Upgrade Core and Blaze

[jviotti]

Signed-off-by: Juan Cruz Viotti jv@jviotti.com

[cubic-dev-ai]

No issues found across 368 files

<sub>Note: This PR contains a large number of files. cubic only reviews up to 200 files per PR, so some files may not have been reviewed. cubic prioritizes the most important files to review.

Re-trigger cubic</sub>

[augmentcode]

🤖 Augment PR Summary

Summary: This PR upgrades the vendored core and blaze dependencies used by jsonbinpack.

Changes:

• Bumps the pinned core and blaze SHAs in DEPENDENCIES (and in the vendored Blaze dependency list).
• Updates Blaze’s CMake configuration to replace the former “documentation” component with a “canonicalizer” component and wires it into the build/test layout.
• Extends Blaze’s JavaScript port with improved error descriptions and a new “evaluate without callback” execution path for some fused instructions.
• Pulls in a large set of Core changes, including new crypto helpers (HMAC/SHA512, signing utilities), improved randomness APIs, and JSON-LD recursion-depth guarding.
• Refreshes Core’s text/URI helper APIs (e.g., hex digit decoding) and updates internal users accordingly.
• Includes multiple documentation and API-safety adjustments across the vendored libraries.

Notes: The bulk of the diff is dependency/vendor code updates; the main integration risk is build-option/API mismatches between jsonbinpack’s build glue and the upgraded vendored projects.

_{🤖 Was this summary useful? React with 👍 or 👎}

[augmentcode]

Review completed. 2 suggestions posted.

Comment augment review to trigger a new review at any time.

[augmentcode]

vendor/blaze/ports/javascript/index.mjs:703-713 — evaluateInstructionWithoutCallback restores evaluateInstruction/evaluator.callbackMode only on the normal return path; if evaluateInstruction(...) throws, the dispatcher/callback mode can remain mutated for subsequent evaluations. Consider ensuring the restoration happens on exception paths as well so a single failure can’t corrupt evaluator state.

Severity: medium

_{🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.}

[augmentcode]

vendor/blaze/CMakeLists.txt:15 — this introduces BLAZE_CANONICALIZER in place of the old BLAZE_DOCUMENTATION option, but jsonbinpack’s cmake/FindBlaze.cmake still sets BLAZE_DOCUMENTATION OFF before add_subdirectory(vendor/blaze). That means the canonicalizer component will stay enabled unexpectedly, potentially changing what gets built/linked in this repo.

Severity: medium

_{🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.}