fix: eliminate panics, restore Sprig math parity, fix mixed numeric comparisons

Bump version to 0.7.6.

Panic fixes (user-triggerable, no longer reachable):
- utils::unqote: guard the 2-byte slice against non-char-boundary and short
  inputs. A string literal containing a backslash followed by a multibyte
  character (e.g. `\…`) panicked with `byte index 2 is not a char boundary`.
- helm_functions::logic::value_is_truthy: `n.as_f64().unwrap() == 0.0`
  panicked on any integer `Number`, because `gtmpl_value::Number::as_f64`
  only returns `Some` for the float variant. Cascade through as_f64 ->
  as_i64 -> as_u64. This path is used by `default`, `empty`, `coalesce`,
  and `ternary`, so any integer flowing into those crashed the executor.
- helm_functions::string::substr: validate start/end against len and char
  boundaries before slicing. Previously panicked on out-of-bounds, inverted
  ranges, or non-char-boundary indices.
- helm_functions::string::trunc: fix the dead-code `negative` branch (was
  parsed as usize so it was never reached), parse as i64 to accept negative
  indices like Sprig, clamp over-large indices to the full string, and
  validate char boundaries.
- helm_functions::string::abbrev: `max_length - 3` underflowed usize and
  slicing past the end panicked. Return the input unchanged when it fits,
  require at least 4 for a meaningful abbreviation, and validate the cut
  against char boundaries.
- helm_functions::string::abbrevboth: same underflow + out-of-bounds
  pattern; apply Sprig's "too short to abbreviate" semantics.
- helm_functions::conversion: `serde_yaml::Value::Tagged` was hitting
  `unreachable!()`. Recurse into the inner value, discarding the tag.
- mows_functions::crypto::random_string: `parse::<u16>().unwrap()` on the
  length argument and `rng.random_range(0..0)` on an empty charset both
  panicked. Return clean errors instead.

Core numeric comparison fix (no feature flag required):
- funcs::cmp: mixed int/float comparisons like `{{ lt 5 3.5 }}` returned
  `unable to compare 5 and 3.5` because the function short-circuited on
  `as_f64()` which only succeeds for the float variant. Now tries exact
  i64, then exact u64, then falls back to coercing both sides to f64 via
  a shared `number_to_f64` helper that cascades through all variants.
  Affects `lt`, `le`, `gt`, `ge`.

Helm/Sprig math parity (helm-functions feature):
- Rewrite helm_functions::math to match Sprig semantics exactly.
  Integer functions (add, sub, mul, div, mod, pow, add1, max, min) now
  operate on i64 and return `Value::Number` (previously returned
  `Value::String`, which broke numeric pipelines). Float functions
  (addf, subf, mulf, divf, add1f, maxf, minf, floor, ceil, round)
  operate on f64 and return `Value::Number`. `add` and `mul` are
  variadic to match Sprig. Division and modulo by zero return a clean
  error instead of panicking (divergence from Go/Sprig, required to
  preserve the no-panic invariant). Wrapping arithmetic matches Go's
  int64 behaviour.
- Shared `to_i64` / `to_f64` helpers implement Sprig's toInt64/toFloat64
  coercion (numbers, strings, bools, nil).
- helm_functions::conversion: preserve the narrowest numeric variant
  (i64 -> u64 -> f64) when converting from serde_json / serde_yaml, so
  integers from JSON/YAML stay integers through the math pipeline.

Tests:
- tests/panic_regressions.rs: 8 tests covering the original user report
  (URL literal with %5B/%5D), integer/unsigned/zero variants in default,
  and mixed int/float cmp.
- tests/panic_audit.rs: 26 tests exhaustively exercising substr/trunc/
  abbrev/abbrevboth edge cases, tagged YAML values, and the math parity
  across literal/context/JSON/YAML sources with div/mod-by-zero handling.
- helm_functions::math unit tests extended to cover variadic add/mul,
  string inputs, div-by-zero, and fractional-result preservation.

All 269 tests pass under no-features, helm-functions, helm+mows, and
--all-features.

Author: firstdorsal

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "gtmpl-ng"
-version = "0.7.5"
+version = "0.7.6"
 authors = ["Florian Dieminger <me@fiji-flo.de>", "Paul Colin Hennig <8d_fvfmaa-o2wf_79aqig6g2ki6-09ffkeqmyo3d@vindelicum.eu>"]
 description = "The Golang Templating Language for Rust (fork with line number fix and Helm functions)"
 license = "MIT"

