.13
+
+v4.22.0
+=======
+
+* Improve ``best_match`` (and thereby error messages from ``jsonschema.validate``) in cases where there are multiple *sibling* errors from applying ``anyOf`` / ``allOf`` -- i.e. when multiple elements of a JSON array have errors, we now do prefer showing errors from earlier elements rather than simply showing an error for the full array (#1250).
+* (Micro-)optimize equality checks when comparing for JSON Schema equality by first checking for object identity, as ``==`` would.
+
 v4.21.1
 =======
 

README.rst

@@ -134,8 +134,6 @@ I'm Julian Berman.
 
 Get in touch, via GitHub or otherwise, if you've got something to contribute, it'd be most welcome!
 
-You can also generally find me on Libera (nick: ``Julian``) in various channels, including ``#python``.
-
 If you feel overwhelmingly grateful, you can also `sponsor me <https://github.com/sponsors/Julian/>`_.
 
 And for companies who appreciate ``jsonschema`` and its continued support and growth, ``jsonschema`` is also now supportable via `TideLift <https://tidelift.com/subscription/pkg/pypi-jsonschema?utm_source=pypi-jsonschema&utm_medium=referral&utm_campaign=readme>`_.

docs/conf.py

@@ -123,19 +123,23 @@ def entire_domain(host):
 
 autosectionlabel_prefix_document = True
 
+# -- intersphinx --
+
+intersphinx_mapping = {
+    "python": ("https://docs.python.org/3", None),
+    "referencing": ("https://referencing.readthedocs.io/en/stable/", None),
+}
+
 # -- extlinks --
 
 extlinks = {
     "ujs": ("https://json-schema.org/understanding-json-schema%s", None),
 }
 extlinks_detect_hardcoded_links = True
+# -- sphinx-copybutton --
 
-# -- intersphinx --
-
-intersphinx_mapping = {
-    "python": ("https://docs.python.org/3", None),
-    "referencing": ("https://referencing.readthedocs.io/en/stable/", None),
-}
+copybutton_prompt_text = r">>> |\.\.\. |\$"
+copybutton_prompt_is_regexp = True
 
 # -- sphinxcontrib-spelling --
 

docs/errors.rst

@@ -216,8 +216,8 @@ easier debugging.
     3 is not valid under any of the given schemas
 
     Failed validating 'anyOf' in schema['items']:
-        {'anyOf': [{'maxLength': 2, 'type': 'string'},
-                   {'minimum': 5, 'type': 'integer'}]}
+        {'anyOf': [{'type': 'string', 'maxLength': 2},
+                   {'type': 'integer', 'minimum': 5}]}
 
     On instance[1]:
         3