[dependabot]

Bumps the npm-prod group with 18 updates in the / directory:

Package	From	To
@isaacs/ttlcache	1.4.1	2.1.5
@kubernetes/client-node	2.0.0	2.0.1
@smooai/fetch	3.4.0	4.0.0
@smooai/logger	4.3.0	4.5.4
@standard-schema/spec	1.0.0	1.1.0
@valibot/to-json-schema	1.7.1	1.8.0
arktype	2.1.20	2.2.9
commander	13.1.0	15.0.0
effect	3.22.1	4.0.6
empathic	1.1.0	2.1.0
esm-utils	4.3.0	4.4.2
ink	7.1.1	8.0.0
jiti	2.6.1	2.7.0
json-schema-to-zod	2.6.1	2.8.1
lru-cache	11.1.0	11.5.3
synckit	0.11.12	0.12.3
tsx	4.19.4	4.23.15
valibot	1.4.2	1.5.0

Updates @isaacs/ttlcache from 1.4.1 to 2.1.5

Changelog

Sourced from @​isaacs/ttlcache's changelog.

2.1

• Add updateAgeOnHas and checkAgeOnHas options to match corresponding get() options.
• Include items with Infinity expirations in iterations like entries(), keys(), values().

2.0

• refactor as hybrid typescript module (changes export)
• Blue Oak license

1.4

• add checkAgeOnGet option
• Guard against expiration list going missing

1.3.0

• make cache.cancelTimer a public method
• Reduce memory usage by only creating one timer

1.2

• Add support for immortality
• ensure dispose() only happens after full removal
• Clear timeouts so we don't rely on only unref()
• fix error when deleting immortal entries

1.1

• Add setTTL(key, ttl)
• avoid off-by-1ms purge failures

1.0

• Initial release

Commits

• 5e4ccd2 2.1.5
• 5e4a669 Fix named import in README
• 84fa4c8 update project stuff
• 1476f92 2.1.4
• e101894 stack timers for long TTLs
• fe12fe3 move configs out of package.json to config files
• 4d5e71d 2.1.3
• 93bff3b Fix syntax typo in README example
• 6e15c53 2.1.2
• cbfdbd5 correct test name, use t.clock for regularity
• Additional commits viewable in compare view

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Updates @kubernetes/client-node from 2.0.0 to 2.0.1

Release notes

Sourced from @​kubernetes/client-node's releases.

Release 2.0.1

Full Changelog: kubernetes-client/javascript@2.0.0...2.0.1

Commits

• 1c811ad Pin node version in release workflow
• 73e4414 Prepare 2.0.1
• b02ad64 ci: pin the Node 26 matrix entry to 26.7
• 4895d44 fix: use inactivity timeout for watch instead of whole-request timeout
• See full diff in compare view

Updates @smooai/fetch from 3.4.0 to 4.0.0

Release notes

Sourced from @​smooai/fetch's releases.

v4.0.0

Major Changes

• 1a84633: SMOODEV-3375: Retries never duplicate a side effect: they now check the HTTP method, and timeouts cancel the attempt. This changes a default, so it is a major release.

  What was wrong. Retries ignored the HTTP method. A POST that timed out or got a 429/5xx was sent again, up to twice more. In TypeScript the per-attempt timeout (mollitia's Timeout module) did not stop the losing request, so the first attempt kept running on the server while the retry sent it again. Image generation takes 20-50s against the 10s default timeout, so it billed three images and returned nothing. Any non-idempotent call (CRM writes, message sends, payments) could run its side effect more than once.

  New default, in all five languages:

  • Only idempotent methods are retried: GET, HEAD, OPTIONS, TRACE, PUT and DELETE (RFC 9110 §9.2.2).
  • POST, PATCH and any other method make exactly one attempt. You get that attempt's own error (HTTPResponseError / TimeoutError and the equivalents in other languages), not the retries-exhausted wrapper.
  • A 429 with Retry-After on a POST is not retried either.
  • onRejection is never called for these requests, so it cannot turn their retries back on.

