Jsonnet

Latest version: v0.20.0

Safety actively analyzes 723144 Python packages for vulnerabilities to keep your Python projects secure.

Scan your dependencies

Page 4 of 7

0.9.4

Major changes:

There are two new operators `e in e` and `e in super`. They perform the same role as `std.objectHasAll`, i.e. they allow you to discover whether a field exists, except that `std.objectHasAll(super, e)` cannot be expressed since `super` is not allowed in isolation. The semantics of `e in super` are quite interesting because it returns false even if there is no super object.

There is a subtle change to the semantics of `+:` and related field definitions. Previously if the super-object did not have the field `f` then `f +: e` was an error. Now, it succeeds in that case yielding `f: e`. This extends recursively, so `{ } + { f+: { x +: { y: 1 } } }` yields `{ f: { x: { y: 1 } } }`, and in fact the left hand side `{ }` is not even needed. You can evaluate a mixin like `{ f+: { x +: { y: 1 } } }` without even applying it to anything. This is a backwards compatible change because it only affects the behavior of programs that used to fail.

Minor other changes in this release:

- Addition of std.prune
- Fix of uninitialized value (undefined behavior) in desugarer.

0.9.3

Python-only release.

0.9.2

Sorry for the churn. Since the last release a buffer overrun was identified, so this release fixes it. Also included are some fixes to jsonnet fmt behavior and a fix for [e::] when e was larger than one token.

0.9.1

New features:
- error will implicitly convert to string
- Verbatim string literals, e.g. " \ \" " can now be given as " \ "" " (note the escaping of "
- std.md5("foo") is added.

Bug fixes:

Fixed the binding of self / super in e after the expansion of [e] +:
Several improvements to the output of jsonnet fmt when -n is used.
Avoid an infinite loop of memory consumption at a ||| syntax error.

0.9.0

Fix a segfault in the GC when using native functions.

Some minor bug fixes.

Imported values are now cached after execution, resulting in a ~2x performance improvement (measured on some real Jsonnet code).

0.8.9

This release renames all "library" jsonnet files to .libsonnet as proposed some months ago. This is just a convention, it does not affect evaluation of Jsonnet configs. As with all conventions, users can adopt it... or ignore it :)

This release also has some new language features:

Named params, default arguments

As in Python, you can provide default arguments to functions, e.g.


local add(x, y=3) = x + y;
add(6)


and also bind arguments to parameters by name instead of by position:


add(x=6)


The syntax and semantics matches Python but without _args and *_kwargs.

Top-level arguments

This is a more principled way of parameterizing an entire config. Previously the only way to do that was with `std.extVar`, but this created a global variable of sorts. Code anywhere in the config could use it and it in large configs this can become a maintenance hurdle. `std.extVar` still exists but there is a new way where the parameter is scoped only to the main or root file of the config, and has to be explicitly threaded to imported files:

Previously a Jsonnet file evaluating to a function would be rejected:


$ jsonnet -e 'function() 42'
RUNTIME ERROR: Couldn't manifest function in JSON output.


Now, such a function is called with no arguments to yield the value that is manifested as JSON. To add arguments, use the new commandline parameters.


Available options for specifying values of 'top-level arguments':
Provide the value as a string:
-A / --tla-str <var>[=<val>] If <val> is omitted, get from environment var <var>
--tla-str-file <var>=<file> Read the string from the file
Provide a value as Jsonnet code:
--tla-code <var>[=<code>] If <code> is omitted, get from environment var <var>
--tla-code-file <var>=<file> Read the code from the file



$ jsonnet -e 'function(a, b, c=3) a + b + c' --tla-code a=1 --tla-code b=2
6


Note that TLAs provide default arguments for the entire config, something that was not possible (but often requested) with std.extVar().

Native functions

Now you can, via the C API (or wrappers, e.g. Python) add your own native functions to Jsonnet. The purpose of these functions is to expose tricky functionality that you wouldn't want to implement in Jsonnet. E.g. compression, or encryption. Note that these functions must be pure. They must have no side-effects and must give the same return value for the same input. Since Jsonnet is a lazy language, native functions may be called at unusual times, in an unusual order, more times than expected, or not at all. If the functionality being exposed is not naturally pure (e.g. random secret generation), please wrap it in a cache so that subsequent calls with the same params give the same result.

Currently native extensions can have an arbitrary number of parameters but each has to be a primitive (i.e. not an object or an array). One option for now is to wrap the native function in Jsonnet code that calls std.toString() on the value, then parse the JSON on the host language side.

Native extensions can however return arbitrary JSON objects.

Page 4 of 7

© 2025 Safety CLI Cybersecurity Inc. All Rights Reserved.