dependabot[bot] opened a new pull request, #28225: URL: https://github.com/apache/camel/pull/28225
Bumps [dev.toonformat:jtoon](https://github.com/toon-format/toon-java) from 2.0.7 to 3.0.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/toon-format/toon-java/releases";>dev.toonformat:jtoon's releases</a>.</em></p> <blockquote> <h2>v3.0.0</h2> <p>Release 3.0.0 — Java 21, CycloneDX 3.5.0</p> <h2>v2.0.8</h2> <p>Release 2.0.8</p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/toon-format/toon-java/blob/main/CHANGELOG.md";>dev.toonformat:jtoon's changelog</a>.</em></p> <blockquote> <h1>Changelog</h1> <p>All notable changes to this project will be documented in this file.</p> <p>This project adheres to Semantic Versioning and follows a Keep a Changelog-like format.</p> <h2>[Unreleased]</h2> <h2>[2.0.6] - 2026-10-07</h2> <h3>Changed</h3> <ul> <li>Conformance raised from spec 4.1.2 to <strong>4.3</strong>. The 23 conformance fixture files are byte-identical to the spec repository at <code>v4.3.0</code> (<code>dfbc459</code>, including the four pinned fixture cases).</li> <li><strong>Array-header classification follows §5.2 of spec 4.3</strong>: a line whose first unquoted <code>[</code> precedes its first unquoted colon must match the §6 grammar, or strict mode rejects it (<code>a[1:</code> with an unclosed bracket segment, <code>a[2:]{x}</code> without its colon) while non-strict decoders read it as a key-value line. Any whitespace – space, tab or NBSP – between a key and its bracket segment now prevents array-header interpretation (§5.2, §6, §14.2).</li> <li><strong>Non-strict decoding no longer returns <code>null</code> on invalid input.</strong> It applies the leniencies the spec names – such as count mismatches, indentation depth jumps and skipped over-indented lines – and throws <code>IllegalArgumentException</code> wherever the spec names none (§14).</li> </ul> <h3>Fixed</h3> <ul> <li> <p><strong>The encoder no longer drops nested arrays that mix primitives and objects</strong> inside list items.</p> </li> <li> <p><strong>A line without an unquoted colon is a scalar line, never a header</strong>, and a scalar line outside root primitive position is an error in any mode, including among skipped over-indented lines and as a root scalar followed by other lines (§5, §5.2, §14.2).</p> </li> <li> <p><strong>A <code>[</code>-led line without a well-formed header is a key-value line</strong>: a lone bracket stays part of the key, and in non-strict mode a malformed bracket segment such as <code>[03]</code> or <code>[invalid]</code> does too. An unclosed quote in an unquoted key opens a span to the end of the line, so no header follows it (§5.2, §6).</p> </li> <li> <p><strong>Non-strict mode adopts the depth of a jumped first line</strong> in objects, lists, tabular rows and keyed entries; an indented first line of the document is over-indented, <code>null</code> and <code>[]</code> included (§8, §14.2).</p> </li> <li> <p><strong>Strict mode rejects a blank line anywhere inside a list's span</strong> and an over-indented line under a list item, while non-strict mode keeps a list item's fields after a blank line (§12, §14.2).</p> </li> <li> <p><strong>A field list ends its header line</strong>: strict mode rejects inline content after it (<code>items[1]{a}: 1</code>) and a malformed keyless header (<code>[1]{a}}:</code>) instead of dropping what follows, and non-strict mode reads such a line as a key-value pair. A field list spanning the colon (<code>[1]{x:y}</code>) and a keyless header with a field list as a list item (<code>- [1]{a}:</code>) are strict-mode errors that non-strict decoders read as key-value pairs (§6, §14.2).</p> </li> <li> <p><strong><code>maxArraySize</code> bounds the actual element count</strong> of inline, list, tabular and keyed forms in either mode; only the comparison with the declared <code>[N]</code> stays strict-only.</p> </li> <li> <p><strong>Header parsing:</strong> empty field entries and malformed nested field groups are rejected, a length beyond the <code>long</code> range still forms a header, and a line below a bare <code>key[N]:</code> header carries no values (§6, §9).</p> </li> <li> <p><strong>Key and value tokens:</strong> <code>: 1</code> decodes as the empty key, <code>\uXXXX</code> escapes with a surrogate or a non-ASCII digit are rejected, a carriage return before CRLF is content, a backslash outside quotes is a literal character (<code>a\: b</code> has the key <code>a\</code>), a list ends at a hyphen without a following space, and tabular rows sit exactly one level below their header in strict mode (§7, §9, §12).</p> </li> <li> <p><strong>Documentation code examples corrected:</strong> array headers no longer carry an invalid comma (<code>users[2]{id,name}</code> — comma is implied), tab-delimited examples contain real tab characters instead of spaces, the pipe tabular header declares its field list with pipes (<code>users[2|]{id|name}</code>), the multi-value value catalogs are valid inline arrays, and the README tab output matches the encoder byte-for-byte.</p> </li> </ul> <h2>[2.0.5] - 2026-10-03</h2> <h3>Fixed</h3> <ul> <li><strong>Token trimming is now exactly U+0020</strong>, as §12 requires. <code>String.trim()</code>, <code>String.isBlank()</code> and <code>String.stripTrailing()</code> also removed tabs and control characters, so <code>key: value<tab></code> decoded as <code>value</code>, and <code>key: "a"<tab></code> was accepted even though §7.4 requires the quoted token to end with its closing quote. A trailing tab at the end of a line is now line content. A single U+FEFF at the very start of a document is still stripped as a byte-order mark (§12).