  There are two ways to opt back in:

  • Send a non-empty Idempotency-Key header, in any casing. The server then deduplicates.
  • Set retry: { allowNonIdempotent: true }. The name in each language:
    • TypeScript: allowNonIdempotent
    • Python and Rust: allow_non_idempotent
    • Go and .NET: AllowNonIdempotent

  Eligibility is checked after the pre-request hooks and the auth provider run, so a hook can add the key. The client-side rate limiter's retry loop is unchanged, because it rejects requests before anything is sent.

  Timeouts cancel the attempt. TypeScript now aborts each attempt with an AbortController, combined with the caller's own signal, so the connection is closed before any retry. A fetch that ignores signal still times out on schedule. Rust, Go, Python and .NET already cancelled the attempt. A new test in every language proves the first attempt's connection closes. Go now also waits for the cancelled attempt to finish before it retries. Python now puts a hard deadline on each attempt with asyncio.timeout. Before, httpx only had per-phase timeouts, so a server that kept sending bytes slowly never timed out.

  Also fixed: in TypeScript, a request the caller aborted is no longer retried.

  Other API changes:

  • TypeScript:
    • New exports: isIdempotentMethod, isRetryEligible, IDEMPOTENCY_KEY_HEADER and the RetryOptions type.
    • options.retry and FetchBuilder.withRetry now take a partial. It is merged over the defaults, so retry: { allowNonIdempotent: true } keeps every other default.
    • The signal that fetch receives now combines the caller's signal with the timeout's. It is no longer the caller's own object.
  • Rust:
    • RetryOptions gains allow_non_idempotent. This breaks existing RetryOptions { .. } struct literals.
    • RetryOptions now implements Default, so literals can end with ..Default::default() from now on.
    • New: is_idempotent_method, is_retry_eligible and IDEMPOTENCY_KEY_HEADER.
  • Go:
    • New: RetryOptions.AllowNonIdempotent, IsIdempotentMethod and IdempotencyKeyHeader.
    • The module path moves to /v4.
  • Python:
    • New: RetryOptions.allow_non_idempotent.
    • is_idempotent_method and IDEMPOTENCY_KEY_HEADER are exported.
  • .NET:
    • New on RetryPolicy: AllowNonIdempotent, IsIdempotentMethod, IsRetryEligible and IdempotencyKeyHeader.
    • Microsoft.SourceLink.GitHub goes to 10.0.303. 8.0.0 pulls in Microsoft.Build.Tasks.Git 8.0.0, which has an advisory against it (GHSA-23fw-v26w-5fgq), and a clean restore now fails with NU1902.

  Why a major version:

  • A caller that relied on POST retries quietly loses them.
  • In Rust, adding a field to a struct that callers construct breaks their code. The 3.7.1 entry below explains why that must not ship as a minor.

  The shared spec/retry-idempotency-corpus.json pins the rule. Each language's tests run it against a real local server and count the requests the server received.

... (truncated)

Changelog

Sourced from @​smooai/fetch's changelog.

4.0.0

Major Changes

• 1a84633: SMOODEV-3375: Retries never duplicate a side effect: they now check the HTTP method, and timeouts cancel the attempt. This changes a default, so it is a major release.

  What was wrong. Retries ignored the HTTP method. A POST that timed out or got a 429/5xx was sent again, up to twice more. In TypeScript the per-attempt timeout (mollitia's Timeout module) did not stop the losing request, so the first attempt kept running on the server while the retry sent it again. Image generation takes 20-50s against the 10s default timeout, so it billed three images and returned nothing. Any non-idempotent call (CRM writes, message sends, payments) could run its side effect more than once.

  New default, in all five languages:

  • Only idempotent methods are retried: GET, HEAD, OPTIONS, TRACE, PUT and DELETE (RFC 9110 §9.2.2).
  • POST, PATCH and any other method make exactly one attempt. You get that attempt's own error (HTTPResponseError / TimeoutError and the equivalents in other languages), not the retries-exhausted wrapper.
  • A 429 with Retry-After on a POST is not retried either.
  • onRejection is never called for these requests, so it cannot turn their retries back on.

  There are two ways to opt back in:

  • Send a non-empty Idempotency-Key header, in any casing. The server then deduplicates.
  • Set retry: { allowNonIdempotent: true }. The name in each language:
    • TypeScript: allowNonIdempotent
    • Python and Rust: allow_non_idempotent
    • Go and .NET: AllowNonIdempotent

  Eligibility is checked after the pre-request hooks and the auth provider run, so a hook can add the key. The client-side rate limiter's retry loop is unchanged, because it rejects requests before anything is sent.

  Timeouts cancel the attempt. TypeScript now aborts each attempt with an AbortController, combined with the caller's own signal, so the connection is closed before any retry. A fetch that ignores signal still times out on schedule. Rust, Go, Python and .NET already cancelled the attempt. A new test in every language proves the first attempt's connection closes. Go now also waits for the cancelled attempt to finish before it retries. Python now puts a hard deadline on each attempt with asyncio.timeout. Before, httpx only had per-phase timeouts, so a server that kept sending bytes slowly never timed out.

  Also fixed: in TypeScript, a request the caller aborted is no longer retried.

  Other API changes:

  • TypeScript:
    • New exports: isIdempotentMethod, isRetryEligible, IDEMPOTENCY_KEY_HEADER and the RetryOptions type.
    • options.retry and FetchBuilder.withRetry now take a partial. It is merged over the defaults, so retry: { allowNonIdempotent: true } keeps every other default.
    • The signal that fetch receives now combines the caller's signal with the timeout's. It is no longer the caller's own object.
  • Rust:
    • RetryOptions gains allow_non_idempotent. This breaks existing RetryOptions { .. } struct literals.
    • RetryOptions now implements Default, so literals can end with ..Default::default() from now on.
    • New: is_idempotent_method, is_retry_eligible and IDEMPOTENCY_KEY_HEADER.
  • Go:
    • New: RetryOptions.AllowNonIdempotent, IsIdempotentMethod and IdempotencyKeyHeader.
    • The module path moves to /v4.
  • Python:
    • New: RetryOptions.allow_non_idempotent.
    • is_idempotent_method and IDEMPOTENCY_KEY_HEADER are exported.
  • .NET:
    • New on RetryPolicy: AllowNonIdempotent, IsIdempotentMethod, IsRetryEligible and IdempotencyKeyHeader.
    • Microsoft.SourceLink.GitHub goes to 10.0.303. 8.0.0 pulls in Microsoft.Build.Tasks.Git 8.0.0, which has an advisory against it (GHSA-23fw-v26w-5fgq), and a clean restore now fails with NU1902.

  Why a major version:

  • A caller that relied on POST retries quietly loses them.
  • In Rust, adding a field to a struct that callers construct breaks their code. The 3.7.1 entry below explains why that must not ship as a minor.

... (truncated)

Commits

• 17b4223 🦋 New version release (#125)
• 1a84633 SMOODEV-3375: Make retries method-aware and make timeouts cancel the attempt ...
• a68fc08 🦋 New version release (#123)
• 0518da3 Rust: move the redirect option onto the builder — 3.7.0 was breaking (#122)
• 1fcfb64 🦋 New version release (#121)
• 43ca80a Make redirect handling configurable in all five languages (th-86dc77) (#120)
• 1dcd136 chore: delete .nvmrc — mise.toml is the toolchain pin now (#119)
• e149b98 chore(ci): bump Go toolchain to 1.26 (#118)
• 072eecb chore(ci): adopt mise, move to Node 24 so npm can do OIDC trusted publishing ...
• 7023068 README: say WHY redaction is TS+Rust, so it stops reading as a parity gap (#116)
• Additional commits viewable in compare view

Updates @smooai/logger from 4.3.0 to 4.5.4

Release notes

Sourced from @​smooai/logger's releases.

v4.5.4

Patch Changes

• 96efa6b: Bump uuid to ^11.1.1, gate each registry publish on that registry, and stop Go caching the parity corpus.
  • uuid 9.0.1 → 11.1.1. The moderate advisory (missing buffer bounds check in v3/v5/v6 when buf is provided) is not reachable here — logger only ever calls v4() with no arguments — but every consumer of @smooai/logger was inheriting the advisory and having to carry its own pnpm.overrides pin. Fixed at the source instead. @types/uuid dropped; uuid 11 ships its own.
  • Publish steps no longer gate on steps.changesets.outputs.published. That output is true only when the publish command shipped something in that run, so a run that died after npm left the other four behind — and the follow-up run, with no changesets left, reported published=false, skipped all four, and went green having published nothing. That is exactly how 4.5.1 and 4.5.2 stranded crates.io, NuGet and the Go tag at 4.5.0. Each step now asks its own registry whether the version is already there, which also lets a re-run heal a partial release.
  • go:test gains -count=1. Go currently refuses to cache parity_corpus_test.go because it reads ../parity-corpus.json from outside the package dir — verified — but a parity guarantee should not rest on that.

v4.5.3

Patch Changes

• be2b735: Commit the repo's formatting and stop the release pipeline from dirtying its own working tree.

  Dropping cargo publish --allow-dirty surfaced what the flag had been hiding: release.yml's own Format step ran pnpm format, which rewrites files and never commits them, so cargo publish a few steps later saw a dirty tree. Every crate published from this repo silently carried uncommitted reformatting.

  main was format-drifted across seven files with nothing checking — PR checks ran oxlint but never a formatter, and pnpm format:check did not exist.

  • The formatting is committed; pnpm format is now a no-op on main.
  • New format:check (oxfmt + ruff + cargo fmt + gofmt) runs in PR checks.
  • release.yml's Format becomes Format check — check, never rewrite.
  • The changesets version lifecycle now ends with oxfmt --write CHANGELOG.md package.json, because changeset version emits both in a shape oxfmt disagrees with; without it the next release PR would land unformatted and break cargo publish --locked again.

  This release also re-publishes to crates.io, NuGet, and the Go module tag, which stalled at 4.5.0 while npm and PyPI went to 4.5.2.

v4.5.2

Patch Changes

• ad58fce: Sync non-npm manifest versions during the version bump instead of after publish, and guard it.

  ci:publish ran pnpm build && changeset publish && pnpm version:sync — the sync happened after the publish, mutating manifests in the CI workspace that were then thrown away. So every git tag shipped stale version constants, and cargo publish --allow-dirty existed only to paper over the dirt. With 4.4.0 published on npm, the repo was carrying 3.2.3 in python/pyproject.toml, python/uv.lock and go/version.go, 3.1.2 in rust/logger/Cargo.toml

... (truncated)

Changelog

Sourced from @​smooai/logger's changelog.

4.5.4

Patch Changes

• 96efa6b: Bump uuid to ^11.1.1, gate each registry publish on that registry, and stop Go caching the parity corpus.
  • uuid 9.0.1 → 11.1.1. The moderate advisory (missing buffer bounds check in v3/v5/v6 when buf is provided) is not reachable here — logger only ever calls v4() with no arguments — but every consumer of @smooai/logger was inheriting the advisory and having to carry its own pnpm.overrides pin. Fixed at the source instead. @types/uuid dropped; uuid 11 ships its own.
  • Publish steps no longer gate on steps.changesets.outputs.published. That output is true only when the publish command shipped something in that run, so a run that died after npm left the other four behind — and the follow-up run, with no changesets left, reported published=false, skipped all four, and went green having published nothing. That is exactly how 4.5.1 and 4.5.2 stranded crates.io, NuGet and the Go tag at 4.5.0. Each step now asks its own registry whether the version is already there, which also lets a re-run heal a partial release.
  • go:test gains -count=1. Go currently refuses to cache parity_corpus_test.go because it reads ../parity-corpus.json from outside the package dir — verified — but a parity guarantee should not rest on that.

4.5.3

Patch Changes

• be2b735: Commit the repo's formatting and stop the release pipeline from dirtying its own working tree.

  Dropping cargo publish --allow-dirty surfaced what the flag had been hiding: release.yml's own Format step ran pnpm format, which rewrites files and never commits them, so cargo publish a few steps later saw a dirty tree. Every crate published from this repo silently carried uncommitted reformatting.

  main was format-drifted across seven files with nothing checking — PR checks ran oxlint but never a formatter, and pnpm format:check did not exist.

