[dependabot]

Updates the requirements on softcreatr/jsonpath to permit the latest version.

Release notes

Sourced from softcreatr/jsonpath's releases.

2.1.0

• Added the RFC 9535 length(), count(), match(), search(), and value() function extensions.
• Added a dedicated expression parser and static type checker for function expressions; malformed and ill-typed expressions are rejected without evaluating user-controlled PHP code.
• Added checked RFC 9485 I-Regexp support for full-string and substring matching, with PCRE resource limits.

Changelog

Sourced from softcreatr/jsonpath's changelog.

2.1.0

• Added the RFC 9535 length(), count(), match(), search(), and value() function extensions.
• Added a dedicated expression parser and static type checker for function expressions; malformed and ill-typed expressions are rejected without evaluating user-controlled PHP code.
• Added checked RFC 9485 I-Regexp support for full-string and substring matching, with PCRE resource limits.

2.0.0

🔻 Breaking changes ahead:

• Aligned every current result with the JSONPath comparison consensus or majority.
• Tightened selector parsing so malformed or ambiguous syntax is rejected instead of being interpreted as another query. This removes unquoted bracket members, quoted dot members, empty selectors, incomplete recursive descent, script expressions, mixed wildcard/filter unions, and synthetic .length handling.
• Restricted filter operators to portable comparisons (==, !=, <, <=, >, >=) and logical expressions; legacy single/strict equality, regex, membership, arithmetic, literal-only truth tests, array/object comparison literals, and function-like expressions are now unsupported.
• Fixed filters over objects to return node lists, added descendant and nested-filter existence tests, distinguished missing nodes from JSON null, and corrected missing-member/path-to-path comparisons.
• Lowered the minimum PHP version from 8.5 to the verified PHP 8.3 floor and expanded CI to PHP 8.3 through 8.6, including the PHP 8.6 nightly.
• Kept the PHPUnit suite at 100% class, method, and line coverage for the stricter behavior.

1.0.2

• Fixed tokenizer handling for quoted bracket keys containing $ so literals like ['[$the.size$]'] remain atomic and do not split into root tokens.

1.0.1

• Aligned the query runner and lexer with the JSONPath comparison suite: JSON documents are now decoded as objects to preserve {} vs [], unsupported selectors no longer abort the runner, and dot-notation now accepts quoted keys with dots/spaces/leading @.
• Hardened filter parsing: boolean-only filters (?(true|false|null)), literal short-circuiting (&& false, || true), and empty filters now return the expected collections instead of throwing.
• Slice filters gracefully skip non-countable objects.

1.0.0

• Rebuilt the test suite from scratch: removed bulky baseline fixtures and added compact unit/integration coverage for every filter (index, union, query, recursive, slice), lexer edge cases, and JSONPath core helpers. Runs reflection-free and deprecation-free.
• Achieved and enforced 100% code coverage across AccessHelper, all filters, lexer, tokens, and JSONPath core while keeping phpstan and coding standards clean.
• Added a lightweight manual query runner with curated examples to exercise selectors quickly without external datasets.
• Major compatibility push toward the unofficial JSONPath standard: unions support slices/queries/wildcards, trailing commas parse correctly, negative indexes and bracket-escaped keys (quotes, brackets, wildcards, special chars) are honored, filters compare path-to-path and root references, equality/deep-equality/regex/in/nin semantics align with expectations, and null existence/value handling follows RFC behavior.
• New feature highlights from this cycle:
  • Multi-key unions with and without quotes: $[name,year] and $["name","year"].
  • Robust bracket notation for special/escaped keys, including ']', '*', $, backslashes, and mixed punctuation.
  • Trailing comma support in unions/slices (e.g. $..books[0,1,2,]).
  • Negative index handling aligned with spec (short arrays return empty; -1 works where valid).
  • Filter improvements: path-to-path/root comparisons, deep equality across scalars/objects/arrays/null/empties, regex matching, in/nin/!in, tautological expressions, and ?@ existence behavior per RFC.
  • Unions combining slices/queries/wildcards now return complete results (e.g. $[1:3,4], $[*,1]).

0.11.0

🔻 Breaking changes ahead:

• Dropped support for PHP < 8.5
• JSONPathToken now uses a TokenType enum and the constructor signature changed accordingly.
• JSONPath options flag is now an int bitmask (was bool), requiring callers to pass integer flags.
• SliceFilter returns an empty result for non-positive step values (previously iterated indefinitely).
• QueryResultFilter now throws a JSONPathException for unsupported operators instead of silently proceeding.
• Access helper behavior is stricter: arrayValues throws on invalid types; ArrayAccess lookups check offsetExists before reading; traversables and objects are handled distinctly.
• Adopted PHP 8.5 features: TokenType enum, readonly value object for tokens, typed flags/options, and #[\Override] usage.
• CI now runs on PHP 8.5 with required extensions; code style workflow updated accordingly.
• Added coverage for AccessHelper edge cases (magic getters, ArrayAccess, traversables, negative indexes), QueryResultFilter arithmetic branches, and SliceFilter negative/null bounds.
• Fixed empty-expression handling in lexer and improved safety in AccessHelper traversable lookups.

... (truncated)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)