test(json): adversarial QuickCheck roundtrip and parser-robustness tests

.github/workflows/bleeding-check.yml

@@ -26,7 +26,7 @@ jobs:
           version: nightly
 
       - name: run tests
-        timeout-minutes: 10
+        timeout-minutes: 20
         uses: ./.github/actions/test
 
       - name: Test new allocator

.github/workflows/pre-release-check.yml

@@ -148,7 +148,7 @@ jobs:
         run: moon check --deny-warn
 
       - name: run tests
-        timeout-minutes: 10
+        timeout-minutes: 20
         uses: ./.github/actions/test
 
       - name: moon bundle

.github/workflows/stable-check.yml

@@ -41,7 +41,7 @@ jobs:
           git diff --exit-code
 
       - name: run tests
-        timeout-minutes: 10
+        timeout-minutes: 20
         uses: ./.github/actions/test
 
       - name: moon bundle

CHANGELOG.md

@@ -13,9 +13,14 @@ changelog should follow [Keep a Changelog](https://keepachangelog.com/en/1.1.0/)
 - Core commit: `bd827dc85`
 - Added `Debug` trait with `derive(Debug)` support, including `ignore=[..]` configuration for non-debuggable nested types
 - Added new `moonbitlang/async` APIs including `@process.spawn`, advisory file locking, `@fs.tmpdir`, `@async.all`, and `@async.any`
+- Added `Array::release_unused(placeholder~)`, which overwrites the unused capacity of an array in place with a placeholder, releasing the elements that earlier removals left there
+- Added `Deque::release_unused(placeholder~)`, which overwrites the unused capacity of a deque in place with a placeholder, releasing the elements that earlier removals left there
 
 #### Changed
 
+- `Array` shrinking operations no longer null out the slots they vacate, so an `ArrayView` created before the mutation can no longer read uninitialized memory (previously a segfault on native and `null` on wasm-gc; the JavaScript backend is unchanged, and such a view still observes `undefined` past the array's current length there). Mutating an array while a view of it is alive remains a program error, but it now yields unspecified *valid* values rather than undefined behavior. The removed elements stay reachable from the buffer until later pushes reuse those slots, the buffer grows, or the array is dropped -- uniformly, `clear` included, which no longer releases them. `Array::release_unused(placeholder~)` overwrites the unused capacity in place with a placeholder to release them on demand, while `shrink_to_fit`, which already reallocated, lets them go with the old buffer. No existing signature changes
+- `Deque` shrinking operations no longer null out the slots they vacate, so an `ArrayView` obtained from `Deque::as_views` before the mutation can no longer read uninitialized memory (previously a segfault on native, `null`/`undefined` elsewhere). Mutating a deque while a view of it is alive remains a program error, but it now yields unspecified *valid* values rather than undefined behavior. The removed elements stay reachable from the buffer until later pushes reuse those slots, the buffer grows, or the deque is dropped -- uniformly, `clear` included, which no longer releases them. `Deque::release_unused(placeholder~)` overwrites the unused capacity in place with a placeholder to release them on demand, while `shrink_to_fit`, which already reallocated, lets them go with the old buffer. No existing signature changes
+- **BREAKING**: `@json.parse` now rejects unpaired `\uXXXX` surrogate escapes in strings, raising `ParseError::InvalidChar` at the backslash that opens the offending escape; an escaped leading surrogate must be followed immediately by an escaped trailing surrogate, and the pair decodes to the character it denotes. Previously such escapes were decoded unchecked and produced a `String` that was not well-formed Unicode. `@json.valid` reports the same documents as invalid. JSON emitted by `JSON.stringify` in JavaScript can contain these escapes, so input that JavaScript and Python accept may now be rejected — as it is by Rust's serde_json
 - `@json.inspect` has been migrated to `json_inspect`
 - `String::sub` and `StringView::sub` now panic on invalid indices instead of raising `CreatingViewError`. The `CreatingViewError` type has been removed.
 

NOTICE

@@ -42,6 +42,15 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 File random/random.mbt is adapted from Golang's [`math/rand/v2`](https://pkg.go.dev/math/rand/v2) package.
 
+Files `internal/strconv/strconv_eisel_lemire.mbt` and
+`internal/strconv/strconv_eisel_lemire_table.mbt` are adapted from Go 1.26.2's
+`internal/strconv/atofeisel.go` and generated `internal/strconv/pow10tab.go`.
+
+Files `bigint/arith_wide.mbt` and `bigint/bigint_wide.mbt` are adapted from
+Go's `math/big` package, specifically `src/math/big/arith.go`,
+`src/math/big/nat.go`, `src/math/big/natmul.go`, and
+`src/math/big/natdiv.go`.
+
 License from Golang:
 Copyright 2009 The Go Authors.
 

README.md

@@ -23,7 +23,7 @@ graph BT
   prelude["<b>prelude</b> — auto-opened re-exports<br/>from builtin, debug, test, bigint, …"] --> builtin
   values["<b>value types</b><br/>bool · byte · char · unit · option · result<br/>error · ref · tuple · cmp · range · lazy"] --> builtin
   numbers["<b>numerics</b><br/>int · uint · int16 · uint16 · int64 · uint64<br/>double · float · bigint · v128 · math"] --> builtin
-  text["<b>text & binary</b><br/>string · bytes · buffer · encoding/*<br/>strconv · lexbuf"] --> builtin
+  text["<b>text & binary</b><br/>string · bytes · buffer · encoding/*<br/>lexbuf"] --> builtin
   mut["<b>mutable collections</b><br/>array · hashmap · hashset · deque · queue<br/>priority_queue · set · sorted_map · sorted_set"] --> builtin
   imm["<b>immutable collections</b><br/>list · lazy_list · immut/vector<br/>immut/hashmap · immut/sorted_map · …"] --> builtin
   tools["<b>algorithms & tooling</b><br/>json · diff · random · quickcheck · argparse<br/>bench · test · debug · env"] --> builtin

argparse/arg_spec.mbt

@@ -29,7 +29,7 @@ pub(all) enum FlagAction {
 ///|
 /// Behavior for option args.
 ///
-/// - `Set` keeps the last provided value.
+/// - `Set` accepts the value once; a repeated occurrence is an error.
 /// - `Append` keeps all provided values in order.
 pub(all) enum OptionAction {
   Set
@@ -89,8 +89,10 @@ pub struct FlagArg {
 /// - At least one of `short`, `long`, or `env` must be available.
 /// - `global=true` makes the flag available in subcommands.
 /// - `negatable=true` accepts `--no-<long>` for long flags.
-/// - If `env` is set, accepted boolean values are:
-///   `1`, `0`, `true`, `false`, `yes`, `no`, `on`, `off`.
+/// - If `env` is set on a `SetTrue` / `SetFalse` flag, accepted boolean
+///   values are: `1`, `0`, `true`, `false`, `yes`, `no`, `on`, `off`.
+/// - If `env` is set on a `Count` flag, the value must be a non-negative
+///   integer.
 #alias(new, deprecated="Use `FlagArg()` instead")
 pub fn FlagArg::FlagArg(
   name : StringView,
@@ -240,11 +242,6 @@ pub fn PositionArg::PositionArg(
   }
 }
 
-///|
-fn arg_name(arg : Arg) -> String {
-  arg.name
-}
-
 ///|
 fn range_allows_multiple(range : ValueRange?) -> Bool {
   range is Some(r) &&