deps: use optional dependency rfc3987-syntax2 instead of rfc3987-syntax

[jkowalleck]

in #1388 a non-gpl library for validating IRI was introduced.

Unfortunately, the library rfc3987-syntax (https://pypi.org/project/rfc3987-syntax/) is no longer maintained.
Therefore, a maintained fork rfc3987-syntax2 (https://pypi.org/project/rfc3987-syntax2/) exists, which is used here.

rfc3987-syntax2 v1.3.0 has various improvements over the old rfc3987-syntax v1.1.0

• lazy-loading - improving import times tremendously

  • simple bench

    $ # new lib
    $ time python -c "from rfc3987_syntax2 import is_valid_syntax as _rfc3987_is_valid_syntax"
    
    ________________________________________________________
    Executed in  149.03 millis    fish           external
       usr time  133.83 millis    0.00 micros  133.83 millis
       sys time   13.60 millis  708.00 micros   12.89 millis
    
    $ # old lib 
    $ time python -c "from rfc3987_syntax import is_valid_syntax as _rfc3987_is_valid_syntax"
    
    ________________________________________________________
    Executed in    2.20 secs    fish           external
       usr time    2.16 secs  782.00 micros    2.16 secs
       sys time    0.03 secs  115.00 micros    0.03 secs

  • test compare in CI pipeline
    • new lib on PR: 10.006s - https://github.com/python-jsonschema/jsonschema/actions/runs/29859393697/job/88731960392?pr=1521#step:8:8839
    • old lib on main: 27.485s - https://github.com/python-jsonschema/jsonschema/actions/runs/29805998926/job/88556570183#step:8:8839

• is RFC 3987 syntax complete (old lib had blind-spots)

• various bug fixes

  • https://github.com/jkowalleck/rfc3987-syntax2/releases#release-v1.3.0
  • https://github.com/jkowalleck/rfc3987-syntax2/releases#release-v1.2.0
  • https://github.com/jkowalleck/rfc3987-syntax2/releases#release-v1.1.1

• proper typing and API docs

[read-the-docs-community]

Documentation build overview

📚 python-jsonschema | 🛠️ Build #33694151 | 📁 Comparing 271cf7a against latest (0274292)

  🔍 Preview build  

2 files changed

± validate/index.html
± _modules/jsonschema/_format/index.html

[jkowalleck]

@Julian I think we should switch to this library

[jkowalleck]

@kdeldycke could you check whether this also requires your downstream mod like in Nuitka/Nuitka#3578

[Julian]

I'm not looking to add external dependencies for format at this time, by which I mean that even though previously I pushed back on maintaining format dependencies "ourselves" here in the jsonschema org, these days for better or worse this is something LLMs are quite adept at. So my preference, if indeed the library is abandoned, would be to grow a format validator here ourselves in the org rather than adopt an otherwise-unused fork.

[jkowalleck]

I'm not looking to add external dependencies for format at this time, by which I mean that even though previously I pushed back on maintaining format dependencies "ourselves" here in the jsonschema org, these days for better or worse this is something LLMs are quite adept at. So my preference, if indeed the library is abandoned, would be to grow a format validator here ourselves in the org rather than adopt an otherwise-unused fork.

Great point, and I understand the preference to eventually own this in-org.

That said, this PR is not introducing a new dependency category — it replaces an already-existing dependency (rfc3987-syntax) that is currently unmaintained with its maintained successor (rfc3987-syntax2).

The practical benefit is immediate:

• fixes and improved RFC 3987 coverage are available now,
• substantially better import/runtime behavior (lazy-loading),
• and we avoid staying on an abandoned package while waiting for a future first-party implementation.

I’m very supportive of moving to a first-party validator later. But providing an improved, fixed, and performant version today is better than waiting for an unknown future timeline.

If helpful, I can add a follow-up issue/milestone to track first-party implementation + dependency removal, so this remains explicitly temporary.

P.S. On "otherwise-unused fork": I think that’s a bit speculative. While rfc3987-syntax2 is still relatively new, that alone doesn’t imply it will remain unused; adoption typically takes time, especially for infrastructure libraries.

[Julian]

(Your comment seems LLM-written. Apologies if that isn't the case, but it's the sensation it gives.)

There's no such thing as bitrotting really, so there's no specific disadvantage I'm aware of in inherently being on an "abandoned" library for this specific use case. On the other hand, it seems you work in supply chain security, so surely you understand the downside that adding a dependency which isn't widely used means I need to judge whether you're trustworthy -- the older library wouldn't go away for backwards compatibility, so each time a dependency is added an additional person gets an exploitable vector into all jsonschema's users. So there's certainly downside.

If you're saying there are bugs which lead to incorrect behavior that's certainly more motivation (though I don't think we fail any of the JSON Schema test suite cases in this area, so if that is the case, improving the upstream test suite is another good thing to do).

Again, I'm not saying categorically no, though I am leaning towards it, but I'm not seeing urgency here unless I'm missing something -- a user who wants to use your library for format validation can equally do so today without this PR.

[jkowalleck]

(Your comment seems LLM-written. Apologies if that isn't the case, but it's the sensation it gives.)

It sure is, I am a bit in a rush between many tasks, so I had a LLM flush out my phrasing and fix spelling and and such based on a keyword-based input I provided. Since English is not my mother tongue, I use it a lot to make my texts more readable for others.

If you're saying there are bugs which lead to incorrect behavior that's certainly more motivation

That's because your current test suite is incomplete regarding RFC3987.
There is a more sophisticated one just for all the RFC 3987 - https://github.com/jkowalleck/rfc3987-syntax2/blob/main/tests/_data/valid_syntax.json

PS: I'll have a LLM work on incorporating my test suite into yours. PR coming soon-ish

[Julian]

(Please don't communicate via LLMs with humans -- I fully understand the difficulty in communicating outside one's mother tongue. I would much rather ignore occasional mistakes than be talking to a robot.)

That's because your current test suite is incomplete regarding RFC3987.

The sentence just after what you quoted encouraged you to contribute those improvements to the upstream test suite.

[jkowalleck]

regarding supply chain risks:
i would be happy to donate/transfer this maintained fork and package to the jsonschema org.

[Julian]

That certainly would help get us down the "first party" path.

[jkowalleck]

That certainly would help get us down the "first party" path.

Fantastic.
Just drop me a ticket in https://github.com/jkowalleck/rfc3987-syntax2/issues and wecan discuss and plan the transfer.