build(deps): bump github.com/tggo/goRDFlib from 0.1.16 to 0.3.1 in /packages/cli

[dependabot]

Bumps github.com/tggo/goRDFlib from 0.1.16 to 0.3.1.

Release notes

Sourced from github.com/tggo/goRDFlib's releases.

v0.3.1 — Fuzzing the provenance work, and the two bugs it found

Fixes found by fuzzing and by variation-testing the provenance work released in v0.3.0. Coverage of that code was 90–96%, the interesting variations were untested, and nothing outside SPARQL was fuzzed. Closing both turned up two real defects.

Fixes

A directional language tag broke provenance lookups (shacl)

shacl.toTerm was not the inverse of fromRDFLib. fromRDFLib folds a base direction into the language as "he--rtl"; toTerm left it folded, so a literal converted out and back produced a different term.TermKey. Every provenance lookup on a directional literal therefore missed, and the result silently degraded from SourceLineTriple to SourceLineFocusNode — a less precise line, with nothing to indicate why.

Anything keyed by TermKey across that boundary had the same exposure, which is the part worth remembering.

jsonld.Parse panicked instead of erroring (jsonld)

This one predates v0.3.0 entirely; fuzzing the new code is simply what found it. json-gold resolves a reference against a URL that failed to parse and dereferences the nil result, so {"@id":"%"} with a base IRI took the process down:

panic: runtime error: invalid memory address or nil pointer dereference
net/url.(*URL).ResolveReference(...)
github.com/piprate/json-gold/ld.Resolve(...)

A parser is routinely aimed at untrusted bytes, and a library that crashes the process on them is not usable for that. json-gold's entry points — ToRDF, FromRDF, Compact — are now guarded, and a panic comes back as an error wrapping the new jsonld.ErrProcessorPanic, with the stack retained so it can be reported upstream. errors.Is tells a crash apart from a rejection, which is the difference between "this document is wrong" and "report this".

Testing

Fuzzing. Eleven targets, driven by make test-fuzz (FUZZTIME=5m to hunt). The properties are the ones that make a printed line trustworthy:

Target	Property
rdfxml/FuzzParseProvenance	no panic on arbitrary XML; every reported line exists; every triple in the graph has one
jsonld/FuzzScanIDPositions	every reported line exists; only identifiers actually written are reported
jsonld/FuzzLineIndex	offset-to-line agrees with the naive implementation
jsonld/FuzzParseProvenance	a failed parse reports nothing; a line is only given to a subject the graph holds
provenance/FuzzIndexKeyCollisions	two distinct triples never share a key, whatever a literal contains
provenance/FuzzTripleKeySplit, FuzzSubjectLineIsTheMinimum	key layout and earliest-line selection
shacl/FuzzSourceLines, FuzzSourceLinesNeverInvent	no result names a line outside the file; a SourceLineTriple always has the triple to back it

Seed corpora run as ordinary tests on every go test, so a fixed crash stays fixed.

Variations. Now covered: sequence and inverse paths falling back to the focus node rather than blaming one hop of a path; nested results through sh:node; language-tagged, directional, typed, numeric and escaped literal values resolving to the triple rather than settling for the focus node; blank-node focus nodes; JSON-LD contexts written as arrays and as expanded term definitions; contexts declared below the nodes that use them; scoped contexts staying silent instead of guessing; malformed sources reporting nothing at all.

provenance is now at 100% statement coverage. jsonld is at 96.2%, with two if err != nil branches left uncovered deliberately: they guard error returns that current json-gold never takes.

Compatibility

No API changes beyond the new jsonld.ErrProcessorPanic sentinel.

The toTerm fix makes a directional literal round-trip correctly, which is what it was always meant to do; the only visible change is that such violations now report the precise line they should have.

All W3C suites remain at 100% (2439 tests).

... (truncated)

Commits

• 76f3940 test: fuzz the provenance work, and fix what it and the variation tests found
• 72f85eb feat: provenance for the RDF/XML and JSON-LD parsers
• fc8e03b feat: shacl: validation results can point at the line of the data file
• 0abc5e7 README: list MongoStore among the storage backends
• 3f0f22e ci: run the satellite backend's integration suite against each commit
• 4675e26 README: correct the MongoDB backend example to the shipped storage layout
• 33808ea fix: sparql: an inverse path may carry a modifier
• a3a2b60 feat: store: shared conformance suite + reachability pushdown for property paths
• See full diff in compare view