build(deps): bump github.com/tggo/goRDFlib from 0.1.16 to 0.4.0 in /packages/cli

[dependabot]

Bumps github.com/tggo/goRDFlib from 0.1.16 to 0.4.0.

Release notes

Sourced from github.com/tggo/goRDFlib's releases.

v0.4.0

Breaking

Every parser (turtle, trig, nt, nq, rdfxml, jsonld) now gives blank node labels a fresh scope per Parse call, as RDF 1.1 §3.4 specifies and as rdflib, Jena and RDF4J do. Two documents that both use _:b1 no longer join through that label when parsed into one graph. Code that looked parsed nodes up by their source label must opt out with WithPreserveBlankNodeIDs() on the parser it uses (also available on rdfloader). JSON-LD's preserve mode keeps json-gold's labels, not the source ones. (#28 by @​utrack)

New

• jsonld.WithExpandContext(ctx): a context applied before the document's own @context, for pre-declaring terms a document relies on but never declares. Accepts a context definition, an IRI resolved through the document loader, an array, or a document with a @context key. Provenance expands identifiers through it too. (#29)

Fixed

• RDF/XML: triples captured inside rdf:parseType="Triple" no longer report provenance, since they are components of a triple term rather than assertions in the graph.

v0.3.1 — Fuzzing the provenance work, and the two bugs it found

Fixes found by fuzzing and by variation-testing the provenance work released in v0.3.0. Coverage of that code was 90–96%, the interesting variations were untested, and nothing outside SPARQL was fuzzed. Closing both turned up two real defects.

Fixes

A directional language tag broke provenance lookups (shacl)

shacl.toTerm was not the inverse of fromRDFLib. fromRDFLib folds a base direction into the language as "he--rtl"; toTerm left it folded, so a literal converted out and back produced a different term.TermKey. Every provenance lookup on a directional literal therefore missed, and the result silently degraded from SourceLineTriple to SourceLineFocusNode — a less precise line, with nothing to indicate why.

Anything keyed by TermKey across that boundary had the same exposure, which is the part worth remembering.

jsonld.Parse panicked instead of erroring (jsonld)

This one predates v0.3.0 entirely; fuzzing the new code is simply what found it. json-gold resolves a reference against a URL that failed to parse and dereferences the nil result, so {"@id":"%"} with a base IRI took the process down:

panic: runtime error: invalid memory address or nil pointer dereference
net/url.(*URL).ResolveReference(...)
github.com/piprate/json-gold/ld.Resolve(...)

A parser is routinely aimed at untrusted bytes, and a library that crashes the process on them is not usable for that. json-gold's entry points — ToRDF, FromRDF, Compact — are now guarded, and a panic comes back as an error wrapping the new jsonld.ErrProcessorPanic, with the stack retained so it can be reported upstream. errors.Is tells a crash apart from a rejection, which is the difference between "this document is wrong" and "report this".

Testing

Fuzzing. Eleven targets, driven by make test-fuzz (FUZZTIME=5m to hunt). The properties are the ones that make a printed line trustworthy:

Target	Property
rdfxml/FuzzParseProvenance	no panic on arbitrary XML; every reported line exists; every triple in the graph has one
jsonld/FuzzScanIDPositions	every reported line exists; only identifiers actually written are reported
jsonld/FuzzLineIndex	offset-to-line agrees with the naive implementation
jsonld/FuzzParseProvenance	a failed parse reports nothing; a line is only given to a subject the graph holds
provenance/FuzzIndexKeyCollisions	two distinct triples never share a key, whatever a literal contains
provenance/FuzzTripleKeySplit, FuzzSubjectLineIsTheMinimum	key layout and earliest-line selection
shacl/FuzzSourceLines, FuzzSourceLinesNeverInvent	no result names a line outside the file; a SourceLineTriple always has the triple to back it

... (truncated)

Commits

• 52d40c3 fix: bnodes: scope by replacing labels, not by prefixing them
• a7941e3 Merge PR #28: scope blank node IDs to the parser's run by default
• 0df25b4 feat: jsonld: WithExpandContext option (#29)
• 4d4dca5 blank nodes: scope the blank node IDs to the parser's run; option to preserve...
• 76f3940 test: fuzz the provenance work, and fix what it and the variation tests found
• 72f85eb feat: provenance for the RDF/XML and JSON-LD parsers
• fc8e03b feat: shacl: validation results can point at the line of the data file
• 0abc5e7 README: list MongoStore among the storage backends
• 3f0f22e ci: run the satellite backend's integration suite against each commit
• 4675e26 README: correct the MongoDB backend example to the shipped storage layout
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)