[dependabot]

Bumps the npm group with 10 updates:

Package	From	To
@tanstack/eslint-plugin-query	5.104.5	5.105.0
@tanstack/react-query	5.104.5	5.105.0
@tanstack/react-query-devtools	5.104.5	5.105.0
@storybook/tanstack-react	10.6.3	10.6.4
oxc-transform-react	0.155.0	0.156.0
srvx	1.0.7	1.0.8
storybook	10.6.3	10.6.4
ata-validator	1.60.0	1.61.1
@oxfmt/binding-linux-x64-gnu	0.74.0	0.75.0
mutative	2.0.0	2.0.1

Updates @tanstack/eslint-plugin-query from 5.104.5 to 5.105.0

Release notes

Sourced from @​tanstack/eslint-plugin-query's releases.

@​tanstack/eslint-plugin-query@​5.105.0

No changes in this release.

Changelog

Sourced from @​tanstack/eslint-plugin-query's changelog.

5.105.0

No changes in this release.

Commits

• 5cc606e ci: Version Packages (#12301)
• 0c5ec06 chore(eslint-plugin-query/detect-react-query-imports): explain why 'typescrip...
• 7cafffd chore(oxlint.config): enable 'vitest-js/padding-around-test-blocks' and separ...
• 5c7b9db chore(oxlint.config): enable 'vitest/prefer-strict-equal' and assert with 'to...
• 1616702 chore(oxlint.config): enable 'vitest/require-hook' and move setup code into h...
• See full diff in compare view

Updates @tanstack/react-query from 5.104.5 to 5.105.0

Release notes

Sourced from @​tanstack/react-query's releases.

@​tanstack/react-query-devtools@​5.105.0

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-devtools@​5.105.0
  • @​tanstack/react-query@​5.105.0

@​tanstack/react-query-next-experimental@​5.105.0

Patch Changes

• Updated dependencies []:
  • @​tanstack/react-query@​5.105.0

@​tanstack/react-query-persist-client@​5.105.0

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-persist-client-core@​5.105.0
  • @​tanstack/react-query@​5.105.0

@​tanstack/react-query@​5.105.0

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-core@​5.105.0

Changelog

Sourced from @​tanstack/react-query's changelog.

5.105.0

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-core@​5.105.0

Commits

• 5cc606e ci: Version Packages (#12301)
• 14cc330 style(packages): write durations in 'count * unit * 1000' order (#12382)
• d7c0418 chore(react-query/{useQuery,useInfiniteQuery}): remove the unused '@​eslint-re...
• aa3e26b chore(react-query/{HydrationBoundary,utils}): explain why 'react-hooks-js/ref...
• b2801aa test(react-query/useMutation): assert that the mutation settles in the cache ...
• 43636c4 test(react-query/useMutation): wait for the mutation to settle after unmount ...
• 1eed9d9 chore(*): explain why 'vitest-js/valid-expect' is disabled for the 'expectTyp...
• 6bdeb13 test(*/useQuery): rename the 'throwOnError' callback parameter to 'err' to av...
• 86b9f20 test(*/useMutationState): rename the built 'mutation' to 'existingMutation' t...
• d09972b test(*): rename the 'queryKey' test helper to 'createKey' since it creates ke...
• Additional commits viewable in compare view

Updates @tanstack/react-query-devtools from 5.104.5 to 5.105.0

Release notes

Sourced from @​tanstack/react-query-devtools's releases.

@​tanstack/react-query-devtools@​5.105.0

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-devtools@​5.105.0
  • @​tanstack/react-query@​5.105.0

Changelog

Sourced from @​tanstack/react-query-devtools's changelog.

5.105.0

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-devtools@​5.105.0
  • @​tanstack/react-query@​5.105.0

Commits

• 5cc606e ci: Version Packages (#12301)
• a5d5e00 docs(*-devtools): describe how the 'theme' prop interacts with the theme sele...
• 4b2c611 test({query-devtools,react-query-devtools,preact-query-devtools,vue-query}): ...
• bb41f83 chore(oxlint.config): add 'eslint-plugin-testing-library' with its DOM rules ...
• 07bdb6b chore(oxlint.config): enable 'vitest/require-mock-type-parameters' and type t...
• c1dc50c chore(oxlint.config): enable 'vitest/prefer-import-in-mock' and type the modu...
• 22d9966 chore(oxlint.config): enable 'vitest/prefer-called-with' and assert the call ...
• See full diff in compare view

Updates @storybook/tanstack-react from 10.6.3 to 10.6.4

Release notes

Sourced from @​storybook/tanstack-react's releases.

v10.6.4

10.6.4

• Core: Skip TypeScript loader hook registration under Jest - #36790, thanks @​obvious-autobuild!

Changelog

Sourced from @​storybook/tanstack-react's changelog.

10.6.4

• Core: Skip TypeScript loader hook registration under Jest - #36790, thanks @​obvious-autobuild!

Commits

• 303276d Bump version from "10.6.3" to "10.6.4" [skip ci]
• See full diff in compare view

Updates oxc-transform-react from 0.155.0 to 0.156.0

Release notes

Sourced from oxc-transform-react's releases.

oxc crates_v0.156.0

💥 BREAKING CHANGES

• cf8296f ecmascript: [BREAKING] Fold surrogate strings with JSStr constants (#27098) (Dunqing)

🚀 Features

• dd6cb2b minifier: Fold out-of-bounds string indices to void 0 (#28004) (Dunqing)

🐛 Bug Fixes

• f4dac9e semantic: Separate hoisted vars from block type bindings (#27936) (limadog9)
• 9ec6617 minifier: Keep brackets on negative and non-finite numeric keys (#27855) (Yunus Ozen)
• 520a26e minifier: Keep the default in shorthand assignment targets (#28183) (waltu)
• def47b8 react-compiler: Keep manual memoization as written when its dependencies can't be honoured (#28101) (Dunqing)
• 704d8cf transformer_plugins: Keep the bare inject when references to it remain (#26965) (Bharadwaj Pendyala)
• 6d7b372 minifier: Handle sequence exprs when folding if to expr statement (#27939) (Armano)
• e3eca41 runtime: Align async iterator throw with Babel (#28059) (camc314)
• af0258d parser: Parse source imports named type (#28062) (camc314)
• 83633a7 parser: Parse escaped class field names after initializers (#28061) (camc314)
• 90c58ac parser: Parse postfix updates of sloppy let identifiers (#28060) (camc314)
• 0e2934f codegen: Preserve default import names in source maps (#28058) (camc314)
• 09bdb80 minifier: Allow argument rewrite with with leading var assignments (#28056) (Armano)
• ebcdcd9 minifier: Preserve rest destructuring side effects (#27981) (camc314)
• 5c84098 semantic,linter: Report names with lone surrogates in enum and lint checks (#27991) (Dunqing)
• bd70a9b ecmascript: Use ECMAScript whitespace when folding parseFloat/parseInt/trim (#27719) (Dunqing)
• 4c0fa90 minifier,linter: Keep delete of constant members and later JSX keys (#27990) (Dunqing)

⚡ Performance

• 3493ce3 minifier: Reuse is_error_constructor and simplify substitute_global_new_expression (#28149) (Armano)
• a22c9f2 parser: Move annotation comment handling out of hot paths (#28139) (camc314)
• 1ed93af data_structures: Copy short strings without a memcpy call (#27953) (leaysgur)

🛡️ Security

• b93e169 deps: Bump .node-version to 26.12.1 (#28090) (leaysgur)

Changelog

Sourced from oxc-transform-react's changelog.

[0.156.0] - 2026-10-27

🐛 Bug Fixes

• def47b8 react-compiler: Keep manual memoization as written when its dependencies can't be honoured (#28101) (Dunqing)

[0.152.0] - 2026-09-28

🚀 Features

• 3255b89 transform-react: Add reportDiagnostics option to expose recoverable React Compiler diagnostics (#26624) (Jack)
• f585cb4 napi: Add threadless WASI builds (#26898) (Boshen)

[0.148.0] - 2026-08-31

🐛 Bug Fixes

• e74de61 transform-react: Match Babel diagnostic reporting (#26128) (Boshen)

[0.145.0] - 2026-08-18

🐛 Bug Fixes

• 345f981 react_compiler: Skip node_modules by default (#25859) (Boshen)
• dec0a86 react-compiler: Standardize diagnostics (#25702) (Boshen)
• c5f188a react-compiler: Use Babel v1 validation defaults (#25676) (Boshen)
• db44651 napi: Disable reuseWorker in browser bindings (#25640) (leaysgur)
• ce35d47 react_compiler: Preserve JSX import source pragmas (#25592) (Boshen)
• 8d7f9cf react_compiler: Honor eslint suppressions (#25394) (Boshen)

📚 Documentation

• 627466e transform-react: Document all options (#25800) (Boshen)

[0.144.0] - 2026-08-10

🚀 Features

• 9a37c41 napi: Restructure React transform options (#25326) (Boshen)

🐛 Bug Fixes

• 9d19ab3 transform_react: Downgrade nonfatal compiler diagnostics (#25418) (Boshen)
• 937825c react_compiler: Disable exhaustive memo validation by default (#25417) (Boshen)
• 7d8a9b5 react_compiler: Preserve hook spans for React Refresh (#25393) (Boshen)

[0.143.0] - 2026-08-03

🚀 Features

... (truncated)

Commits

• 75efdca release(crates): oxc v0.156.0 (#28190)
• def47b8 fix(react-compiler): keep manual memoization as written when its dependencies...
• See full diff in compare view

Updates srvx from 1.0.7 to 1.0.8

Release notes

Sourced from srvx's releases.

v1.0.8

compare changes

🩹 Fixes

• node: Don't expose derived content-length on materialized FastResponse headers (#337)
• node: Send the head for stream bodies that end without data (#339)

Changelog

Sourced from srvx's changelog.

v1.0.8

compare changes

🩹 Fixes

• node: Don't expose derived content-length on materialized FastResponse headers (#337)
• node: Send the head for stream bodies that end without data (#339)

🏡 Chore

• Update deps (3806369)

🤖 CI

• Run deno vitest via npm specifier to bypass pnpm 12 bin shim (f0ef09c)

❤️ Contributors

• Pooya Parsa (@​pi0)
• Daniel Roe (@​danielroe)

Commits

• a961c16 chore(release): v1.0.8
• f0ef09c ci: run deno vitest via npm specifier to bypass pnpm 12 bin shim
• 3806369 chore: update deps
• 2af7a1b fix(node): send the head for stream bodies that end without data (#339)
• 30fb59a fix(node): don't expose derived content-length on materialized FastResponse h...
• See full diff in compare view

Updates storybook from 10.6.3 to 10.6.4

Release notes

Sourced from storybook's releases.

v10.6.4

10.6.4

• Core: Skip TypeScript loader hook registration under Jest - #36790, thanks @​obvious-autobuild!

Changelog

Sourced from storybook's changelog.

10.6.4

• Core: Skip TypeScript loader hook registration under Jest - #36790, thanks @​obvious-autobuild!

Commits

• 303276d Bump version from "10.6.3" to "10.6.4" [skip ci]
• 1359868 Merge pull request #36790 from storybookjs/fix/import-module-jest-module-regi...
• See full diff in compare view

Updates ata-validator from 1.60.0 to 1.61.1

Release notes

Sourced from ata-validator's releases.

1.61.1

Smaller browser bundles for code compiled by the bundler plugin, and a fix to ata verify.

With @ata-project/unplugin 0.11.1, a form with two validators (one reading errors, one asking only for a verdict) bundles to 10.7 KB gzipped, against 16.7 KB on 1.61.0, or 3.1 KB with richErrors: false on the validator that reads errors. The code stays new Validator(schema); the answers and the error objects are the same as the runtime's.

ata verify now tries values on either side of every bound a schema states, so a module that reads a minimum off by one is caught.

Checked against 1.61.0, interleaved, both from worktrees (Apple M4 Pro, Node 25.2.1, pure JS):

	1.61.0	1.61.1
ten routes to first validated request	9.08 ms	9.03 ms
request accepted, verdict	42.2 ns	41.8 ns
request rejected, error list read	93.7 ns	93.2 ns
same, code generation blocked	501.9 ns	502.4 ns
runtime first load in a browser, gzipped	54,383 B	54,383 B
runtime with its lazy chunks, gzipped	139,438 B	138,944 B
ata-validator/lite, gzipped	57,788 B	57,715 B
compiled user module, gzipped	2,077 B	1,875 B

The package tarball grows to 493.7 KB with the new wrapper entry points.

Added

• ata-validator/compiled-bare-rich: bareRich(mod, schema), the bare wrapper for a validator that reads ata's own errors, the same errors as fromCompiledObject without Standard Schema and the extension hook. @ata-project/unplugin uses it for a validator only ever called; the two-validator form app went from 13.5 to 10.7 KB gzipped. Held to a default Validator in tests/test_compiled_bare.js.
• compiledModuleFor(schema, { verdictOnly: true }) writes the module for a reader that only ever calls isValid(), without its error collector (its validate() hands out the abort-early stub): 954 to 539 bytes gzipped on a one-field object. @ata-project/unplugin writes verdict-wrapper modules this way, and keeps the full module for verify. The richErrors: false form app went from 3.8 to 3.5 KB gzipped.
• ata-validator/compiled-bare: bareVerdict(mod) and barePlain(mod), the smallest compiled-module wrappers (315 bytes gzipped for both), for a validator the bundler plugin sees used only through direct calls of validate() or isValidObject() and never handed to other code, so nothing reads ~standard or registers a check on it. Defaults are filled with the module's own pass; barePlain hands out the plain errors of a plainErrors module. @ata-project/unplugin uses them where that holds: the form app with richErrors: false went from 6.1 to 3.8 KB gzipped. tests/test_compiled_bare.js holds them to the runtime on 22,315 answers over the suite.
• ata-validator/compiled-plain: fromCompiledPlain(mod, schema, { richErrors: false }), the compiled-module wrapper for a Validator built with richErrors: false, around a module written with compiledModuleFor(schema, { plainErrors: true }), whose one-pass program writes errors in that plain shape and order. It hands them out as they are and carries no rejection classes, enrichment or suggestions: 2.6 KB gzipped. @ata-project/unplugin compiles such a validator away with it, where it kept it on the runtime before. A form app with one validator that reads errors and one that asks for a boolean went from 16.7 KB gzipped on 1.61.0 to 6.1 with richErrors: false. tests/test_compiled_plain.js holds it to the runtime on 17,852 answers over the suite in five dialects. Standard Schema reaches the enrichment only for a native engine's message-less error, now through lib/native-message.js, which the browser build maps to a stub, since a browser has no native engine.
• ata-validator/compiled-object: fromCompiledObject(mod, schema), the compiled-module wrapper without validateJSON() and isValidJSON(), for code that reads errors but never validates JSON text. The position map those entry points use to frame an error in the text stays out of the bundle: 10.9 KB gzipped against 12.8 for the full wrapper. @ata-project/unplugin picks it where the replaced validator is never asked to validate JSON text. tests/test_compiled_parity.js holds it to the runtime over the suite.

Changed

• A browser build carries no code for the native engine: lib/native-positions.js, lib/native-codes.js and lib/native-message.js map to one stub (lib/native.browser.js), since the native loader returns null there. The runtime's code generator chunk went from 78,733 to 78,237 bytes gzipped and the whole runtime from 139,438 to 138,944; the first load is unchanged at 54,383.
• A browser's generator checks an email address literal with the IPv6 and IPv4 parsers it carries, and the expression a compiled module uses (lib/email-literal.js) maps to nothing there. The same answers on either form (tests/test_ipv6_expression.js).
• The format codes in lib/error-codes.js are written by one loop; get() and all(), which only tests and scripts read, are gone from it. The table is unchanged, key order included.
• ata-validator/compiled-bare is an ES module of its own rather than a re-export of the CommonJS file, so a bundler adds no interop code: 662 to 315 bytes gzipped.
• The rejection validateJSON() returns moved to lib/json-rejections.js, loaded with the first rejection that carries JSON text, so validate() through a compiled wrapper does not bundle it (532 bytes gzipped) and a process that never rejects JSON text no longer loads lib/diagnostic-source.js. The native engine's ordinal table moved to lib/native-codes.js, which a browser build maps to a stub. ata-validator/lite went from 57,790 to 57,769 bytes gzipped.
• A built-in format under type: string is no longer repeated in the branch for a value of another type, where it could never fire.
• A compiled module that checks format: email reads an address literal (a@[IPv6:...], a@[1.2.3.4]) with two regular expressions instead of the IPv6 and IPv4 parsers it carried inline, which were 72% of the check's source: an email schema's module went from 1,743 to 1,524 bytes gzipped. The answers are the same (tests/test_ipv6_expression.js: the expressions against ipv6() and ipv4() on 400,000 near-addresses each, the emitted check against formats.email on 100,000 literals); the expression lives with the code generator, so the interpreted engine and ata-validator/lite do not carry it.
• The compiled wrappers fill defaults with the module's own applyDefaults (exported by modules from 1.58.0 on when the schema has a default, the same pass as the runtime's), so the defaults engine is no longer in a bundle that wraps current modules: the verdict wrapper went from 2.7 to 1.6 KB gzipped, the full one from 13.8 to 12.8. A module from before 1.58.0, or without its version stamp, takes the runtime's pass as before; in the browser build such a module with defaults is refused with an error that says to rebuild it rather than run without its defaults. tests/test_compiled_defaults_source.js.

Fixed

• ata verify also tries, for every bound a schema states (minimum, maximum, the exclusive ones, multipleOf, minLength, maxLength), a value on either side of it, on a document the runtime accepts. Its random documents rarely land on a bound, so a module that read one off by one (a minimum of 13 written as < 12) answered all 200 of them as the runtime did and passed; it is now caught, with the runtime saying invalid and the module valid. tests/test_verify.js holds the case.

1.61.0

Added

... (truncated)

Changelog

Sourced from ata-validator's changelog.

1.61.1 - 2026-10-26

Added

• ata-validator/compiled-bare-rich: bareRich(mod, schema), the bare wrapper for a validator that reads ata's own errors, the same errors as fromCompiledObject without Standard Schema and the extension hook. @ata-project/unplugin uses it for a validator only ever called; the two-validator form app went from 13.5 to 10.7 KB gzipped. Held to a default Validator in tests/test_compiled_bare.js.
• compiledModuleFor(schema, { verdictOnly: true }) writes the module for a reader that only ever calls isValid(), without its error collector (its validate() hands out the abort-early stub): 954 to 539 bytes gzipped on a one-field object. @ata-project/unplugin writes verdict-wrapper modules this way, and keeps the full module for verify. The richErrors: false form app went from 3.8 to 3.5 KB gzipped.
• ata-validator/compiled-bare: bareVerdict(mod) and barePlain(mod), the smallest compiled-module wrappers (315 bytes gzipped for both), for a validator the bundler plugin sees used only through direct calls of validate() or isValidObject() and never handed to other code, so nothing reads ~standard or registers a check on it. Defaults are filled with the module's own pass; barePlain hands out the plain errors of a plainErrors module. @ata-project/unplugin uses them where that holds: the form app with richErrors: false went from 6.1 to 3.8 KB gzipped. tests/test_compiled_bare.js holds them to the runtime on 22,315 answers over the suite.
• ata-validator/compiled-plain: fromCompiledPlain(mod, schema, { richErrors: false }), the compiled-module wrapper for a Validator built with richErrors: false, around a module written with compiledModuleFor(schema, { plainErrors: true }), whose one-pass program writes errors in that plain shape and order. It hands them out as they are and carries no rejection classes, enrichment or suggestions: 2.6 KB gzipped. @ata-project/unplugin compiles such a validator away with it, where it kept it on the runtime before. A form app with one validator that reads errors and one that asks for a boolean went from 16.7 KB gzipped on 1.61.0 to 6.1 with richErrors: false. tests/test_compiled_plain.js holds it to the runtime on 17,852 answers over the suite in five dialects. Standard Schema reaches the enrichment only for a native engine's message-less error, now through lib/native-message.js, which the browser build maps to a stub, since a browser has no native engine.
• ata-validator/compiled-object: fromCompiledObject(mod, schema), the compiled-module wrapper without validateJSON() and isValidJSON(), for code that reads errors but never validates JSON text. The position map those entry points use to frame an error in the text stays out of the bundle: 10.9 KB gzipped against 12.8 for the full wrapper. @ata-project/unplugin picks it where the replaced validator is never asked to validate JSON text. tests/test_compiled_parity.js holds it to the runtime over the suite.

Changed

• A browser build carries no code for the native engine: lib/native-positions.js, lib/native-codes.js and lib/native-message.js map to one stub (lib/native.browser.js), since the native loader returns null there. The runtime's code generator chunk went from 78,733 to 78,237 bytes gzipped and the whole runtime from 139,438 to 138,944; the first load is unchanged at 54,383.
• A browser's generator checks an email address literal with the IPv6 and IPv4 parsers it carries, and the expression a compiled module uses (lib/email-literal.js) maps to nothing there. The same answers on either form (tests/test_ipv6_expression.js).
• The format codes in lib/error-codes.js are written by one loop; get() and all(), which only tests and scripts read, are gone from it. The table is unchanged, key order included.
• ata-validator/compiled-bare is an ES module of its own rather than a re-export of the CommonJS file, so a bundler adds no interop code: 662 to 315 bytes gzipped.
• The rejection validateJSON() returns moved to lib/json-rejections.js, loaded with the first rejection that carries JSON text, so validate() through a compiled wrapper does not bundle it (532 bytes gzipped) and a process that never rejects JSON text no longer loads lib/diagnostic-source.js. The native engine's ordinal table moved to lib/native-codes.js, which a browser build maps to a stub. ata-validator/lite went from 57,790 to 57,769 bytes gzipped.
• A built-in format under type: string is no longer repeated in the branch for a value of another type, where it could never fire.
• A compiled module that checks format: email reads an address literal (a@[IPv6:...], a@[1.2.3.4]) with two regular expressions instead of the IPv6 and IPv4 parsers it carried inline, which were 72% of the check's source: an email schema's module went from 1,743 to 1,524 bytes gzipped. The answers are the same (tests/test_ipv6_expression.js: the expressions against ipv6() and ipv4() on 400,000 near-addresses each, the emitted check against formats.email on 100,000 literals); the expression lives with the code generator, so the interpreted engine and ata-validator/lite do not carry it.
• The compiled wrappers fill defaults with the module's own applyDefaults (exported by modules from 1.58.0 on when the schema has a default, the same pass as the runtime's), so the defaults engine is no longer in a bundle that wraps current modules: the verdict wrapper went from 2.7 to 1.6 KB gzipped, the full one from 13.8 to 12.8. A module from before 1.58.0, or without its version stamp, takes the runtime's pass as before; in the browser build such a module with defaults is refused with an error that says to rebuild it rather than run without its defaults. tests/test_compiled_defaults_source.js.

Fixed

• ata verify also tries, for every bound a schema states (minimum, maximum, the exclusive ones, multipleOf, minLength, maxLength), a value on either side of it, on a document the runtime accepts. Its random documents rarely land on a bound, so a module that read one off by one (a minimum of 13 written as < 12) answered all 200 of them as the runtime did and passed; it is now caught, with the runtime saying invalid and the module valid. tests/test_verify.js holds the case.

1.61.0 - 2026-10-26

Added

• A schema with a default anywhere (ata fills defaults without being asked, so it has a preprocess pass) now builds its rich errors where they fail, as other schemas do: the path was closed to schemas with a preprocess pass, though it reads the document validate() has already processed. One required error on a four-field user with a defaulted newsletter went from 313 to 248 ns with its error list read; only the one-pass swap, which replaces validate() itself, stays off for such schemas. Found through the fastest-validator comparison in ata-core/validator-benchmarks (issue #74).

• The Node entry warms the engine once the event loop is free: where a validator was built and is still untouched by then (not compiled, no method read off it), one check of a small schema runs, accepted and rejected, so that V8 compiles the generator's functions and the error builders before the first request instead of on it. On a four-field schema with the generator already loaded, a server's first verdict went from 3.1 to 3.4 ms to 0.5 to 0.6, the first error list from 6.7 ms to 0.8, at 1.5 to 2 ms of CPU once. A script that builds and checks in the same tick never runs it, the timer is unref'd, and ATA_NO_WARM=1 turns it off. The browser build has done the same since 1.57.0 (lib/tiering.js); the cold-start benchmarks, which check in the same tick as they build, are unchanged by it. tests/test_node_warm.js holds the conditions.

• ata-validator/build exports bunTarget (the schema as a TypeScript type and the .bun.ts module ata build --target bun writes; with tags: true the split into a type with Bun's Schema tags and a residual schema, made for the typed validator the compiler's pull request carried until 2026-10-25) and verify (verifyOne, verifySource, generate), for a build plugin that replaces new Validator(schema) inside a Bun.build({ compile: { aot: true } }) and holds what it wrote against the runtime.

• ata verify <glob> holds each schema's compiled module against a runtime Validator built from the schema now: documents made from the schema (--generate, 200 by default, half with one rule broken), the project's sample documents (--samples, JSON or JSON Lines files or a directory), verdicts and error lists compared, a module whose schema hash no longer matches the schema reported stale, a non-zero exit on any disagreement, stale or missing module, --json for machines. The check behind the fixes of 1.59.0 and 1.60.0, as a command a project runs in CI.

• ata build --target bun writes a .bun.ts module beside the plain one for executables built with bun build --compile --aot: the schema as a TypeScript type (kinds, properties and which are required, items and fixed tuples, literals, local definitions as named types), isValid as a type guard and validate with the type on them, and parse(text), which declares the type where it parses (under the pull request build of 2026-10-25 that is no faster than a plain parse and the module: 564 to 574 ns against 570 to 578 on a ten-item order, so the file is a type for the program, not a faster path); the module checks the content, so every answer is the module's. A project points the compiler at the file with an "aot" condition in its package.json imports, which nothing else reads. A schema no type can be written for (a remote $ref, $dynamicRef, a root the type says nothing about) gets a warning, an error with --strict, and the plain module alone. The compiler's pull request carried its own typed validator, validate<T> from bun:bundle, until 2026-10-25, and this target was first written for it: the schema split into a type with Bun's Schema tags and a residual schema of the rules the tags do not carry, which on 1024 distinct ten-item orders under the pull request build of 2026-10-24 answered isValid in 96 to 99 ns against 108 for the plain module, and against the official suite never accepted a document the suite refuses (benchmark/proof/aot/suite-differential.mjs, 122 of 384 groups on 2020-12, 105 of 258 on draft 7). That validator left the pull request to return as a change of its own; bunTarget.schemaToBunType(schema, { tags: true }) in ata-validator/build still makes the split, and nothing in ata writes it until then.

• A validator built without engine takes the interpreted engine where the process runs code compiled ahead of time: when Bun reports Bun.isAOT, or when ATA_ENGINE=interpreter is set. Under Bun's ahead-of-time compiler (pull request build) the generated code is interpreted and the interpreted engine is compiled: 80 against 530 ns a document for the same schema, measured in benchmark/proof/aot. engine: 'auto' by name keeps the generated code, and a module from ata build is unaffected, since it is compiled either way (34 ns there). tests/test_aot_engine.js.

• schemaOf<T>(): a placeholder for the JSON Schema of a TypeScript type, written in at build time by @ata-project/unplugin from the type and the JSDoc tags on its properties, so new Validator(schemaOf<User>()) compiles like any static schema. It has no run-time form: a call that reaches the runtime throws with a message naming the plugin, rather than returning an empty schema that accepts everything. Exported from every entry.

Changed

• The standalone module's error collector (the default form, with schema-source frames) reads each property once into a local, names a closed object's declared keys outright instead of a Set lookup per key when there are at most eight, and reuses the node's plain-object flag in that walk instead of reading the prototype again. A rejected ten-item order with its error list built went from 378 to 244 ns on Node (the one-pass form, 102, is unchanged and still opt-in for its size); the module's size does not move. Found by profiling line by line: one closedness walk held 31% of the samples.
• ata build --target bun writes the one-pass error function by default and no schema-source frames, as an executable compiled ahead of time pays no bundle size: a rejected ten-item order with the error list built went from 724 to 189 ns under Bun's compiler (on Node, 378 to 105 against 99 for the runtime). The default for every other build stays the older collector with frames, since the one-pass form is 20% larger gzipped over 60 SchemaStore schemas (53 of them larger by more than 5%, the worst 1.6x); --one-pass and --no-source choose it by hand. The plugin's ahead-of-time path does the same.
• Generated code walks and counts a closed object's keys in the form of the engine it is written for: for...in on V8, where it is the cheaper form, an indexed loop over Object.keys on JavaScriptCore, where for...in is a slow path. The runtime writes for the engine it runs on; ata build --target bun and the plugin's Bun entry write for JavaScriptCore. One form is written, so neither engine pays a branch per object (an earlier form with a load-time flag cost V8 5 to 7% on small schemas). A third form, jsc-aot, is what --target bun and the plugin's ahead-of-time path write: a closed object whose declared keys are all required is checked by reading Object.keys once and comparing it with the declared list in order, the order JSON.parse gives, with a membership walk when the order differs. Under Bun's compiler that put the plain module level with Bun's own validate<T> on a ten-item order (105 to 107 ns against 96 to 105, from 108 to 112); on Bun's JIT the same form loses 5 to 15 ns, which is why it is its own target. The prototype read picks __proto__ on V8 and Object.getPrototypeOf on JavaScriptCore at generation. Measured on a ten-item order: Bun 1.4.4's JIT 65 to 53 ns a document, Bun's ahead-of-time compiler (pull request build) 227 to 108, Node 25 unchanged.

Fixed

• CompiledModule.validate in ata-validator/compiled declares errors as read-only, which is what a module returns for an accepted document (a frozen array); under Bun's ahead-of-time compiler, where a TypeScript error fails the build, a compiled-away validator in a TypeScript file did not build.
• The standalone emitters required lib/aot-order.js and lib/error-runtime.js through a name held in a constant, to keep bundlers for runtimes without fs from following them. An executable compiled ahead of time (Bun) cannot load a module from a computed path and warned about each such require at build time. They are literal requires now, and the package's browser field keeps lib/aot-order.js out of browser and edge bundles instead; the browser, edge and lite bundles and the Workers proof are unchanged. The native engine's loader still tries its optional packages by name, inside a try, which is one warning left under that compiler.

Commits

• b9c404a release: 1.61.1
• 1c25912 perf: browser builds carry no native engine code; runtime 139.4 to 138.9 KB g...
• d0c0ee7 docs: lead the browser section with the bundler plugin
• 7d3cc6c feat: compiled-bare-rich, validateJSON's rejection split out; the form app 13...
• 9ec3a69 feat: verdictOnly modules without the error collector; the richErrors: false ...
• c4d805d feat: compiled-bare wrappers for validators only ever called; the richErrors:...
• 0ad2a82 perf: an emitted email check reads address literals by expression; an email s...
• ea831ba feat: compiled-plain wrapper for richErrors: false, a module that writes plai...
• 1d36e6b feat: compiled-object wrapper without the JSON entry points; wrappers fill de...
• 099c017 fix: ata verify tries a value on either side of every stated bound, so a modu...
• Additional commits viewable in compare view

Updates @oxfmt/binding-linux-x64-gnu from 0.74.0 to 0.75.0

Release notes

Sourced from @​oxfmt/binding-linux-x64-gnu's releases.

oxfmt v0.75.0

🐛 Bug Fixes

• 5042019 formatter: Keep fill layout for array with comment after [ (#28170) (leaysgur)
• 9d37ff6 formatter: Use position-based comment checks for concise arrays (#28169) (leaysgur)
• 016c4a2 formatter: Keep a comment before } inside a JSX spread child (#28103) (vidigoat)
• 190bb1e formatter: Keep parens around an instantiation expression ending an operand through any tight parent (#28168) (leaysgur)
• a5314a1 formatter: Keep ; before in and instanceof class members (#28166) (leaysgur)
• 3a56e7c formatter: Keep closing HTML comments at the start of a line (#28064) (Cameron)
• 23d23d6 formatter_markdown: Honor range ignore inside directives (#28164) (leaysgur)
• 5f1fd3d formatter: Measure width heuristics by display width (#28098) (leaysgur)
• a5a52cf formatter: Keep parens around private in expressions (#28096) (leaysgur)
• 999496e formatter: Measure a short key by its display width (#28026) (vidigoat)
• 7e9aa44 formatter: Keep parens around a looser operand of an instantiation expression (#28025) (vidigoat)
• 6912d1f formatter: Keep an arrow signature that exactly fills the line for any body (#27989) (leaysgur)
• eb1d9f9 formatter_core: Count a flat line space in fits only when text follows (#27987) (leaysgur)

⚡ Performance

• 1ed93af data_structures: Copy short strings without a memcpy call (#27953) (leaysgur)
• 7948f0b formatter_core: Shrink FormatElement to 16B (#28012) (leaysgur)
• 788af22 formatter: Keep AstNodes on the stack, and only chain links in the arena (#27963) (leaysgur)

📚 Documentation

• 068a8ea formatter: Fix up wording (#28167) (leaysgur)
• db55461 formatter_core: Document text width divergence (#28095) (leaysgur)
• 880d229 formatter: Add vitest-test-call to known divergences (#28006) (leaysgur)

Commits

• 9b6fff4 release(apps): oxlint v1.90.0 && oxfmt v0.75.0 (#28191)
• 3e7f0f5 chore(oxfmt): bump prettier-plugin-astro to 1.1.2 (#28162)
• See full diff in compare view

Updates mutative from 2.0.0 to 2.0.1

Release notes

Sourced from mutative's releases.

2.0.1

What's Changed

• fix: leave an array draft unchanged when deleting an index it does not have by @​unadlib in unadlib/mutative#213

Full Changelog: unadlib/mutative@v2.0.0...v2.0.1

Commits

• 7ef4bb8 fix: leave an array draft unchanged when deleting an index it does not have (...
• 7eab2dc docs(website): update
• 995fb22 docs(website): update website docs
• d08e08d test(perf): read the heap after three full collections in memory measurements
• 1f131e6 docs(perf): say that Immer ran after both Mutative builds in the process-orde...
• 9f7b080 docs(perf): head the remaining tables of the performance summary with Mutativ...
• 9da1cc4 docs(perf): describe measuring another checkout without the pre-release v2 wo...
• 4148ad1 docs(perf): say that the fresh-data scenarios measured the published 2.0.0 so...
• bb34dbb docs(readme): name the published 2.0.0 as the measured version in the perform...
• 23061d1 docs(readme): link the 2.0 release notes, announcement and migration guide at...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[netlify]

✅ Deploy Preview for schemabenchmarks ready!

Name	Link
🔨 Latest commit	7ca0ceb
🔍 Latest deploy log	https://app.netlify.com/projects/schemabenchmarks/deploys/6ae1c066bd32e00b43bfbaf6
😎 Deploy Preview	https://deploy-preview-391--schemabenchmarks.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.