Skip to content

Fix/build issues#71

Open
bbqsrc wants to merge 3 commits intomainfrom
fix/build-issues
Open

Fix/build issues#71
bbqsrc wants to merge 3 commits intomainfrom
fix/build-issues

Conversation

@bbqsrc
Copy link
Copy Markdown
Member

@bbqsrc bbqsrc commented Apr 23, 2026

No description provided.

bbqsrc added 3 commits April 23, 2026 14:41
Runtime composition silently returned no suggestions when an input
grapheme wasn't explicitly present in the error-model (mutator)
alphabet — as with regex-built "festschrift" error models that define
only the reduced alphabet they actively target. Fixes lang-sma#160.

Two layered causes:

1. `consume_input` tried to fall back to the mutator's identity/unknown
   wildcards only when `input_sym >= mutator.alphabet().initial_symbol_count()`.
   That condition never fires: the mutator's alphabet isn't extended by
   `create_translator_from`, and `to_input_vec` encodes missing graphemes
   as the mutator's own UNKNOWN marker (an in-range value). Switch the
   gate to "input symbol is the mutator's UNKNOWN marker", which is the
   case the fallback was actually written for.

2. When the mutator then emits an identity/unknown pass-through symbol,
   `queue_mutator_arcs` used the alphabet translator on that symbol and
   fed the resulting synthetic lexicon index into the lexicon walk. With
   a compact mutator the synthetic index doesn't match the lexicon's
   explicit arcs (e.g. `Z` in the acceptor), so the walk dies. Carry a
   lexicon-alphabet copy of the input (`lexicon_input`) on the worker
   and, for pass-through emissions, walk the lexicon with the real
   lexicon symbol for the current grapheme.

`analyze_output_form` now builds its throwaway worker via
`new_lexicon_input` (it only walks the lexicon) so the lexicon_input
field has a sensible value without a second encoding pass.

Verified end-to-end with the issue's test bundle:
  Zealaantesnie / Zealaantie now surface Zealaantesne / Zealaanti
  with the festschrift error model. `bijre` and
  `ööpehtimmieprogramminie` (already working) unaffected. The default
  error model path is unchanged (top suggestion at the same weight).
Linux build was broken inside the box-format transitive dep:

    error[E0433]: cannot find module or crate `xattr`
     --> .../box/src/sync/reader.rs:711
          let _ = xattr::set(&new_file, xattr_name, value);

box-format's sync/reader.rs guarded `xattr::set` only with
`#[cfg(target_os = "linux")]`, but the `xattr` crate is an optional dep
controlled by the `xattr` feature. Downstreams that disable default
features and don't opt in — like divvunspell — failed on Linux.
src/fs.rs in the same crate already does it right with
`all(feature = "xattr", target_os = "linux")`.

Pin box-format at bbqsrc/box@c098064, which fixes the cfg gate (69de7b1)
and bumps lru to 0.17 to clear GHSA-... (IterMut Stacked Borrows
violation in lru < 0.16.3, transitive dep via box-format).

Also:

- Refresh workspace deps to current patch/minor versions: memmap2,
  byteorder, serde, serde_json, zip, hashbrown, smol_str, thiserror,
  tempfile, fs_extra, tracing, clap, csv, rayon, indicatif, jni.
- Adapt src/archive/zip.rs to zip 8.x, where
  `ZipFileData::data_start()` now returns `Option<u64>`.
- Port ffi/java-jni/src/lib.rs to jni 0.22:
  * Entry points receive `EnvUnowned<'local>` instead of `JNIEnv`;
    bodies that touch env are wrapped in
    `env.with_env(|env| … ).resolve::<ThrowRuntimeExAndDefault>()`.
  * `JavaStr::from_env` → `JString::mutf8_chars`; `into_raw` now yields
    `(ptr, is_copy)`, so `CWordContext._handles` carries the is_copy
    flag and `MUTF8Chars::from_raw(env, obj, ptr, is_copy)` replaces
    the old 3-arg release.
  * `env.get_string(&jstring)` → `jstring.try_to_string(env)` (old
    method is deprecated).
  * `throw_new` requires `AsRef<JNIStr>`: class names use `jni_str!(…)`
    at compile time; dynamic messages wrap in `JNIString::from(format!)`.
  * `jboolean` is `bool` in jni-sys 0.4, so early-return `0` becomes
    `false`.

Behaviour is unchanged: same exception classes and messages, same 27
`Java_*` symbols exported from the cdylib, all 107 integration tests
still green.
Svelte 3.59 and @rollup/plugin-terser 0.4 pulled in a pile of known
vulnerabilities (all dev-only, in a non-shipped internal tool):

- svelte: mXSS, SSR-spread prototype leaks, XSS via `bind:innerText` /
  `bind:textContent`, unvalidated `<svelte:element>` tag names, XSS via
  SSR spread attributes (GHSA-8266-84wp-wv5c, -crpf-4hrx-3jrp,
  -phwv-c562-gvmh, -m56q-vw4c-c2cp, -f7gr-6p89-r883)
- @rollup/plugin-terser → serialize-javascript: RCE via RegExp.flags
  and Date.prototype.toISOString, CPU-exhaustion DoS via array-like
  objects (GHSA-5c6j-r48x-rmvq, -qj8w-gfj5-8c6v)
- picomatch: method injection in POSIX character classes via transitive
  deps (cleared by the svelte bump pulling fresh versions)

Bumps:
- svelte ^3.59.2 → ^5.55.4
- @rollup/plugin-terser ^0.4.4 → ^1.0.0
- rollup-plugin-svelte ^7.2.2 → ^7.2.3 (only version that peer-depends
  on svelte >= 5)

Svelte 5 migration for the viewer — small because the component uses
legacy reactivity (`$:`) which Svelte 5 still supports:

- src/main.js: `new App({ target })` → `mount(App, { target })`
- src/App.svelte: wrap bare `<tr>` rows in `<tbody>` (Svelte 5's
  compiler refuses invalid HTML structure that browsers silently
  repair); scope the component's `body { overflow-x: hidden }` rule
  with `:global(body)` so it actually applies.

`npm audit` reports 0 vulnerabilities after the bump. `npm run build`
produces public/bundle.js cleanly.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant