fix(deps): bump ijson-jcs to 03df9ed for RFC 8785 number ties

CHANGELOG.adoc

@@ -2,13 +2,14 @@
 
 === [Unreleased]
 
-==== Changed — evidence hash is platform-independent
-
-* The attestation evidence hash now feeds `+files_read+` to SHA-256 as an 8-byte
-little-endian `+u64+`, like the other counts, instead of a platform-sized
-`+usize+`. Hashes are unchanged on 64-bit platforms; 32-bit builds now agree
-with them. The computation lives in `+attestation::evidence::evidence_hash+`,
-with a known-answer test whose value comes from coreutils `+sha256sum+`.
+==== Fixed — JCS numbers on decimal ties
+
+* `+ijson-jcs+` is bumped from 3a9a4ee to 03df9ed, which formats numbers with
+`+ryu-js+` (ECMAScript `+Number::toString+`). The old pin printed RFC 8785
+Appendix B vector 0x43143ff3c1cb0959 as `+1424953923781206.3+`; JCS requires
+`+1424953923781206.2+` (ties to even). Any report or attestation holding such a
+float now hashes to the value other JCS implementations compute. A test in
+`+crate::json+` pins the vector.
 
 ==== Fixed — KYAML keys holding a line separator
 

Cargo.toml

@@ -29,7 +29,7 @@ serde = { version = "1.0", features = ["derive"] }
 serde_json = "1.0"
 # JCS (RFC 8785) for JSON artefacts: the estate tool behind JSON-POLICY rule
 # J-1. Not on crates.io, so pinned to a full commit SHA.
-ijson-jcs = { git = "https://github.com/hyperpolymath/ijson-jcs", rev = "3a9a4ee326a968a32b2f152b4faec243a2d00765" }
+ijson-jcs = { git = "https://github.com/hyperpolymath/ijson-jcs", rev = "03df9ed20c1a2e1d6d913b8b20cf0874651bb61a" }
 # Pure safe-Rust YAML (replaces serde_yaml + unsafe-libyaml, RUSTSEC-2024-0449).
 serde-saphyr = "2.0"
 regex = "1.10"

src/json.rs

@@ -61,6 +61,14 @@ mod tests {
         );
     }
 
+    #[test]
+    fn numbers_follow_rfc_8785_on_decimal_ties() {
+        // RFC 8785 Appendix B: binary64 0x43143ff3c1cb0959 must print as
+        // ECMAScript does, choosing the even digit on a decimal tie.
+        let tie = f64::from_bits(0x4314_3ff3_c1cb_0959);
+        assert_eq!(to_canonical_string(&tie).unwrap(), "1424953923781206.2\n");
+    }
+
     #[test]
     fn rejects_integers_outside_i_json_range() {
         // I-JSON safe integers: [-(2^53 - 1), 2^53 - 1].