  • The formatting is committed; pnpm format is now a no-op on main.
  • New format:check (oxfmt + ruff + cargo fmt + gofmt) runs in PR checks.
  • release.yml's Format becomes Format check — check, never rewrite.
  • The changesets version lifecycle now ends with oxfmt --write CHANGELOG.md package.json, because changeset version emits both in a shape oxfmt disagrees with; without it the next release PR would land unformatted and break cargo publish --locked again.

  This release also re-publishes to crates.io, NuGet, and the Go module tag, which stalled at 4.5.0 while npm and PyPI went to 4.5.2.

4.5.2

Patch Changes

• ad58fce: Sync non-npm manifest versions during the version bump instead of after publish, and guard it.

  ci:publish ran pnpm build && changeset publish && pnpm version:sync — the sync happened after the publish, mutating manifests in the CI workspace that were then thrown away. So every

... (truncated)

Commits

• 7da6390 🦋 New version release (#195)
• 96efa6b Bump uuid, gate publishes per-registry, and stop Go caching the corpus (#194)
• 0ae6414 🦋 New version release (#193)
• be2b735 Commit the formatting, and stop the release from dirtying its own tree (#192)
• 3da9740 Stop the release reporting failure when the changeset PR is already green (#191)
• 6a96863 🦋 New version release (#190)
• 83fdb83 Sync the non-npm manifests to 4.5.1 (one-time, unblocks the release) (#189)
• 1301d0b 🦋 New version release (#188)
• ad58fce Sync manifest versions during the bump, not after publish, and guard it (#186)
• cb917c2 Make the parity corpus real: five loaders, and a Python drift it caught (#183)
• Additional commits viewable in compare view

Updates @standard-schema/spec from 1.0.0 to 1.1.0

Release notes

Sourced from @​standard-schema/spec's releases.

v1.1.0

Adds the Standard JSON Schema specification.

Please refer to the README and standardschema.dev for more details.

Commits

• 2c4e37f Merge pull request #134 from standard-schema/json-schema
• 395ee95 Add json-integrate
• 1a5ccf3 Improve json-integrate
• 1dbb6d2 Improve docs
• b081dbb Update site
• 87bc20f Add pullfrog.yml workflow
• 3a1b9ea Add examples table
• f16ef72 Update website
• ea2436d Update JSON Schema compatibility table with Valibot details
• 727c24a update arktype implementation version and pr
• Additional commits viewable in compare view

Updates @valibot/to-json-schema from 1.7.1 to 1.8.0

Release notes

Sourced from @​valibot/to-json-schema's releases.

v1.8.0 (to-json-schema)

Many thanks to @​dylanpulver, @​dzhu-amplify, @​francisjohnjohnston-web, @​idleberg, @​jagregory, @​lazerg, @​LeSingh1, @​MathurAditya724, @​maximilliangrand, @​MFA-G, @​mrlubos, @​rajanpanth, @​sanjibani, @​spokodev, @​ysknsid25, and @​yslpn for contributing to this release.

• Add support for ksuid action (pull request #1370)
• Add passthrough of other metadata action properties to support custom annotations and standard keywords like format, which take precedence over generated properties (pull request #1591)
• Fix overlapping values, notValue and notValues actions to preserve all restrictions, including value actions for OpenAPI 3.0 (pull request #1613)
• Fix value actions to report conflicting constant restrictions by default (pull request #1613)
• Fix empty and duplicate requirements of values and notValues actions to produce valid enum restrictions or an impossible schema (pull request #1613)
• Fix overlapping numeric, length, and object entry bounds to preserve the stricter constraints, including combinations with nonEmpty and safeInteger actions (pull request #1611)
• Fix minValue, maxValue, gtValue and ltValue actions to reject NaN and infinite requirements by default and skip them in warn and ignore error modes (pull request #1611)
• Fix length, minLength, maxLength, entries, minEntries and maxEntries actions to require non-negative integers by default and skip invalid requirements in warn and ignore error modes (pull request #1611)
• Fix examples property type of JsonSchema to always be an array (pull request #1607)
• Fix JSON compatibility validation of literal schemas to reject NaN and infinite numbers by default (pull request #1573)
• Fix JSON compatibility validation of enum and picklist schemas to reject NaN and infinite numbers by default (pull request #1612)
• Fix literal, enum and picklist schemas to skip unsupported values in warn and ignore error modes (pull request #1612)
• Fix minValue, maxValue, gtValue and ltValue actions to skip numeric constraints on unsupported types in warn and ignore error modes (pull request #1595)
• Fix generation of reference IDs for lazy schemas to produce consistent output and avoid collisions with existing definitions (pull request #1604)
• Change ConversionContext.referenceMap type from Map to its ReferenceMap subclass (pull request #1604)
• Change Valibot peer dependency to v1.5.0

Commits

• See full diff in compare view

Updates arktype from 2.1.20 to 2.2.9

Changelog

Sourced from arktype's changelog.

2.2.9

Keep tuple elements around defaults in .in and .out

Combining a tuple's defaultable elements with its other elements dropped some of them, depending on key order:

const T = type(["string", "number = 5", "boolean?"])
// was: [string, boolean?]
// now: [string, number?, boolean?]
T.in.expression
// was: number[]
// now: [number, string, ...number[]]
type(["number", "string = 'foo'", "...", "number[]"]).out.expression

A bound that narrows two existing length constraints at once also no longer throws "multiple distinct intersection results":

// was: throws
// now: string == 2
type("1 <= string <= 2").and("string >= 2")

Thanks to @​ybai08 (#1696).

Reject NaN in unions discriminated by typeof

number rejects NaN, but compiled unions like number | null dropped that check when they discriminated by typeof, so NaN was only rejected with jitless (#1702).

const T = type("number | null")
// was: NaN
// now: ArkErrors: must be a number (was NaN)
T(NaN)

Thanks to @​thecotne.

Don't treat Object.prototype keys as declared

Inherited names like toString or constructor, and an own __proto__ key like the one JSON.parse creates, were treated as declared keys, so "+": "delete" kept them and "+": "reject" accepted them (#1701).

const T = type({ a: "string", "+": "reject" })
// was: { a: "x", constructor: 1 }
</tr></table>

... (truncated)

Commits

• cfded1a release: arktype 2.2.9 + dependents (#1704)
• 092075a fix(schema): keep tuple elements around defaults in .in and .out (#1696)
• fc06904 fix(schema): only emit referenced $defs in toJsonSchema (#1689)
• cd11e1f fix(schema): don't treat Object.prototype keys as declared for undeclared key...
• c82c596 fix(schema): keep the NaN check when a union discriminates on typeof (#1702)
• 5aad144 fix(schema): convert what JSON Schema can't represent in ~standard.jsonSchema...
• 9d60ec7 docs: simpler landing examples, Markdown docs for agents, and an ArkType skil...
• fe481db attest ts7 support, arktype fixes (#1680)
• 9303229 feat(type): add string.base58 built-in validator (#1604)
• 97ed4f9 Return empty props for base object instead of throwing (#1682)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for arktype since your current version.

Updates commander from 13.1.0 to 15.0.0

Release notes

Sourced from commander's releases.

v15.0.0

Commander 15 is ESM only. This is expected to be seamless for ESM consumers, but some CommonJS consumers may hit issues with tooling requiring configuration for ESM-only dependencies. See Migration Tips below.

The release of Commander 15 moves Commander 14 into maintenance. Commander 14 will get security updates for 12 months (to May 2027). For more info see Release Policy.

Added

• show excess command-arguments in error message (#2384)

Fixed

• Breaking: only lone --no-* option sets default option value to true, default not implicitly set when define both positive and negative option in either order (#2405)
• update example to use compatible character for MINGW64 (#2475)

Changed

• Breaking: migrated Commander implementation from CommonJS to ESM (#2464)
• Breaking: Commander 15 requires Node.js v22.12.0 or higher (for require(esm)).
• dev: switch tests from Jest to node:test test runner (#2463)

Deleted

• Breaking: removed deprecated export of commander/esm.mjs (#2464)

Migration Tips

Commander 15 is ESM only, but this does not mean you need to migrate to ESM to use it. Importing ESM from CommonJS is supported by Node.js, and Bun, and Deno. Hopefully it Just Works for you! However, you may be using a different runtime or some other part of your setup that may not yet natively support importing ESM from CommonJS, such as your testing framework or bundler.

If you have problems using Commander 15 in your environment, one option is stay on Commander 14 for now. Commander 14 will get security updates until May 2027 and things will hopefully improve for your setup in the meantime.

v15.0.0-0

Commander 15 is ESM only. This is expected to be seamless for ESM consumers, but some CommonJS consumers may hit issues with tooling requiring configuration for ESM-only dependencies. See Migration Tips below.

The release of Commander 15 in May 2026 will move Commander 14 into maintenance. Commander 14 will get security updates for 12 months (to May 2027). For more info see Release Policy.

Added

• show excess command-arguments in error message (#2384)

Fixed

• Breaking: only lone --no-* option sets default option value to true, default not implicitly set when define both positive and negative option in either order (#2405)
• update example to use compatible character for MINGW64 (#2475)

... (truncated)

Changelog

Sourced from commander's changelog.

[15.0.0] (2026-05-29)

Commander 15 is ESM only. This is expected to be seamless for ESM consumers, but some CommonJS consumers may hit issues with tooling requiring configuration for ESM-only dependencies. See Migration Tips below.

The release of Commander 15 moves Commander 14 into maintenance. Commander 14 will get security updates for 12 months (to May 2027). For more info see Release Policy.

Added

• show excess command-arguments in error message (#2384)

Fixed

• Breaking: only lone --no-* option sets default option value to true, default not implicitly set when define both positive and negative option in either order (#2405)
• update example to use compatible character for MINGW64 (#2475)

Changed

• Breaking: migrated Commander implementation from CommonJS to ESM (#2464)
• Breaking: Commander 15 requires Node.js v22.12.0 or higher (for require(esm)).
• dev: switch tests from Jest to node:test test runner (#2463)

Deleted

• Breaking: removed deprecated export of commander/esm.mjs (#2464)

Migration Tips

Commander 15 is ESM only, but this does not mean you need to migrate to ESM to use it. Importing ESM from CommonJS is supported by Node.js, and Bun, and Deno. Hopefully it Just Works for you! However, you may be using a different runtime or some other part of your setup that may not yet natively support importing ESM from CommonJS, such as your testing framework or bundler.

If you have problems using Commander 15 in your environment, one option is stay on Commander 14 for now. Commander 14 will get security updates until May 2027 and things will hopefully improve for your setup in the meantime.

[15.0.0-0] (2026-02-22)

(Released as 15.0.0)

[14.0.3] (2026-01-31)

Added

• Release Policy document (#2462)

Changes

• old major versions now supported for 12 months instead of just previous major version, to give predictable end-of-life date (#2462)
• clarify typing for deprecated callback parameter to .outputHelp() (#2427)

... (truncated)

Commits

• ba6d13d Fix release dates in changelog (#2523)
• a752ed9 Pin GitHub actions with hash (#2521)
• 74d5dfe Drop EOL node 20 from test matrix, and add node 26 (#2520)
• 6df9b68 Update details for 15.0.0 release (#2519)
• 01ce5d0 Remove jest esm examples (#2517)
• d785d8b Update dependencies (#2518)
• 9098b48 Update dependencies (#2506)
• 373f660 Use node:util stripVTControlCharacters instead of own code (#2486)
• 987f289 Use simple match in test (to avoid warning about expensive regex) (#2485)
• 0ea3bb3 Update dependecies and lint (#2489)
• Additional commits viewable in compare view

Updates effect from 3.22.1 to 4.0.6

Release notes

Sourced from effect's releases.

effect@4.0.6

Patch Changes

• #9674 ce13a48 Thanks @​effect-bot! - Allow Response.AllParts, Response.Part and Response.StreamPart to be called without a toolkit, decoding tool call and tool result parts for any tool name with unknown parameters and results.

• #9696 f3bbbb4 Thanks @​gcanti! - Fix Array.unionWith calling custom equivalence callbacks with values from the wrong input or in the wrong order.

• #9511 5547315 Thanks @​sledorze! - Speed up field copying in Data.Class, Data.Error, Request.Class and Persistable constructors.

• #9743 6093cfb Thanks @​effect-bot! - Fix AsyncResult equality treating unrelated Equal values with a matching tag and hash as equal.

• #9607 30319d5 Thanks @​effect-bot! - Fix Effect atoms dropping the latest exposed success when an asynchronous run fails, so an initialValue or a success published with get.setSelf remains available as the failure's previous success.

• #9313 74a7596 Thanks @​effect-bot! - Preserve Reactivity and global layers when replacing an atom runtime layer through registry initial values, so injected test layers retain shared invalidation and global services.

• #9190 bfb32a3 Thanks @​danieljvdm! - Log Atom scope finalizer failures at References.UnhandledLogLevel when an atom is disposed, using the atom runtime's logger. Interruption-only cleanup is not logged.

• #9522 f8bf7f4 Thanks @​tim-smart! - Add a skipInitialRun option to Atom.serializable and Atom.initialValue. A seeded effect or stream atom then keeps its hydrated or initial value instead of running on mount, until it is refreshed or a dependency changes. Factory get(...) calls and withReactivity keys are still tracked; dependencies read inside the effect are tracked from its first real run.

• #9718 7f3d3df Thanks @​fubhy! - Add Base64Url.encodePadded and a padding option to SchemaGetter.encodeBase64Url for consumers that require padded URL-safe Base64.

• #9698 db1046d Thanks @​effect-bot! - Encode HttpClientRequest.basicAuth credentials as UTF-8 before base64 encoding, so non-ASCII usernames and passwords no longer throw or get mangled.

• #9326 3c4f88a Thanks @​effect-bot! - Block imports of nested internal modules in the development and published package exports. These implementation details are not public APIs; public entry points remain available.

• #9441 916e709 Thanks @​fubhy! - Add the unstable Bytes module with concat, Equivalence, and Order for Uint8Array values. Stream.mkUint8Array now returns Uint8Array<ArrayBuffer>. Browser HTTP clients collect streamed request bodies without repeatedly copying accumulated bytes.

• #9470 916f843 Thanks @​tim-smart! - Reduce EventLog remote replay overhead by reusing decoded conflict payloads within each batch.

• #9617 66ec757 Thanks @​Marve10s! - Fix Effect.cachedInvalidateWithTTL caching a stale result when invalidated while the effect is running.

• #9499 daac06f Thanks @​schutzelaars! - Fix Effect.callback retaining completed suspension state, such as values received by Deferred.await or PubSub.take, until the next full GC.

• #9727 c2552ec Thanks @​Marve10s! - Fix Cause.pretty, Cause.prettyErrors, loggers and runMain overflowing the stack when an error's cause chain is cyclic.

• #9540 b02c1cd Thanks @​Marve10s! - Preserve falsy nested error causes (0, false, "", null) in Cause.prettyErrors and Cause.pretty.

• #9418 1855f1d Thanks @​jpowersdev! - Fix Channel.fromTransformStream so an upstream failure is reported when a read is pending, instead of the error raised by aborting the transform stream.

• #9602 683ed2c Thanks @​effect-bot! - Preserve Prompt.FilePart byte and URL data when chat history is exported or persisted as JSON. Encoding now produces tagged { _tag: "Uint8Array", base64 } and { _tag: "URL", href } objects that decode back to their original types, and Chat.Persistence reports undecodable stored history as a PersistenceError instead of a defect.

• #9238 ac68940 Thanks @​effect-bot! - Fix child-process cleanup without forceKillAfter to give remaining process-group members up to one second to exit after the leader exits. Clarify that waiting for the leader has no time limit and never escalates to SIGKILL when forceKillAfter is omitted.

• #9611 22a8401 Thanks @​itisrmk! - Fix Chunk.get and Chunk.getUnsafe throwing on in-range fractional indexes of one-element chunks, and treat NaN and infinite indexes as out of bounds.

• #9287 c53c194 Thanks @​devangpratap! - Fix the CLI lexer treating a short option cluster with an inline value, such as -vn=3, as one unknown flag instead of -v -n=3. A single dash followed by a multi-character name, such as ...

  Description has been truncated

[changeset-bot]

⚠️ No Changeset found

Latest commit: ab7ef4a

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR