Bump the npm-prod group across 1 directory with 15 updates

[dependabot]

Bumps the npm-prod group with 15 updates in the / directory:

Package	From	To
@isaacs/ttlcache	1.4.1	2.1.5
@smooai/fetch	3.4.0	3.7.1
@smooai/logger	4.3.0	4.5.4
@standard-schema/spec	1.0.0	1.1.0
arktype	2.1.20	2.2.3
commander	13.1.0	15.0.0
effect	3.22.1	3.22.2
empathic	1.1.0	2.0.1
esm-utils	4.3.0	4.4.2
jiti	2.6.1	2.7.0
json-schema-to-zod	2.6.1	2.8.1
lru-cache	11.1.0	11.5.2
synckit	0.11.12	0.11.13
tsx	4.19.4	4.23.13
valibot	1.4.2	1.5.0

Updates @isaacs/ttlcache from 1.4.1 to 2.1.5

Changelog

Sourced from @​isaacs/ttlcache's changelog.

2.1

• Add updateAgeOnHas and checkAgeOnHas options to match corresponding get() options.
• Include items with Infinity expirations in iterations like entries(), keys(), values().

2.0

• refactor as hybrid typescript module (changes export)
• Blue Oak license

1.4

• add checkAgeOnGet option
• Guard against expiration list going missing

1.3.0

• make cache.cancelTimer a public method
• Reduce memory usage by only creating one timer

1.2

• Add support for immortality
• ensure dispose() only happens after full removal
• Clear timeouts so we don't rely on only unref()
• fix error when deleting immortal entries

1.1

• Add setTTL(key, ttl)
• avoid off-by-1ms purge failures

1.0

• Initial release

Commits

• 5e4ccd2 2.1.5
• 5e4a669 Fix named import in README
• 84fa4c8 update project stuff
• 1476f92 2.1.4
• e101894 stack timers for long TTLs
• fe12fe3 move configs out of package.json to config files
• 4d5e71d 2.1.3
• 93bff3b Fix syntax typo in README example
• 6e15c53 2.1.2
• cbfdbd5 correct test name, use t.clock for regularity
• Additional commits viewable in compare view

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Updates @smooai/fetch from 3.4.0 to 3.7.1

Release notes

Sourced from @​smooai/fetch's releases.

v3.7.1

Patch Changes

• 0518da3: Rust: move the redirect option off RequestInit and onto the builder

  3.7.0 added RequestInit.follow_redirects. Adding a public field to a struct consumers construct is a breaking change in Rust semver, shipped under a minor — building the SmooAI monorepo against 3.7.0 fails with error[E0063]: missing field in 129 exhaustive constructors across ~40 crates.

  The option is now FetchBuilder::with_follow_redirects, matching the shape Go and .NET already use, and RequestInit is back to its 3.6.2 fields. Redirect policy is per-Client in reqwest anyway, so the builder was the right home from the start.

  client::fetch keeps its exact signature; a new client::fetch_with_redirect_policy takes the extra argument, so nothing that compiled against 3.6.2 needs changing.

  3.7.0 is yanked from crates.io. The other four languages were unaffected — Python added a defaulted dataclass field, Go and .NET added builder methods.

v3.7.0

Minor Changes

• 43ca80a: Make redirect handling configurable in all five languages

  Redirects were followed unconditionally everywhere, and TypeScript went further: merge({}, init, { redirect: 'follow' }) put the literal last, so a caller passing redirect: 'manual' had it silently overwritten. Python hardcoded follow_redirects=True into the httpx kwargs; Rust, Go and .NET set nothing and inherited platform defaults that follow up to 10 hops.

  That is a security gap, not just an ergonomic one. A caller who resolves a hostname and checks it against an SSRF allowlist has that guard defeated by a 302 to an internal address, because the check was performed on the original host. And RFC 8461 forbids following redirects when fetching an MTA-STS policy.

  • TypeScript — redirect is honoured (defaults first, caller last)
  • Python — FetchOptions.follow_redirects
  • Rust — RequestInit.follow_redirects: Option<bool> (None inherits, so a client-level default survives a per-request ..Default::default())
  • Go — ClientBuilder.WithFollowRedirects, applied to a caller-supplied *http.Client too
  • .NET — SmooFetchOptions.FollowRedirects / WithFollowRedirects

  Honouring the option was not sufficient on its own: in TS, Rust, Go and .NET a 3xx is neither "ok" nor "redirected", so it was raised as an error and the option was undone a line later. Each now returns a deliberately-unfollowed 3xx as an ordinary response. Defaults are unchanged — everything still follows unless a caller says otherwise.

... (truncated)

Changelog

Sourced from @​smooai/fetch's changelog.

3.7.1

Patch Changes

• 0518da3: Rust: move the redirect option off RequestInit and onto the builder

  3.7.0 added RequestInit.follow_redirects. Adding a public field to a struct consumers construct is a breaking change in Rust semver, shipped under a minor — building the SmooAI monorepo against 3.7.0 fails with error[E0063]: missing field in 129 exhaustive constructors across ~40 crates.

  The option is now FetchBuilder::with_follow_redirects, matching the shape Go and .NET already use, and RequestInit is back to its 3.6.2 fields. Redirect policy is per-Client in reqwest anyway, so the builder was the right home from the start.

  client::fetch keeps its exact signature; a new client::fetch_with_redirect_policy takes the extra argument, so nothing that compiled against 3.6.2 needs changing.

  3.7.0 is yanked from crates.io. The other four languages were unaffected — Python added a defaulted dataclass field, Go and .NET added builder methods.

3.7.0

Minor Changes

• 43ca80a: Make redirect handling configurable in all five languages

  Redirects were followed unconditionally everywhere, and TypeScript went further: merge({}, init, { redirect: 'follow' }) put the literal last, so a caller passing redirect: 'manual' had it silently overwritten. Python hardcoded follow_redirects=True into the httpx kwargs; Rust, Go and .NET set nothing and inherited platform defaults that follow up to 10 hops.

  That is a security gap, not just an ergonomic one. A caller who resolves a hostname and checks it against an SSRF allowlist has that guard defeated by a 302 to an internal address, because the check was performed on the original host. And RFC 8461 forbids following redirects when fetching an MTA-STS policy.

  • TypeScript — redirect is honoured (defaults first, caller last)
  • Python — FetchOptions.follow_redirects
  • Rust — RequestInit.follow_redirects: Option<bool> (None inherits, so a client-level default survives a per-request ..Default::default())
  • Go — ClientBuilder.WithFollowRedirects, applied to a caller-supplied *http.Client too
  • .NET — SmooFetchOptions.FollowRedirects / WithFollowRedirects

  Honouring the option was not sufficient on its own: in TS, Rust, Go and .NET a 3xx is neither "ok" nor "redirected", so it was raised as an error and the option was undone a line later. Each now returns a deliberately-unfollowed 3xx as an ordinary response. Defaults are unchanged — everything still follows unless a

... (truncated)

Commits

• a68fc08 🦋 New version release (#123)
• 0518da3 Rust: move the redirect option onto the builder — 3.7.0 was breaking (#122)
• 1fcfb64 🦋 New version release (#121)
• 43ca80a Make redirect handling configurable in all five languages (th-86dc77) (#120)
• 1dcd136 chore: delete .nvmrc — mise.toml is the toolchain pin now (#119)
• e149b98 chore(ci): bump Go toolchain to 1.26 (#118)
• 072eecb chore(ci): adopt mise, move to Node 24 so npm can do OIDC trusted publishing ...
• 7023068 README: say WHY redaction is TS+Rust, so it stops reading as a parity gap (#116)
• 5c7c733 🦋 New version release (#115)
• 8781ce8 Two green signals that meant nothing: Go's test cache, and the publish gate (...
• Additional commits viewable in compare view

Updates @smooai/logger from 4.3.0 to 4.5.4

Release notes

Sourced from @​smooai/logger's releases.

v4.5.4

Patch Changes

• 96efa6b: Bump uuid to ^11.1.1, gate each registry publish on that registry, and stop Go caching the parity corpus.
  • uuid 9.0.1 → 11.1.1. The moderate advisory (missing buffer bounds check in v3/v5/v6 when buf is provided) is not reachable here — logger only ever calls v4() with no arguments — but every consumer of @smooai/logger was inheriting the advisory and having to carry its own pnpm.overrides pin. Fixed at the source instead. @types/uuid dropped; uuid 11 ships its own.
  • Publish steps no longer gate on steps.changesets.outputs.published. That output is true only when the publish command shipped something in that run, so a run that died after npm left the other four behind — and the follow-up run, with no changesets left, reported published=false, skipped all four, and went green having published nothing. That is exactly how 4.5.1 and 4.5.2 stranded crates.io, NuGet and the Go tag at 4.5.0. Each step now asks its own registry whether the version is already there, which also lets a re-run heal a partial release.
  • go:test gains -count=1. Go currently refuses to cache parity_corpus_test.go because it reads ../parity-corpus.json from outside the package dir — verified — but a parity guarantee should not rest on that.

v4.5.3

Patch Changes

• be2b735: Commit the repo's formatting and stop the release pipeline from dirtying its own working tree.

  Dropping cargo publish --allow-dirty surfaced what the flag had been hiding: release.yml's own Format step ran pnpm format, which rewrites files and never commits them, so cargo publish a few steps later saw a dirty tree. Every crate published from this repo silently carried uncommitted reformatting.

  main was format-drifted across seven files with nothing checking — PR checks ran oxlint but never a formatter, and pnpm format:check did not exist.

  • The formatting is committed; pnpm format is now a no-op on main.
  • New format:check (oxfmt + ruff + cargo fmt + gofmt) runs in PR checks.
  • release.yml's Format becomes Format check — check, never rewrite.
  • The changesets version lifecycle now ends with oxfmt --write CHANGELOG.md package.json, because changeset version emits both in a shape oxfmt disagrees with; without it the next release PR would land unformatted and break cargo publish --locked again.

  This release also re-publishes to crates.io, NuGet, and the Go module tag, which stalled at 4.5.0 while npm and PyPI went to 4.5.2.

v4.5.2

Patch Changes

• ad58fce: Sync non-npm manifest versions during the version bump instead of after publish, and guard it.

  ci:publish ran pnpm build && changeset publish && pnpm version:sync — the sync happened after the publish, mutating manifests in the CI workspace that were then thrown away. So every git tag shipped stale version constants, and cargo publish --allow-dirty existed only to paper over the dirt. With 4.4.0 published on npm, the repo was carrying 3.2.3 in python/pyproject.toml, python/uv.lock and go/version.go, 3.1.2 in rust/logger/Cargo.toml

... (truncated)

Changelog

Sourced from @​smooai/logger's changelog.

4.5.4

Patch Changes

• 96efa6b: Bump uuid to ^11.1.1, gate each registry publish on that registry, and stop Go caching the parity corpus.
  • uuid 9.0.1 → 11.1.1. The moderate advisory (missing buffer bounds check in v3/v5/v6 when buf is provided) is not reachable here — logger only ever calls v4() with no arguments — but every consumer of @smooai/logger was inheriting the advisory and having to carry its own pnpm.overrides pin. Fixed at the source instead. @types/uuid dropped; uuid 11 ships its own.
  • Publish steps no longer gate on steps.changesets.outputs.published. That output is true only when the publish command shipped something in that run, so a run that died after npm left the other four behind — and the follow-up run, with no changesets left, reported published=false, skipped all four, and went green having published nothing. That is exactly how 4.5.1 and 4.5.2 stranded crates.io, NuGet and the Go tag at 4.5.0. Each step now asks its own registry whether the version is already there, which also lets a re-run heal a partial release.
  • go:test gains -count=1. Go currently refuses to cache parity_corpus_test.go because it reads ../parity-corpus.json from outside the package dir — verified — but a parity guarantee should not rest on that.

4.5.3

Patch Changes

• be2b735: Commit the repo's formatting and stop the release pipeline from dirtying its own working tree.

  Dropping cargo publish --allow-dirty surfaced what the flag had been hiding: release.yml's own Format step ran pnpm format, which rewrites files and never commits them, so cargo publish a few steps later saw a dirty tree. Every crate published from this repo silently carried uncommitted reformatting.

  main was format-drifted across seven files with nothing checking — PR checks ran oxlint but never a formatter, and pnpm format:check did not exist.

  • The formatting is committed; pnpm format is now a no-op on main.
  • New format:check (oxfmt + ruff + cargo fmt + gofmt) runs in PR checks.
  • release.yml's Format becomes Format check — check, never rewrite.
  • The changesets version lifecycle now ends with oxfmt --write CHANGELOG.md package.json, because changeset version emits both in a shape oxfmt disagrees with; without it the next release PR would land unformatted and break cargo publish --locked again.

  This release also re-publishes to crates.io, NuGet, and the Go module tag, which stalled at 4.5.0 while npm and PyPI went to 4.5.2.

4.5.2

Patch Changes

• ad58fce: Sync non-npm manifest versions during the version bump instead of after publish, and guard it.

  ci:publish ran pnpm build && changeset publish && pnpm version:sync — the sync happened after the publish, mutating manifests in the CI workspace that were then thrown away. So every

... (truncated)

Commits

• 7da6390 🦋 New version release (#195)
• 96efa6b Bump uuid, gate publishes per-registry, and stop Go caching the corpus (#194)
• 0ae6414 🦋 New version release (#193)
• be2b735 Commit the formatting, and stop the release from dirtying its own tree (#192)
• 3da9740 Stop the release reporting failure when the changeset PR is already green (#191)
• 6a96863 🦋 New version release (#190)
• 83fdb83 Sync the non-npm manifests to 4.5.1 (one-time, unblocks the release) (#189)
• 1301d0b 🦋 New version release (#188)
• ad58fce Sync manifest versions during the bump, not after publish, and guard it (#186)
• cb917c2 Make the parity corpus real: five loaders, and a Python drift it caught (#183)
• Additional commits viewable in compare view

Updates @standard-schema/spec from 1.0.0 to 1.1.0

Release notes

Sourced from @​standard-schema/spec's releases.

v1.1.0

Adds the Standard JSON Schema specification.

Please refer to the README and standardschema.dev for more details.

Commits

• 2c4e37f Merge pull request #134 from standard-schema/json-schema
• 395ee95 Add json-integrate
• 1a5ccf3 Improve json-integrate
• 1dbb6d2 Improve docs
• b081dbb Update site
• 87bc20f Add pullfrog.yml workflow
• 3a1b9ea Add examples table
• f16ef72 Update website
• ea2436d Update JSON Schema compatibility table with Valibot details
• 727c24a update arktype implementation version and pr
• Additional commits viewable in compare view

Updates arktype from 2.1.20 to 2.2.3

Changelog

Sourced from arktype's changelog.

2.2.3

Fix type.fn.raw throwing at runtime

type.fn.raw is documented as an untyped alias of type.fn, but was undefined at runtime and threw type.fn.raw is not a function when called. It now references the underlying parser directly, so it parses, runs, and validates like type.fn without type-level inference. Thanks to @​aarsh767.

Anchor versioned UUID validation

string.uuid no longer accepts strings that merely contain a UUID. The internal #versioned pattern is now anchored like the individual version keywords, so leading or trailing content is rejected. Thanks to @​WolfieLeader.

Fix inferred output of declared morphs

The output side of a declared definition now wraps its preinferred value in Out<...>, matching the inference of the equivalent definition without declare. Thanks to @​eralmansouri.

Allow Object.prototype method names as keys

Keys like constructor, toString, and hasOwnProperty are no longer incorrectly reported as duplicate keys, since duplicate detection now uses a prototype-free record. Thanks to @​kaigritun.

2.2.2

Fix precompilation of private aliases

A private alias referenced only within its own scope is no longer skipped during JIT precompilation, so its optimized traversal is bound correctly instead of falling back to the unbound reference.

Harden ArkErrors JSON serialization

ArkErrors doubles as a Standard Schema issues array, so JSON.stringify no longer assumes every indexed entry is an ArkError with a toJSON method (e.g. plain issue-shaped entries from other validators). Inherited array methods (map, filter, slice, …) now return a plain Array via Symbol.species, preventing callbacks that return primitives from producing a malformed ArkErrors.

2.2.1

Improve regex inference for zero-min quantifiers on numeric patterns

// was: Regex<`${number}`>
// now: Regex<"" | `${number}`>
regex("^\\d*$")

See arkregex CHANGELOG for full notes.

2.2.0

Full announcement: https://arktype.io/docs/blog/2.2

type.fn - Validated functions

Define functions with runtime-validated parameters and return types. Supports defaults, optionals, and variadics.

const len = type.fn("string | unknown[]", ":", "number")(s => s.length)
</tr></table> 

... (truncated)

Commits

• 03b1f01 release: arktype 2.2.3 + dependents (#1635)
• eb93f33 fix: allow prototype method names as object keys (#1586)
• f067dbf fix declare type issue (#1578) (#1579)
• b18db2c fix(type): anchor UUID #versioned regex to reject partial matches (#1602)
• 07a9e9c fix(type): wire up type.fn.raw at runtime (#1631)
• ab66f64 release: arktype 2.2.2 + dependents (#1633)
• 11e2e49 fix private alias precompilation (#1632)
• d0c43a9 refactor(repo): drop tsx, rely on native Node type stripping (#1620)
• 93cb501 release: arkregex 0.0.6 + dependents; publish @​ark/fast-check
• 3ad19d5 2.2.0 (#1594)
• Additional commits viewable in compare view

Updates commander from 13.1.0 to 15.0.0

Release notes

Sourced from commander's releases.

v15.0.0

Commander 15 is ESM only. This is expected to be seamless for ESM consumers, but some CommonJS consumers may hit issues with tooling requiring configuration for ESM-only dependencies. See Migration Tips below.

The release of Commander 15 moves Commander 14 into maintenance. Commander 14 will get security updates for 12 months (to May 2027). For more info see Release Policy.

Added

• show excess command-arguments in error message (#2384)

Fixed

• Breaking: only lone --no-* option sets default option value to true, default not implicitly set when define both positive and negative option in either order (#2405)
• update example to use compatible character for MINGW64 (#2475)

Changed

• Breaking: migrated Commander implementation from CommonJS to ESM (#2464)
• Breaking: Commander 15 requires Node.js v22.12.0 or higher (for require(esm)).
• dev: switch tests from Jest to node:test test runner (#2463)

Deleted

• Breaking: removed deprecated export of commander/esm.mjs (#2464)

Migration Tips

Commander 15 is ESM only, but this does not mean you need to migrate to ESM to use it. Importing ESM from CommonJS is supported by Node.js, and Bun, and Deno. Hopefully it Just Works for you! However, you may be using a different runtime or some other part of your setup that may not yet natively support importing ESM from CommonJS, such as your testing framework or bundler.

If you have problems using Commander 15 in your environment, one option is stay on Commander 14 for now. Commander 14 will get security updates until May 2027 and things will hopefully improve for your setup in the meantime.

v15.0.0-0

Commander 15 is ESM only. This is expected to be seamless for ESM consumers, but some CommonJS consumers may hit issues with tooling requiring configuration for ESM-only dependencies. See Migration Tips below.

The release of Commander 15 in May 2026 will move Commander 14 into maintenance. Commander 14 will get security updates for 12 months (to May 2027). For more info see Release Policy.

Added

• show excess command-arguments in error message (#2384)

Fixed

• Breaking: only lone --no-* option sets default option value to true, default not implicitly set when define both positive and negative option in either order (#2405)
• update example to use compatible character for MINGW64 (#2475)

... (truncated)

Changelog

Sourced from commander's changelog.

[15.0.0] (2026-05-29)

Commander 15 is ESM only. This is expected to be seamless for ESM consumers, but some CommonJS consumers may hit issues with tooling requiring configuration for ESM-only dependencies. See Migration Tips below.

The release of Commander 15 moves Commander 14 into maintenance. Commander 14 will get security updates for 12 months (to May 2027). For more info see Release Policy.

Added

• show excess command-arguments in error message (#2384)

Fixed

• Breaking: only lone --no-* option sets default option value to true, default not implicitly set when define both positive and negative option in either order (#2405)
• update example to use compatible character for MINGW64 (#2475)

Changed

• Breaking: migrated Commander implementation from CommonJS to ESM (#2464)
• Breaking: Commander 15 requires Node.js v22.12.0 or higher (for require(esm)).
• dev: switch tests from Jest to node:test test runner (#2463)

Deleted

• Breaking: removed deprecated export of commander/esm.mjs (#2464)

Migration Tips

Commander 15 is ESM only, but this does not mean you need to migrate to ESM to use it. Importing ESM from CommonJS is supported by Node.js, and Bun, and Deno. Hopefully it Just Works for you! However, you may be using a different runtime or some other part of your setup that may not yet natively support importing ESM from CommonJS, such as your testing framework or bundler.

If you have problems using Commander 15 in your environment, one option is stay on Commander 14 for now. Commander 14 will get security updates until May 2027 and things will hopefully improve for your setup in the meantime.

[15.0.0-0] (2026-02-22)

(Released as 15.0.0)

[14.0.3] (2026-01-31)

Added

• Release Policy document (#2462)

Changes

• old major versions now supported for 12 months instead of just previous major version, to give predictable end-of-life date (#2462)
• clarify typing for deprecated callback parameter to .outputHelp() (#2427)

... (truncated)

Commits

• ba6d13d Fix release dates in changelog (#2523)
• a752ed9 Pin GitHub actions with hash (#2521)
• 74d5dfe Drop EOL node 20 from test matrix, and add node 26 (#2520)
• 6df9b68 Update details for 15.0.0 release (#2519)
• 01ce5d0 Remove jest esm examples (#2517)
• d785d8b Update dependencies (#2518)
• 9098b48 Update dependencies (#2506)
• 373f660 Use node:util stripVTControlCharacters instead of own code (#2486)
• 987f289 Use simple match in test (to avoid warning about expensive regex) (#2485)
• 0ea3bb3 Update dependecies and lint (#2489)
• Additional commits viewable in compare view

Updates effect from 3.22.1 to 3.22.2

Release notes

Sourced from effect's releases.

effect@3.22.2

Patch Changes

• #6233 291d5a9 Thanks @​mvanhorn! - Fix TMap.remove and removeAll erroneously clearing entire bucket on hash collision.

• #7170 7c6e1e5 Thanks @​thewilkybarkid! - Fix use of Schema.NonEmptyArrayEnsure with strings

Changelog

Sourced from effect's changelog.

3.22.2

Patch Changes

• #6233 291d5a9 Thanks @​mvanhorn! - Fix TMap.remove and removeAll erroneously clearing entire bucket on hash collision.

• #7170 7c6e1e5 Thanks @​thewilkybarkid! - Fix use of Schema.NonEmptyArrayEnsure with strings

Commits

• 6985be0 Version Packages (v3) (#6809)
• 7c6e1e5 Fix use of Schema.NonEmptyArrayEnsure with strings (#7170)
• 291d5a9 fix(effect): TMap.remove/removeAll clears entire bucket on hash collision (#6...
• See full diff in compare view

Updates empathic from 1.1.0 to 2.0.1

Release notes

Sourced from empathic's releases.

v2.0.0

Breaking

• Replaced options.stop (which was exclusive) with options.last (now inclusive): 4076495

  Note: Applies to all exports within empathic/find, empathic/package, and empathic/walk.

Features

• Add find.file() and find.dir() exports: bbe9b42, b441e3b

Chores

• bump oxc versions: 79c3e72, 2b8ca36

---

Full Changelog: lukeed/empathic@v1.1.0...v2.0.0

Commits

• 71fff27 2.0.1
• 410cbe7 fix: add ESM types (#11)
• f77a45a chore(ci): setup npm trusted publishing (#13)
• f5f944a 2.0.0
• 535b41e 2.0.0-next.0
• b441e3b chore: update find.dir fixture
• bbe9b42 feat: add find.file and find.dir exports
• 2b8ca36 chore: regen lockfile
• 79c3e72 chore: bump oxc versions
• 4076495 break: replace options.stop (exclusive) with options.last (inclusive)
• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for empathic since your current version.

Updates esm-utils from 4.3.0 to 4.4.2

Release notes

Sourced from esm-utils's releases.

Release 4.4.2

• Avoid using ??= (de48b32)

Release 4.4.1

What's Changed

• Update dependencies (9d9b018)

Full Changelog: fisker/esm-utils@v4.3.0...v4.4.1

Commits

• 161d53f chore: release v4.4.2
• de48b32 Avoid using ??=
• 1bea617 chore: release v4.4.1
• cc09925 Make ESLint happy
• f3c3d85 Update scripts
• 9d9b018 Update dependencies
• ae95495 chore(deps): update dependency prettier to v3.5.3 (#579)
• ef2d9b4 chore(deps): update dependency sort-package-json to v2.15.1 (#578)
• 621350d chore(deps): update dependency sort-package-json to v2.15.0 (#577)
• f0908d1 chore(deps): update dependency prettier to v3.5.2 (#576)
• Additional commits viewable in compare view

Updates jiti from 2.6.1 to 2.7.0

Release notes

Sourced from jiti's releases.

v2.7.0

compare changes

🚀 Enhancements

• Add explicit resource management (using/await using) support (#422)
• Support opt-in tsconfigPaths (#427)
• Support virtual modules (#428)
• Add jiti/static subpath (#430)

🔥 Performance

• interopDefault: Add caching to reduce proxy overhead by ~2x (#421)

🩹 Fixes

• require: Passthrough resolve options (#412)
• require: Fallback to transpilation when tryNative fails (#413)
• Fallback for ENAMETOOLONG when evaluating esm (#429)

📦 Build

• Upgrade rspack to v2 (55194fb)
• Experimental rolldown config (8c0243f)

✅ Tests

• Ignore jsx test for bun/cjs (3a744ca)

❤️ Contributors

• Pooya Parsa (@​pi0)
• Kricsleo (@​kricsleo)
• Espen Hovlandsdal (@​rexxars)
• Rintaro Itokawa (@​re-taro)
• Matteo Collina (@​mcollina)
• Mario Zechner (@​badlogic)

Changelog

Sourced from jiti's changelog.

v2.7.0

compare changes

🚀 Enhancements

• Add explicit resource management (using/await using) support (#422)
• Support opt-in tsconfigPaths (#427)
• Support virtual modules option (#428)
• Add jiti/static export (#430)

🔥 Performance

• interopDefault: Add caching to reduce proxy overhead by ~2x (#421)

🩹 Fixes

• require: Passthrough resolve options (#412)
• ci: Skip --coverage flag for node 18 (fe264b4)
• require: Fallback to transpilation when tryNative fails (#413)
• Fallback for ENAMETOOLONG when evaluating esm (#429)

📦 Build

• Upgrade rspack (55194fb)
• Experimental rolldown config (8c0243f)

🏡 Chore

• Fix lint issues (4045c7a)
• Update deps (e88ac44)
• Update deps (498e8d7)
• Add missing prettier dep (650bc48)
• Lint (058d91a)
• Init agents.md (c49c54e)
• Update agents.md (4deba16)
• Update deps (08fc868)
• Update tsconfig (8c7822e)
• Update release script (27fe3f2)

✅ Tests

• Ignore jsx test for bun/cjs (3a744ca)
• Update (9ee314f)

🤖 CI

• Update node test matrix (0abda72)

❤️ Contributors

... (truncated)

Commits

• fd3bb28 chore(release): v2.7.0
• 27fe3f2 chore: update release script
• 4fcd2f2 fix: fallback for ENAMETOOLONG when evaluating esm (#429)
• 8c0243f build: experimental rolldown config
• 55194fb build: upgrade rspack
• 0abda72 ci: update node test matrix
• 8c7822e chore: update tsconfig
• 08fc868 chore: update deps
• 5d552e3 feat: add jiti/static export (#430)
• ae790b0 feat: support virtual modules option (#428)
• Additional commits viewable in compare view

Updates json-schema-to-zod from 2.6.1 to 2.8.1

Commits

• See full diff in compare view

Updates lru-cache from 11.1.0 to 11.5.2

Changelog

Sourced from lru-cache's changelog.

cringe lorg

11.5

• Add backgroundFetchSize option, defaulting to 1, to set an effective size for provisional background fetch objects while in flight, if they do not shadow an existing stale entry.

11.4

• Add cache property to status objects, in order to differentiate which cache is emitting the metric or trace.
• Several small bugs regarding fetch behavior edge cases.
  • onInsert does not fire for background fetch internal promises.
  • dispose() and disposeAfter() now fire for the stale value left behind when an in-process background fetch is pre-empted by eviction.
  • fetchMethod that returns a non-Promise value is handled correctly.
  • No Error is created, or abort() signaled, when a background fetch promise is resolved. (Presumably the implementation is done by that point.)

11.3

• Add observability features, expand the coverage of LRUCache.Status objects.

11.2

• Add the perf option to specify performance, Date, or any other object with a now() method that returns a number.

11.1

• Add the onInsert method

11.0

• Drop support for node less than v20

10.4

• Accidental minor update, should've been patch.

10.3

• add forceFetch() method
• set disposeReason to 'expire' when it's the result of a TTL

... (truncated)

Commits

• 16b3a91 11.5.2
• 0b0a77e fire autopurge again if the first time isn't stale
• cd98065 11.5.1
• 281f49d work with exactOptionalPropertyTypes
• 0adc7a5 11.5.0
• 4708153 add backgroundFetchSize option
• 9bed6db formatting changelog
• cd8f37b test: loosen test on onInsert
• c440996 11.4.0
• fdab191 changelog 11.4
• Additional commits viewable in compare view

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.

Updates synckit from 0.11.12 to 0.11.13

Release notes

Sourced from synckit's releases.

v0.11.13

Patch Changes

• #258 e752c6a Thanks @​JounQin! - fix(deps): update dependency @​pkgr/core

Changelog

Sourced from synckit's changelog.

0.11.13

Patch Changes

• #258 e752c6a Thanks @​JounQin! - fix(deps): update dependency @​pkgr/core

Commits

• 05d6be3 chore: release synckit (#259)
• e752c6a fix(deps): update dependency @​pkgr/core (#258)
• See full diff in compare view

Updates tsx from 4.19.4 to 4.23.13

Relea...

Description has been truncated

[changeset-bot]

⚠️ No Changeset found

Latest commit: 1a87d39

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR