Bump step-security/harden-runner from 2.21.0 to 2.21.1

Bumps [step-security/harden-runner](https://github.com/step-security/harden-runner) from 2.21.0 to 2.21.1.
- [Release notes](https://github.com/step-security/harden-runner/releases)
- [Commits](https://github.com/step-security/harden-runner/compare/05e31511f85b41b11d1cf0ef85d0992719546e2c...e14015d583714f6e62063499dc959a02595150a1)

---
updated-dependencies:
- dependency-name: step-security/harden-runner
  dependency-version: 2.21.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

.github/workflows/check_amalgamation.yml

@@ -11,7 +11,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
         with:
           egress-policy: audit
 
@@ -34,7 +34,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
         with:
           egress-policy: audit
 

.github/workflows/cifuzz.yml

@@ -9,7 +9,7 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
     - name: Harden Runner
-      uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
       with:
         egress-policy: audit
 

.github/workflows/codeql-analysis.yml

@@ -27,7 +27,7 @@ jobs:
 
     steps:
     - name: Harden Runner
-      uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+      uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
       with:
         egress-policy: audit
 

.github/workflows/comment_check_amalgamation.yml

@@ -19,7 +19,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
         with:
           egress-policy: audit
 

.github/workflows/dependency-review.yml

@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
         with:
           egress-policy: audit
 

.github/workflows/flawfinder.yml

@@ -27,7 +27,7 @@ jobs:
       security-events: write
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
         with:
           egress-policy: audit
 

.github/workflows/labeler.yml

@@ -17,7 +17,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
         with:
           egress-policy: audit
 

.github/workflows/publish_documentation.yml

@@ -26,7 +26,7 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
         with:
           egress-policy: audit
 

.github/workflows/scorecards.yml

@@ -36,7 +36,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
         with:
           egress-policy: audit
 

.github/workflows/semgrep.yml

@@ -32,7 +32,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
         with:
           egress-policy: audit
 

.github/workflows/stale.yml

@@ -16,7 +16,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
         with:
           egress-policy: audit
 

.github/workflows/ubuntu.yml

@@ -35,7 +35,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
         with:
           egress-policy: audit
 
@@ -60,7 +60,7 @@ jobs:
         target: [ci_test_amalgamation, ci_test_single_header, ci_cppcheck, ci_cpplint, ci_reproducible_tests, ci_non_git_tests, ci_offline_testdata, ci_reuse_compliance, ci_test_valgrind]
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
         with:
           egress-policy: audit
 
@@ -118,7 +118,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
         with:
           egress-policy: audit
 
@@ -369,7 +369,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
         with:
           egress-policy: audit
 
@@ -392,7 +392,7 @@ jobs:
         target: [ci_test_examples, ci_test_build_documentation]
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
         with:
           egress-policy: audit
 

docs/mkdocs/docs/api/basic_json/patch.md

@@ -34,10 +34,6 @@ Strong guarantee: if an exception is thrown, there are no changes in the JSON va
   ("add", "remove", "move")
 - Throws [`out_of_range.411`](../../home/exceptions.md#jsonexceptionout_of_range411) if an "add" operation's target
   location has a parent that is neither an object nor an array.
-- Throws [`out_of_range.413`](../../home/exceptions.md#jsonexceptionout_of_range413) if a "remove" operation's target
-  location has a parent that is neither an object nor an array.
-- Throws [`out_of_range.414`](../../home/exceptions.md#jsonexceptionout_of_range414) if a "move" operation's "from"
-  location is a proper prefix of its "path" location.
 - Throws [`other_error.501`](../../home/exceptions.md#jsonexceptionother_error501) if "test" operation was
   unsuccessful.
 
@@ -79,7 +75,3 @@ is thrown. In any case, the original value is not changed: the patch is applied
 - Added in version 2.0.0.
 - Added [`out_of_range.411`](../../home/exceptions.md#jsonexceptionout_of_range411) and stopped relying on an internal assertion when an "add" operation's
   target location has a non-object/non-array parent in version 3.13.0.
-- Added [`out_of_range.413`](../../home/exceptions.md#jsonexceptionout_of_range413) and stopped silently ignoring a "remove" operation whose target
-  location has a non-object/non-array parent in version 3.13.0.
-- Added [`out_of_range.414`](../../home/exceptions.md#jsonexceptionout_of_range414) and rejected a "move" operation whose "from" location is a proper
-  prefix of its "path" location instead of silently producing a corrupted result in version 3.13.0.

docs/mkdocs/docs/api/basic_json/patch_inplace.md

@@ -30,10 +30,6 @@ No guarantees, value may be corrupted by an unsuccessful patch operation.
   ("add", "remove", "move")
 - Throws [`out_of_range.411`](../../home/exceptions.md#jsonexceptionout_of_range411) if an "add" operation's target
   location has a parent that is neither an object nor an array.
-- Throws [`out_of_range.413`](../../home/exceptions.md#jsonexceptionout_of_range413) if a "remove" operation's target
-  location has a parent that is neither an object nor an array.
-- Throws [`out_of_range.414`](../../home/exceptions.md#jsonexceptionout_of_range414) if a "move" operation's "from"
-  location is a proper prefix of its "path" location.
 - Throws [`other_error.501`](../../home/exceptions.md#jsonexceptionother_error501) if "test" operation was
   unsuccessful.
 
@@ -76,7 +72,3 @@ function throws an exception.
 - Added in version 3.11.0.
 - Added [`out_of_range.411`](../../home/exceptions.md#jsonexceptionout_of_range411) and stopped relying on an internal assertion when an "add" operation's
   target location has a non-object/non-array parent in version 3.13.0.
-- Added [`out_of_range.413`](../../home/exceptions.md#jsonexceptionout_of_range413) and stopped silently ignoring a "remove" operation whose target
-  location has a non-object/non-array parent in version 3.13.0.
-- Added [`out_of_range.414`](../../home/exceptions.md#jsonexceptionout_of_range414) and rejected a "move" operation whose "from" location is a proper
-  prefix of its "path" location instead of silently producing a corrupted result in version 3.13.0.

docs/mkdocs/docs/home/exceptions.md

@@ -933,34 +933,6 @@ BSON stores the length of documents, arrays, strings, and binary values in a sig
     [`to_bson`](../api/basic_json/to_bson.md) produced documents with negative length prefixes that
     [`from_bson`](../api/basic_json/from_bson.md) rejected.
 
-### json.exception.out_of_range.413
-
-A JSON Patch `remove` operation cannot be applied because the target location's parent is neither an object nor an array. Per [RFC 6902](https://datatracker.ietf.org/doc/html/rfc6902), a `remove` target must reference a member of an existing object or an element of an existing array; a primitive value (string, number, boolean, etc.) or `null` has no members or elements to remove.
-
-!!! failure "Example message"
-
-    ```
-    cannot remove value: the JSON Patch 'remove' target's parent is of type number, but must be an object or array
-    ```
-
-!!! note
-
-    This exception was added in version 3.13.0. Before that, this situation was silently ignored (the `remove` operation had no effect).
-
-### json.exception.out_of_range.414
-
-A JSON Patch `move` operation's `"from"` location is a proper prefix of its `"path"` location. Per [RFC 6902](https://datatracker.ietf.org/doc/html/rfc6902) (section 4.4), a location cannot be moved into one of its own children.
-
-!!! failure "Example message"
-
-    ```
-    cannot move value: 'from' path '/0' is a proper prefix of 'path' '/0/0'
-    ```
-
-!!! note
-
-    This exception was added in version 3.13.0. Before that, this situation could succeed with a corrupted result: for an array target, removing the "from" element before the "add" step shifted subsequent indices, so "path" silently re-resolved to a different element than intended.
-
 ## Further exceptions
 
 This exception is thrown in case of errors that cannot be classified with the

include/nlohmann/json.hpp

@@ -4939,36 +4939,6 @@ class basic_json // NOLINT(cppcoreguidelines-special-member-functions,hicpp-spec
                 // note erase performs range check
                 parent.erase(json_pointer::template array_index<basic_json_t>(last_path));
             }
-            else
-            {
-                // the parent of a "remove" target must be an object or array
-                // (see #5396)
-                JSON_THROW(out_of_range::create(413, detail::concat("cannot remove value: the JSON Patch 'remove' target's parent is of type ", parent.type_name(), ", but must be an object or array"), &parent));
-            }
-        };
-
-        // RFC 6902 (section 4.4) forbids "from" from being a proper prefix
-        // of "path" for a "move" operation: a location cannot be moved into
-        // one of its own children. Compares reference tokens (already
-        // unescaped by json_pointer's parser) rather than the raw pointer
-        // strings, since a token may itself contain an escaped '/' or '~'
-        // that would defeat a naive string-prefix comparison. "from" equal
-        // to "path" is *not* a proper prefix and must return false.
-        const auto is_proper_prefix = [](const json_pointer & from, const json_pointer & to)
-        {
-            const auto from_size = from.reference_tokens.size();
-            if (from_size >= to.reference_tokens.size())
-            {
-                return false;
-            }
-            for (std::size_t i = 0; i < from_size; ++i)
-            {
-                if (!(from.reference_tokens[i] == to.reference_tokens[i]))
-                {
-                    return false;
-                }
-            }
-            return true;
         };
 
         // type check: top level value must be an array
@@ -5046,11 +5016,6 @@ class basic_json // NOLINT(cppcoreguidelines-special-member-functions,hicpp-spec
                     const auto from_path = get_value("move", "from", true).template get<string_t>();
                     json_pointer from_ptr(from_path);
 
-                    if (JSON_HEDLEY_UNLIKELY(is_proper_prefix(from_ptr, ptr)))
-                    {
-                        JSON_THROW(out_of_range::create(414, detail::concat("cannot move value: 'from' path '", from_path, "' is a proper prefix of 'path' '", path, "'"), &result));
-                    }
-
                     // the "from" location must exist - use at()
                     basic_json const v = result.at(from_ptr);
 

single_include/nlohmann/json.hpp

@@ -26367,36 +26367,6 @@ class basic_json // NOLINT(cppcoreguidelines-special-member-functions,hicpp-spec
                 // note erase performs range check
                 parent.erase(json_pointer::template array_index<basic_json_t>(last_path));
             }
-            else
-            {
-                // the parent of a "remove" target must be an object or array
-                // (see #5396)
-                JSON_THROW(out_of_range::create(413, detail::concat("cannot remove value: the JSON Patch 'remove' target's parent is of type ", parent.type_name(), ", but must be an object or array"), &parent));
-            }
-        };
-
-        // RFC 6902 (section 4.4) forbids "from" from being a proper prefix
-        // of "path" for a "move" operation: a location cannot be moved into
-        // one of its own children. Compares reference tokens (already
-        // unescaped by json_pointer's parser) rather than the raw pointer
-        // strings, since a token may itself contain an escaped '/' or '~'
-        // that would defeat a naive string-prefix comparison. "from" equal
-        // to "path" is *not* a proper prefix and must return false.
-        const auto is_proper_prefix = [](const json_pointer & from, const json_pointer & to)
-        {
-            const auto from_size = from.reference_tokens.size();
-            if (from_size >= to.reference_tokens.size())
-            {
-                return false;
-            }
-            for (std::size_t i = 0; i < from_size; ++i)
-            {
-                if (!(from.reference_tokens[i] == to.reference_tokens[i]))
-                {
-                    return false;
-                }
-            }
-            return true;
         };
 
         // type check: top level value must be an array
@@ -26474,11 +26444,6 @@ class basic_json // NOLINT(cppcoreguidelines-special-member-functions,hicpp-spec
                     const auto from_path = get_value("move", "from", true).template get<string_t>();
                     json_pointer from_ptr(from_path);
 
-                    if (JSON_HEDLEY_UNLIKELY(is_proper_prefix(from_ptr, ptr)))
-                    {
-                        JSON_THROW(out_of_range::create(414, detail::concat("cannot move value: 'from' path '", from_path, "' is a proper prefix of 'path' '", path, "'"), &result));
-                    }
-
                     // the "from" location must exist - use at()
                     basic_json const v = result.at(from_ptr);
 

tests/src/unit-json_patch.cpp

@@ -1389,192 +1389,6 @@ TEST_CASE("JSON patch - add to a primitive parent (regression #4292)")
     }
 }
 
-TEST_CASE("JSON patch - remove with primitive or null parent (regression #5396)")
-{
-    // Regression test for https://github.com/nlohmann/json/issues/5396
-    //
-    // RFC 6902 (§4.2) requires the target location of a "remove" operation
-    // to exist. When the target's parent resolves to a primitive value or
-    // null, the operation must fail. Previously operation_remove silently
-    // did nothing in this case (neither the "is_object" nor the "is_array"
-    // branch matched, and there was no final "else"), so the patch appeared
-    // to succeed without changing the document. It now throws
-    // out_of_range.413.
-
-    SECTION("parent is a primitive (number)")
-    {
-        json const doc = {{"a", 1}};
-        json const patch = {{{"op", "remove"}, {"path", "/a/b"}}};
-#if JSON_DIAGNOSTICS
-        CHECK_THROWS_WITH_AS(doc.patch(patch), "[json.exception.out_of_range.413] (/a) cannot remove value: the JSON Patch 'remove' target's parent is of type number, but must be an object or array", json::out_of_range&);
-#else
-        CHECK_THROWS_WITH_AS(doc.patch(patch), "[json.exception.out_of_range.413] cannot remove value: the JSON Patch 'remove' target's parent is of type number, but must be an object or array", json::out_of_range&);
-#endif
-    }
-
-    SECTION("parent is a primitive (string)")
-    {
-        json const doc = {{"foo", {{"bar", "a string"}}}};
-        json const patch = {{{"op", "remove"}, {"path", "/foo/bar/baz"}}};
-#if JSON_DIAGNOSTICS
-        CHECK_THROWS_WITH_AS(doc.patch(patch), "[json.exception.out_of_range.413] (/foo/bar) cannot remove value: the JSON Patch 'remove' target's parent is of type string, but must be an object or array", json::out_of_range&);
-#else
-        CHECK_THROWS_WITH_AS(doc.patch(patch), "[json.exception.out_of_range.413] cannot remove value: the JSON Patch 'remove' target's parent is of type string, but must be an object or array", json::out_of_range&);
-#endif
-    }
-
-    SECTION("top-level document is null")
-    {
-        json const doc = nullptr;
-        json const patch = {{{"op", "remove"}, {"path", "/a"}}};
-        CHECK_THROWS_WITH_AS(doc.patch(patch), "[json.exception.out_of_range.413] cannot remove value: the JSON Patch 'remove' target's parent is of type null, but must be an object or array", json::out_of_range&);
-    }
-
-    SECTION("legitimate removes still work")
-    {
-        // object member
-        json const doc1 = {{"a", 1}, {"b", 2}};
-        json const patch1 = {{{"op", "remove"}, {"path", "/a"}}};
-        CHECK(doc1.patch(patch1) == json({{"b", 2}}));
-
-        // array element
-        json const doc2 = R"([1, 2, 3])"_json;
-        json const patch2 = {{{"op", "remove"}, {"path", "/1"}}};
-        CHECK(doc2.patch(patch2) == R"([1, 3])"_json);
-    }
-}
-
-TEST_CASE("JSON patch - move where 'from' is a proper prefix of 'path' (regression #5397)")
-{
-    // Regression test for https://github.com/nlohmann/json/issues/5397
-    //
-    // RFC 6902 (§4.4) forbids "from" from being a proper prefix of "path"
-    // for a "move" operation: "a location cannot be moved into one of its
-    // children." "move" is implemented as remove-then-add; for an object
-    // target this happened to throw anyway as a side effect of the "add"
-    // step re-resolving through the now-removed parent, but for an array
-    // target the removal shifted subsequent indices, so "path" silently
-    // re-resolved to a different element and the operation "succeeded"
-    // with a corrupted result. It now throws out_of_range.414 for both
-    // object and array targets.
-
-    SECTION("array target (from the issue)")
-    {
-        json const doc = R"([[1,2],[3]])"_json;
-        json const patch = {{{"op", "move"}, {"from", "/0"}, {"path", "/0/0"}}};
-#if JSON_DIAGNOSTIC_POSITIONS
-        CHECK_THROWS_WITH_AS(doc.patch(patch), "[json.exception.out_of_range.414] (bytes 0-11) cannot move value: 'from' path '/0' is a proper prefix of 'path' '/0/0'", json::out_of_range&);
-#else
-        CHECK_THROWS_WITH_AS(doc.patch(patch), "[json.exception.out_of_range.414] cannot move value: 'from' path '/0' is a proper prefix of 'path' '/0/0'", json::out_of_range&);
-#endif
-    }
-
-    SECTION("object target")
-    {
-        json const doc = R"({"a": {"b": 1}})"_json;
-        json const patch = {{{"op", "move"}, {"from", "/a"}, {"path", "/a/b"}}};
-#if JSON_DIAGNOSTIC_POSITIONS
-        CHECK_THROWS_WITH_AS(doc.patch(patch), "[json.exception.out_of_range.414] (bytes 0-15) cannot move value: 'from' path '/a' is a proper prefix of 'path' '/a/b'", json::out_of_range&);
-#else
-        CHECK_THROWS_WITH_AS(doc.patch(patch), "[json.exception.out_of_range.414] cannot move value: 'from' path '/a' is a proper prefix of 'path' '/a/b'", json::out_of_range&);
-#endif
-    }
-
-    SECTION("from == path is not a proper prefix and must not be rejected")
-    {
-        // "from" equal to "path" is a no-op move; it is not a *proper*
-        // prefix relationship, so this new check must not reject it.
-        json const doc = R"({"a": 1, "b": 2})"_json;
-        json const patch = {{{"op", "move"}, {"from", "/a"}, {"path", "/a"}}};
-        CHECK(doc.patch(patch) == doc);
-    }
-
-    SECTION("raw string prefix that is not a pointer-token prefix must be allowed")
-    {
-        // "/ab" is a string-prefix of "/abc/x" as raw text, but "ab" and
-        // "abc" are different reference tokens, so this is NOT a
-        // pointer-token prefix relationship and the move must succeed.
-        // This is the key case proving the check compares tokens, not
-        // raw pointer text (a naive std::string prefix/rfind check on
-        // the undecoded pointer would wrongly reject this).
-        json const doc = R"({"ab": 1, "abc": {"x": 2}})"_json;
-        json const patch = {{{"op", "move"}, {"from", "/ab"}, {"path", "/abc/x"}}};
-        json const result = R"({"abc": {"x": 1}})"_json;
-        CHECK(doc.patch(patch) == result);
-    }
-
-    SECTION("escaped reference tokens are compared unescaped")
-    {
-        // "from" is the single token "a/b" (escaped as "a~1b"); "path"
-        // addresses member "x" of that same value, so "from" is a
-        // proper (token-level) prefix of "path" and must be rejected.
-        json const doc = R"({"a/b": {"x": 1}})"_json;
-        json const patch = {{{"op", "move"}, {"from", "/a~1b"}, {"path", "/a~1b/x"}}};
-#if JSON_DIAGNOSTIC_POSITIONS
