Changelog

All notable changes to phil/structured-data will be documented in this file.

Updates should follow the Keep a CHANGELOG principles.

0.1.1-alpha - 2026-11-11

Security

• The Validator reads an address property (url, sameAs, image…) by phil/url, as a browser reads it, no longer by parse_url(), which took a user name for a host: https://example.com@evil.example/, which leads to evil.example, passed as valid. An address with a user name or a password, or whose host is an IP address (https://127.0.0.1/, https://2130706433/), a single name, an empty label (https://example..com/) or an escape (https://%zz.example/), or with port 0, is now an invalid-url error.

Added

• Validator's allowLocalhost, false by default, kept by withRules(): true, in development and tests, makes an address on localhost or under .localhost valid; an IP address stays an invalid-url.
• Schema::allowLocalhost(), for the factories: true, once in development and tests, lets the nodes built after hold an address on localhost or under .localhost.

Changed

• The package requires phil/url 0.1.3.

0.1.0-alpha - 2026-11-11

Added

• Node: an immutable schema.org node with its types, its @id and its properties — texts, numbers, booleans, dates written as ISO 8601, backed enums written as their values, language strings, references, nested nodes and lists of them —, its terms and identifiers checked, 32 levels deep at most; Node::fromArray() reads schema.org data as JSON-LD decodes it; mergedWith() merges two nodes of one thing.
• Reference, LanguageString, LanguageTag (BCP 47 tags, locales with underscores read too) and Id, whose Id::of() makes stable identifiers of an address and a fragment; InvalidStructuredData.
• Graph: the nodes of a page, merged by @id where the first stands, nested nodes with an @id lifted to the top and replaced by references, the language of its texts written in its context, 10,000 nodes at most.
• Factories of Thing, WebSite (with its SearchAction), WebPage, BreadcrumbList, Organization, LocalBusiness, Person, Event, Place, PostalAddress, Product, Offer, Book, CreativeWork, Article, SoftwareSourceCode, SoftwareApplication, FAQPage and ImageObject, with the enums EventStatus, EventAttendanceMode, ItemAvailability and BookFormat.
• JsonLd: the JSON-LD of a graph, and its one script element with the nonce of a content security policy, unable to be closed by its data.
• Validator, Rules, TypeRules, Report, Issue and Severity: the required and recommended properties of each type and of its parents, dates, addresses, currencies and languages checked, references to missing nodes and untyped nodes reported.
• Schema: the factories of Article, Product, Offer, Event, Place, PostalAddress, Organization, Person, WebSite, WebPage, BreadcrumbList and ImageObject, each node checked by the validator at once and refused with its errors.
• JsonLdReader and Extraction: the JSON-LD elements of a page read back into one graph, bounded for pages written by anyone, with a fuzz target.
• NodeCollector, the port where the parts of an application pour the nodes of a page.
• A benchmark of the assembly and the writing of a page's graph.
• The documentation in doc/, indexed by the README.
• CONTRIBUTING.md, SECURITY.md and CODE_OF_CONDUCT.md.