</li> <li><strong>Any character after the closing quote of a quoted token is now rejected in key position</strong> as well as in value position (§7.4).</li> <li><strong>Root-form discovery starts at the first non-blank line</strong> instead of assuming line 0, so a document with leading blank lines is no longer misparsed (§5).</li> <li><strong>An unquoted key token may contain spaces.</strong> <code>foo bar[2]: 1,2</code> now decodes with the literal key <code>foo bar</code>, which §7.4 requires of decoders. Whitespace between a key and its bracket segment (<code>foo [2]:</code>) remains a header syntax error (§6, §14.2).</li> <li><strong>A root string value starting with U+FEFF is now quoted</strong>, as §7.2 requires; unquoted, a conforming decoder would strip it as a byte-order mark and silently lose the character (§12). This is the one normative behaviour change in spec 4.1.2.</li> </ul> <h3>Changed</h3> <ul> <li>Conformance raised from spec 4.1.1 to <strong>4.1.2</strong>, which is a single normative change: a root primitive starting with U+FEFF must be quoted (§7.2). On top of that, decoder strictness was tightened in five places where the implementation accepted input the spec rejects — token trimming, quoted-token boundaries, root-form discovery, header key tokens and the <code>[N]</code> length marker. The full conformance suite from 4.1 (canonical number formatting, BOM stripping, comment pre-pass §5.1, strict header validation §5/§6/§7.3/§7.4, nested field groups in tabular arrays §9.3, keyed tabular form §9.5/§10, non-strict tab leniency §12) carries over unchanged and remains green. The 23 conformance fixture files are byte-identical to the spec repository at tag <code>v4.1.2</code>.</li> <li>Upstream [PR <a href="https://redirect.github.com/toon-format/toon-java/issues/201";>#201</a>](<a href="https://redirect.github.com/toon-format/toon-java/pull/201";>toon-format/toon-java#201</a>) integrated (squash merge). Conflicts in <code>KeyDecoder</code>, <code>ListItemDecoder</code> and <code>ValueDecoder</code> were resolved additively, keeping both the <code>validateQuotedTokenBoundary</code> check from <a href="https://redirect.github.com/toon-format/toon-java/issues/201";>#201</a> and the <code>validateKeyHasNoUnquotedBrackets</code> check from <a href="https://redirect.github.com/toon-format/toon-java/issues/200";>#200</a>. <code>DecodeHelper.trimSpaces()</code> remains the canonical token trimmer.</li> <li>The targeted specification version is now declared as <code>toon-spec: 4.1.2</code> in the README, as §13 recommends.</li> </ul> <h3>Documentation</h3> <ul> <li><code>README.md</code>: spec badge updated to v4.1.2; corrected a stale quick-start example that showed the non-conforming legacy empty-array form <code>preferences[0]:</code> instead of <code>preferences: []</code> (§9.1).</li> <li><code>docs/FORMAT.md</code> audited against the spec and corrected. The most serious defect was a flat contradiction: the document stated <em>"TOON does not support comments"</em>, while §5.1 defines full-line comments and the decoder has always implemented the comment pre-pass. Also corrected: empty arrays (§9.1, was the stale <code>items[0]:</code> form), number notation (§2, was stated as an absolute MUST where the spec only requires canonical decimal inside the canonical range and permits exponent notation outside it), nested-uniform tabular columns (§9.3), decoder key permissiveness (§7.4), and the quoting triggers for a leading <code>-</code> or <code>#</code> and for a root primitive starting with U+FEFF (§7.2).</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/toon-format/toon-java/commit/aaee6f5b4ad99eed7c90e96f4c5fdb6f44810dde";><code>aaee6f5</code></a> keep xml-input.md, add 3.0.0 release</li> <li><a href="https://github.com/toon-format/toon-java/commit/e783e4a2b251be73793ba882811986a7b250ee75";><code>e783e4a</code></a> remove .omo and .out-of-scope</li> <li><a href="https://github.com/toon-format/toon-java/commit/5dc5edc102d9fe0f19dafe4b7ba0cb1f6975d3dd";><code>5dc5edc</code></a> auto: update dependency verification metadata [skip ci]</li> <li><a href="https://github.com/toon-format/toon-java/commit/b4eaf5308fdfce3e5f79027136006fd653b6970f";><code>b4eaf53</code></a> java 21 + cyclonedx 3.5.0</li> <li><a href="https://github.com/toon-format/toon-java/commit/010d8b4d7bca69f8b044cb64e5187a01680f2681";><code>010d8b4</code></a> java 21 on main</li> <li><a href="https://github.com/toon-format/toon-java/commit/9289f21a9dd21f2e951e803a59e42adb24da0471";><code>9289f21</code></a> docs: update version to 2.0.8 in README</li> <li><a href="https://github.com/toon-format/toon-java/commit/2ae262c774520e80489c70c5c4bfb150096d8c01";><code>2ae262c</code></a> refactor: drop decoder paths that spec 4.4 made unreachable (<a href="https://redirect.github.com/toon-format/toon-java/issues/221";>#221</a>)</li> <li><a href="https://github.com/toon-format/toon-java/commit/2acf9a601515b5e015ede002128b52b6d22a39ee";><code>2acf9a6</code></a> docs: update version to 2.0.7 in README</li> <li>See full diff in <a href="https://github.com/toon-format/toon-java/compare/v2.0.7...v3.0.0";>compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
