deps: bump regorus from 0.10.1 to 0.12.0

[dependabot]

Bumps regorus from 0.10.1 to 0.12.0.

Release notes

Sourced from regorus's releases.

regorus-v0.12.0

Added

• (value) Frozen object storage (boxed-slice) for compact parsed objects (#787)
• json.patch builtin with Rego set support + partial-rule multi-body fix (picks up #442) (#776)
• Support Verus verification (#759)

Fixed

• Prevent panic by Number::modulo (#773)
• Handle i64::MIN / -1 special case
• (interpreter,rvm) resolve function calls through import aliases (#769)

Other

• Add per-execution memory budgets to RVM (#792)
• Verify Number with Verus (#774)
• (deps) bump the github-actions group with 3 updates (#793)
• Fix potential underflow in bigint_to_scientific (#791)
• (deps) migrate from serde_yaml to yaml_serde (#790)
• (value) migrate Array storage abstraction (#785)
• (deps) bump the github-actions group across 1 directory with 4 updates (#783)
• Pin GitHub Actions to full-length commit SHAs (#777)
• (value) migrate Value::Set to Set storage abstraction (#778)
• (deps) bump the rust-dependencies group across 5 directories with 10 updates (#784)
• (deps) bump the github-actions group with 4 updates (#779)
• (deps) bump the github-actions group across 1 directory with 11 updates (#763)
• (deps) bump the rust-dependencies group across 6 directories with 6 updates (#768)
• Handle i32::MIN in Number::two_pow and Number::ten_pow (#771)

Added

• (rvm) add opt-in per-execution memory budgets for run-to-completion evaluation, including typed Rust and binding errors (#792)

regorus-v0.11.0

Added

• (compiler) support registered host-await builtins for natural function call syntax (#667)
• (value) introduce Set storage abstraction (#740)

Fixed

• (rvm) assert every-quantifier results so failing cases don't pass (#765)
• Engine::add_data now deep-merges nested data documents instead of only merging top-level keys. Adding { "a": { "x": 1 } } followed by { "a": { "y": 2 } } now yields { "a": { "x": 1, "y": 2 } } (matching OPA's data-document merge). Nested sets under a shared key are unioned. Only genuine leaf conflicts (the same path holding two different values) are reported as errors. (#760)
• A zero-arg function producing two different complete values (e.g. f() := { "a": 1 } and f() := { "b": 2 }) is now reported as a conflict, matching OPA's complete-rule semantics, instead of silently combining the outputs.

Security

• Engine::add_data now rejects data nested beyond 128 levels instead of risking a stack overflow on adversarially deep input.

... (truncated)

Changelog

Sourced from regorus's changelog.

0.12.0 - 2026-09-01

Added

• (value) Frozen object storage (boxed-slice) for compact parsed objects (#787)
• json.patch builtin with Rego set support + partial-rule multi-body fix (picks up #442) (#776)
• Support Verus verification (#759)

Fixed

• Prevent panic by Number::modulo (#773)
• Handle i64::MIN / -1 special case
• (interpreter,rvm) resolve function calls through import aliases (#769)

Other

• Add per-execution memory budgets to RVM (#792)
• Verify Number with Verus (#774)
• (deps) bump the github-actions group with 3 updates (#793)
• Fix potential underflow in bigint_to_scientific (#791)
• (deps) migrate from serde_yaml to yaml_serde (#790)
• (value) migrate Array storage abstraction (#785)
• (deps) bump the github-actions group across 1 directory with 4 updates (#783)
• Pin GitHub Actions to full-length commit SHAs (#777)
• (value) migrate Value::Set to Set storage abstraction (#778)
• (deps) bump the rust-dependencies group across 5 directories with 10 updates (#784)
• (deps) bump the github-actions group with 4 updates (#779)
• (deps) bump the github-actions group across 1 directory with 11 updates (#763)
• (deps) bump the rust-dependencies group across 6 directories with 6 updates (#768)
• Handle i32::MIN in Number::two_pow and Number::ten_pow (#771)

Added

• (rvm) add opt-in per-execution memory budgets for run-to-completion evaluation, including typed Rust and binding errors (#792)

0.11.0 - 2026-07-21

Added

• (compiler) support registered host-await builtins for natural function call syntax (#667)
• (value) introduce Set storage abstraction (#740)

Fixed

• (rvm) assert every-quantifier results so failing cases don't pass (#765)
• Engine::add_data now deep-merges nested data documents instead of only merging top-level keys. Adding { "a": { "x": 1 } } followed by { "a": { "y": 2 } } now yields { "a": { "x": 1, "y": 2 } } (matching OPA's data-document merge). Nested sets under a shared key are unioned. Only genuine leaf conflicts (the same path holding two different values) are reported as errors. (#760)
• A zero-arg function producing two different complete values (e.g. f() := { "a": 1 } and f() := { "b": 2 }) is now reported as a conflict, matching OPA's complete-rule semantics, instead of silently combining the outputs.

Security

... (truncated)

Commits

• c6c679f chore: release (#802)
• b17ede6 Add per-execution memory budgets to RVM (#792)
• a9b1eea Verify Number with Verus (#774)
• 409a36f build(deps): bump rb_sys in /bindings/ruby in the per-dependency group (#794)
• 39f535e ci(deps): bump the github-actions group with 3 updates (#793)
• 3496f05 Fix potential underflow in bigint_to_scientific (#791)
• fc1533b build(deps): migrate from serde_yaml to yaml_serde (#790)
• a7a1534 feat(value): Frozen object storage (boxed-slice) for compact parsed objects (...
• 3cff6c5 refactor(value): migrate Array storage abstraction (#785)
• e60e707 build(deps): bump rubocop (#782)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[codspeed]

Merging this PR will not alter performance

✅ 9 untouched benchmarks

---

_{Comparing dependabot/cargo/regorus-0.12.0 (128ad16) with main (f7a3c38)}