src/funcs.rs

@@ -527,16 +527,25 @@ ge(a: ref Value, b: ref Value) -> Result<Value, FuncError> {
 fn cmp(left: &Value, right: &Value) -> Option<Ordering> {
     match (left, right) {
         (&Value::Number(ref l), &Value::Number(ref r)) => {
-            if let (Some(lf), Some(rf)) = (l.as_f64(), r.as_f64()) {
-                return lf.partial_cmp(&rf);
-            }
+            // Exact integer comparison when both sides fit in i64.
             if let (Some(li), Some(ri)) = (l.as_i64(), r.as_i64()) {
                 return li.partial_cmp(&ri);
             }
+            // Exact unsigned comparison for values outside the i64 range.
             if let (Some(lu), Some(ru)) = (l.as_u64(), r.as_u64()) {
                 return lu.partial_cmp(&ru);
             }
-            None
+            // Mixed int/float or disjoint signed/unsigned ranges: coerce
+            // both sides to f64. This is lossy for integers beyond the
+            // f64 mantissa, but matches Go's numeric-comparison semantics
+            // and — crucially — never returns `None` for an otherwise
+            // comparable pair of numbers. Previously, the function checked
+            // `as_f64` first and short-circuited `None` for any value that
+            // happened to be stored as an integer variant, so e.g.
+            // `lt 5 3.5` reported "unable to compare".
+            let lf = number_to_f64(l)?;
+            let rf = number_to_f64(r)?;
+            lf.partial_cmp(&rf)
         }
         (&Value::Bool(ref l), &Value::Bool(ref r)) => l.partial_cmp(r),
         (&Value::String(ref l), &Value::String(ref r)) => l.partial_cmp(r),
@@ -545,6 +554,14 @@ fn cmp(left: &Value, right: &Value) -> Option<Ordering> {
     }
 }
 
+/// Convert any `Number` variant to `f64`, accepting `Num::F`, `Num::I`,
+/// and `Num::U`. Returns `None` only if the library adds a new variant.
+fn number_to_f64(n: &gtmpl_value::Number) -> Option<f64> {
+    n.as_f64()
+        .or_else(|| n.as_i64().map(|i| i as f64))
+        .or_else(|| n.as_u64().map(|u| u as f64))
+}
+
 #[cfg(test)]
 mod tests_mocked {
     use super::*;

src/helm_functions/conversion.rs

@@ -106,7 +106,21 @@ pub fn serde_json_value_to_gtmpl_value(value: serde_json::Value) -> Value {
     match value {
         serde_json::Value::Null => Value::Nil,
         serde_json::Value::Bool(b) => Value::Bool(b),
-        serde_json::Value::Number(n) => Value::Number(n.as_f64().unwrap().into()),
+        // Preserve the narrowest numeric representation so downstream math
+        // functions see an integer as an integer (not a float). Without
+        // this, `fromJson "{\"n\":5}" | .n | add 1` would go through a
+        // float round-trip and lose the integer identity.
+        serde_json::Value::Number(n) => {
+            if let Some(i) = n.as_i64() {
+                Value::Number(i.into())
+            } else if let Some(u) = n.as_u64() {
+                Value::Number(u.into())
+            } else if let Some(f) = n.as_f64() {
+                Value::Number(f.into())
+            } else {
+                Value::Nil
+            }
+        }
         serde_json::Value::String(s) => Value::String(s),
         serde_json::Value::Array(a) => {
             Value::Array(a.into_iter().map(serde_json_value_to_gtmpl_value).collect())
@@ -133,7 +147,19 @@ pub fn serde_yaml_value_to_gtmpl_value(value: serde_yaml::Value) -> Value {
     match value {
         serde_yaml::Value::Null => Value::Nil,
         serde_yaml::Value::Bool(b) => Value::Bool(b),
-        serde_yaml::Value::Number(n) => Value::Number(n.as_f64().unwrap().into()),
+        // Same rationale as serde_json: preserve integer identity so that
+        // math functions behave consistently regardless of numeric source.
+        serde_yaml::Value::Number(n) => {
+            if let Some(i) = n.as_i64() {
+                Value::Number(i.into())
+            } else if let Some(u) = n.as_u64() {
+                Value::Number(u.into())
+            } else if let Some(f) = n.as_f64() {
+                Value::Number(f.into())
+            } else {
+                Value::Nil
+            }
+        }
         serde_yaml::Value::String(s) => Value::String(s),
         serde_yaml::Value::Sequence(a) => {
             Value::Array(a.into_iter().map(serde_yaml_value_to_gtmpl_value).collect())
@@ -148,6 +174,9 @@ pub fn serde_yaml_value_to_gtmpl_value(value: serde_yaml::Value) -> Value {
             }
             gtmpl_object
         }),
-        _ => unreachable!(),
+        // `serde_yaml::Value::Tagged` wraps an inner value with a user tag
+        // (e.g. `!MyTag hello`). Previously this path hit `unreachable!()`
+        // and panicked. Recurse into the inner value, discarding the tag.
+        serde_yaml::Value::Tagged(tagged) => serde_yaml_value_to_gtmpl_value(tagged.value),
     }
 }

src/helm_functions/logic.rs

@@ -73,7 +73,15 @@ pub fn value_is_truthy(value: &Value) -> bool {
         Value::Object(o) => o.is_empty(),
         Value::Map(m) => m.is_empty(),
         Value::Function(_) => false,
-        Value::Number(n) => n.as_f64().unwrap() == 0.0,
+        // `gtmpl_value::Number::as_f64()` only returns `Some` for float
+        // variants, so we must also check integer variants — otherwise any
+        // integer value here would panic with `unwrap()` on `None`.
+        Value::Number(n) => n
+            .as_f64()
+            .map(|f| f == 0.0)
+            .or_else(|| n.as_i64().map(|i| i == 0))
+            .or_else(|| n.as_u64().map(|u| u == 0))
+            .unwrap_or(true),
     }
 }