Upgrade all dependencies

[jviotti]

Signed-off-by: Juan Cruz Viotti jv@jviotti.com

[cubic-dev-ai]

No issues found across 63 files

_{Re-trigger cubic}

[augmentcode]

🤖 Augment PR Summary

Summary: This PR updates the repository’s pinned dependency SHAs (core/jsonbinpack/blaze and the JSON Schema Test Suite) to newer upstream revisions.

Changes:

• Bumps core, blaze, and jsonbinpack revisions in DEPENDENCIES (and corresponding vendor dependency files).
• Pulls in upstream Blaze changes that adjust JSON Pointer concatenation usage (newer pointer API).
• Updates Sourcemeta Core with new JSON Pointer convenience overloads and URI helpers (scheme + gen-delim checks, improved relativization).
• Adds a JOSE JWKSProvider for cached JWKS retrieval + token verification with refresh/rotation handling.
• Adds a new JSON-LD 1.1 processor module (expand/compact/flatten) and associated error type.
• Extends Core’s JSON object internals with a hash-aware key equality helper for faster key comparisons.

Technical Notes: Several of the changes are in vendored dependencies and may alter public APIs/behavior (e.g., JSON Pointer concatenation and new JSON-LD/JOSE surface area).

_{🤖 Was this summary useful? React with 👍 or 👎}

[augmentcode]

Review completed. 2 suggestions posted.

Comment augment review to trigger a new review at any time.

[augmentcode]

JWKSProvider::verify calls the injected clock_() without any exception guard, so a throwing test/consumer clock would escape verify() (unlike the fetcher which is explicitly contained). Consider whether verify() should treat a throwing clock as a failed verification path to keep its “never escape verification” resilience story consistent.

Severity: low

_{🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.}

[augmentcode]

These are exported entry points, but assert(jsonld_is_expanded(input)) means release builds will accept non-expanded input and continue with potentially nonsensical results instead of failing fast. Consider whether this should be a runtime check/error (or at least explicitly documented as undefined behavior) to avoid surprising production behavior.

Severity: medium

Other Locations

• vendor/core/src/core/jsonld/jsonld.cc:141

_{🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.}