feat: release v1.0.6

[AlinsRan]

Drop the unpinned "lua-cjson" dependency from the rockspecs and cut v1.0.6.

Problem

The library only ever does require("cjson.safe"), which OpenResty always bundles. But the rockspec declares lua-cjson as a LuaRocks dependency, so every consumer installing this rock also pulls lua-cjson 2.1.0.10-1 — the latest release on luarocks.org; 2.1.0.11 was never published there — into their rocks tree.

When that tree comes first on the worker's lua_package_cpath (which is the case for APISIX's deps/), the installed 2.1.0.10 shadows OpenResty's bundled 2.1.0.11.

2.1.0.10 predates openresty/lua-cjson#82: the empty_array sentinel is pushed through a 47-bit pointer mask but compared unmasked. On platforms that map shared libraries above 2^47 — arm64 Linux with 48-bit VA, e.g. Apple Silicon — the comparison fails and the encoder emits nothing for the value, producing invalid JSON:

require("cjson").encode({ x = require("cjson").empty_array })
-- 2.1.0.10 on arm64: {"x":}    <- invalid
-- 2.1.0.11:          {"x":[]}

Reported downstream as apache/apisix#13593 (APISIX 3.17.0 ships this rock in deps/; 3.16.0, which did not depend on this library, has no cjson in deps/).

Pinning lua-cjson >= 2.1.0.11 is not an option — that version does not exist on luarocks.org. Removing the declaration is the correct fix: the module we use is guaranteed to be present on OpenResty, and nothing should be installing a second copy of cjson alongside the bundled one.

Changes

• rockspec/lua-resty-openapi-validator-master-0.1-0.rockspec: drop "lua-cjson"
• rockspec/lua-resty-openapi-validator-1.0.6-1.rockspec: new, copied from 1.0.5-1 without "lua-cjson"
• README: note that lua-cjson comes from OpenResty rather than LuaRocks

Safety

• Every require in lib/ and t/ is cjson.safe; no bare require("cjson") anywhere in the repo.
• Only cjson.decode and cjson.null are used — both present in the OpenResty bundled build.
• .github/workflows/test.yml, fuzz.yml and fuzz-nightly.yml install only jsonschema and lua-resty-radixtree; lua-cjson has never been installed in CI, so the suite has always run against the bundled version. This change makes the declared dependency set match what CI has been exercising.
• No module code or API changes; removing a dependency only narrows the install set.

Follow-up

apache/apisix bumps its pin to lua-resty-openapi-validator = 1.0.6-1 once 1.0.6-1 is on luarocks.org.

Summary by CodeRabbit

• Documentation
  • Clarified that lua-cjson is bundled with OpenResty and does not need to be installed separately through LuaRocks.
• Chores
  • Added package metadata for the 1.0.6 release.
  • Updated dependency declarations to avoid requiring a separately installed lua-cjson package where it is already provided by OpenResty.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: f3a4f7a5-d8c5-4e4c-8919-e531aaad93fe

📥 Commits

Reviewing files that changed from the base of the PR and between 632e759 and b0a84bd.

📒 Files selected for processing (3)

• README.md
• rockspec/lua-resty-openapi-validator-1.0.6-1.rockspec
• rockspec/lua-resty-openapi-validator-master-0.1-0.rockspec

💤 Files with no reviewable changes (1)

• rockspec/lua-resty-openapi-validator-master-0.1-0.rockspec

---

📝 Walkthrough

Walkthrough

The PR adds a versioned LuaRocks specification, maps exported modules to implementation files, and updates lua-cjson dependency documentation and declarations for OpenResty.

Changes

Package metadata and dependencies

Layer / File(s)	Summary
Versioned release package definition rockspec/lua-resty-openapi-validator-1.0.6-1.rockspec	Adds package identity, Git source metadata, description, licensing, runtime dependencies, and builtin module mappings for version 1.0.6.
lua-cjson dependency alignment rockspec/lua-resty-openapi-validator-master-0.1-0.rockspec, README.md	Removes lua-cjson from the master rockspec dependencies and documents that OpenResty bundles it outside LuaRocks.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Suggested reviewers: jarvis9443

🚥 Pre-merge checks | ✅ 6

✅ Passed checks (6 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately reflects the main change: releasing v1.0.6.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
E2e Test Quality Review	✅ Passed	PASS: metadata-only change (rockspecs/README) with no runtime code paths altered, so E2E coverage isn’t applicable.
Security Check	✅ Passed	Only README and rockspec metadata changed; no runtime code, auth, logging, storage, or TLS paths were modified, and repo cjson use remains cjson.safe.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/drop-lua-cjson-dependency

---

_{Comment @coderabbitai help to get the list of available commands.}