-        CHECK_THROWS_WITH_AS(doc.patch(patch), "[json.exception.out_of_range.414] (bytes 0-17) cannot move value: 'from' path '/a~1b' is a proper prefix of 'path' '/a~1b/x'", json::out_of_range&);
-#else
-        CHECK_THROWS_WITH_AS(doc.patch(patch), "[json.exception.out_of_range.414] cannot move value: 'from' path '/a~1b' is a proper prefix of 'path' '/a~1b/x'", json::out_of_range&);
-#endif
-    }
-
-    SECTION("ordinary valid moves still work")
-    {
-        // unrelated top-level members
-        json const doc1 = R"({"a": 1, "b": 2})"_json;
-        json const patch1 = {{{"op", "move"}, {"from", "/a"}, {"path", "/c"}}};
-        CHECK(doc1.patch(patch1) == R"({"b": 2, "c": 1})"_json);
-
-        // sibling paths that share a textual prefix but are unrelated
-        json const doc2 = R"({"a": {"x": 1}, "b": {"y": 2}})"_json;
-        json const patch2 = {{{"op", "move"}, {"from", "/a/x"}, {"path", "/b/z"}}};
-        CHECK(doc2.patch(patch2) == R"({"a": {}, "b": {"y": 2, "z": 1}})"_json);
-
-        // "path" is a proper prefix of "from" (the reverse relationship,
-        // which RFC 6902 does not forbid)
-        json const doc3 = R"({"a": {"b": 1}})"_json;
-        json const patch3 = {{{"op", "move"}, {"from", "/a/b"}, {"path", "/a"}}};
-        CHECK(doc3.patch(patch3) == R"({"a": 1})"_json);
-    }
-
-    SECTION("root 'from' is a proper prefix of every non-root 'path'")
-    {
-        // the whole document is a proper prefix of any location inside it
-        json const doc = R"({"a": 1})"_json;
-        json const patch = {{{"op", "move"}, {"from", ""}, {"path", "/a"}}};
-#if JSON_DIAGNOSTIC_POSITIONS
-        CHECK_THROWS_WITH_AS(doc.patch(patch), "[json.exception.out_of_range.414] (bytes 0-8) cannot move value: 'from' path '' is a proper prefix of 'path' '/a'", json::out_of_range&);
-#else
-        CHECK_THROWS_WITH_AS(doc.patch(patch), "[json.exception.out_of_range.414] cannot move value: 'from' path '' is a proper prefix of 'path' '/a'", json::out_of_range&);
-#endif
-    }
-
-    SECTION("root 'path' is never a proper prefix violation for a non-root 'from'")
-    {
-        // the reverse of the above: moving a non-root location to the root
-        // is the "path is a prefix of from" relationship, which RFC 6902
-        // permits (already covered generally above; this pins the root
-        // case specifically, since root is the one path with no reference
-        // tokens at all)
-        json const doc = R"({"a": {"b": 1}})"_json;
-        json const patch = {{{"op", "move"}, {"from", "/a"}, {"path", ""}}};
-        CHECK(doc.patch(patch) == R"({"b": 1})"_json);
-    }
-
-    SECTION("the array-append token '-' is an ordinary child token")
-    {
-        // "-" (append-to-array) addresses a location *inside* the array,
-        // so "from" pointing at the array is still a proper prefix of
-        // "path" ending in "-" and must be rejected like any other child.
-        json const doc = R"({"a": [1, 2]})"_json;
-        json const patch = {{{"op", "move"}, {"from", "/a"}, {"path", "/a/-"}}};
-#if JSON_DIAGNOSTIC_POSITIONS
-        CHECK_THROWS_WITH_AS(doc.patch(patch), "[json.exception.out_of_range.414] (bytes 0-13) cannot move value: 'from' path '/a' is a proper prefix of 'path' '/a/-'", json::out_of_range&);
-#else
-        CHECK_THROWS_WITH_AS(doc.patch(patch), "[json.exception.out_of_range.414] cannot move value: 'from' path '/a' is a proper prefix of 'path' '/a/-'", json::out_of_range&);
-#endif
-    }
-}
-
 TEST_CASE("JSON patch - diff emits array removals in descending index order")
 {
     SECTION("array shrunk to empty")