chore(deps): bump the dependencies group with 2 updates

[dependabot]

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.

---

Bumps the dependencies group with 2 updates: ata-validator and @pmndrs/detect-gpu.

Updates ata-validator from 1.22.0 to 1.27.1

Release notes

Sourced from ata-validator's releases.

v1.27.1

Security patch. Update if you use useDefaults (on by default) with schemas you did not write.

Fixed

• A schema declaring a property named __proto__ with nested defaults wrote those defaults onto Object.prototype, for every object in the process, on both engines, regardless of the input. The defaults machinery is now prototype-safe end to end: a default fills a property that is an own key or absent (Object.hasOwn, not in, so a property named constructor also receives its default now), the nested applier refuses to walk a parent the instance does not carry as an own key, and fills of a property named __proto__ go through Object.defineProperty, because plain assignment of that name rewrites the object's prototype instead of creating a property. Type coercion skips that name for the same reason; the raw value still goes through validation. Reported with the initial fix by @​d4tocchini in #43.
• The AOT parse() emitter received the same hardening (computed keys, Object.hasOwn presence checks, defineProperty for the one dangerous name), and its record loop, whose keys come from the input, now keeps a JSON-parsed own __proto__ key as an own key in the output instead of silently rewriting the output's prototype.

v1.27.0

Added

• parse() is now emitted for the record shape: additionalProperties as a schema, which is what z.record and every generator's map type compile to, with or without declared properties beside it. The key set is open by declaration, so keeping every key is exact, and every undeclared value is rebuilt against the one schema that governs it, stripping unknown keys inside it the same way a declared property's rebuild would. Defaults under a record value are not filled, because the runtime's useDefaults does not fill them there and parse() output stays equal to validate().data. Still declined, loudly: additionalProperties: true, applicators next to a record, and patternProperties.
• onWarning now receives a second argument, { kind }, naming which capability degraded: 'error-detail' or 'parse'. A build that requested both can tell the warnings apart instead of treating any warning as degraded errors. build() result warnings carry the same kind field. Existing single-argument callbacks keep working unchanged.

Fixed

• Two more fixed-name collisions in the generated-code path, the same family as the patternProperties helper-scope bug fixed in 1.26.0: a record whose values are themselves records (additionalProperties nested in itself) generated an inner loop that redeclared the outer loop's variables and threw ReferenceError at validation time, and patternProperties inside a patternProperties value schema had the same collision on its own loop variables. All the loop names now carry a unique suffix; the combined error generator already did this, and the boolean generator now matches it.

v1.26.0

Added

• toStandaloneModule(schema, { parse: true }) inlines local, acyclic $refs before the clone proof runs, so schemas that keep their shapes in $defs and reference them, which is every schema a generator emits, now get a parse(). Only a node that is exactly a $ref plus annotations is inlined; a cycle, an external reference or a constraining sibling keyword leaves the reference in place and the clone declines as before. Defaults follow the runtime exactly: a default written next to the $ref fills, a default written inside the referenced definition does not, and a test holds parse() output equal to the runtime's validate().data on the same input.
• When parse: true is requested and the clone still cannot be proven, the decline is loud: onWarning fires with the reason, and the emitted module carries a NOTE comment saying it has no parse export. Previously the only way to notice was reading the export list.

Fixed

• The runtime compiler built patternProperties (and combined additionalProperties) child validators with new Function, which discarded the parent's helper scope: a child schema that needed a compiled pattern or format helper threw ReferenceError at validation time. Child checks are now generated inline in the parent validator and share its helper bindings. Reported and fixed by @​jdalton in #46.
• The TypeScript declarations emitted next to a compiled module now declare the schemaHash export; 1.25.0 added it to every module but not to the generated .d.mts, so importing it by name failed type checking while working at runtime.

1.25.0

Fixed

• Emitted standalone modules compiled their regex patterns on every call. The compiler stores each pattern both as a closure variable and as an inline const _reN = __ataSafeRe(...) in the stored source; in process the inline line never runs (the closure binds the compiled matcher once), but every emitter placed it inside the emitted function, where it shadowed the module-scope binding and rebuilt the matcher per call. A schema with one pattern validated at 202 thousand ops/s as a standalone module while the in-process path ran at millions. Patterns are now declared once at load scope in all four emitters (toStandalone, toStandaloneModule, bundleStandalone, bundleCompact); the same document on the same schema now measures 27.0 million ops/s, 134x. bundleCompact needed care: its deduplication keyed on body text alone, and with the pattern no longer in the body, two schemas differing only in their pattern would have merged, so the key now includes the factory-scope declarations.

Added

• Provably local unevaluated* compiles real error detail on the generated-code path, and therefore in standalone modules. When every occurrence of unevaluatedProperties/unevaluatedItems sits on a node with no $ref and no patternProperties, and every in-place applicator (allOf, anyOf, oneOf, if/then/else) contributes only property names the node's own properties already declares, the keyword is exactly additionalProperties/items in disguise and both the error and combined generators now emit it as such, keeping the keyword's own identity: one error per stray key with params.unevaluatedProperty (ATA7003), one error with params.limit for extra items. toStandaloneModule with error detail requested no longer degrades on these schemas; a config schema of the common if/then/else plus root unevaluatedProperties: false shape ships an AOT module with the same per-field errors the runtime reports. Schemas where the annotations cannot be proven local (unevaluated* next to a $ref, cousin-visible shapes) still decline, loudly, as before. Verified by the error-shape differential (2,816 cases), the engine differential (18,126 cases) and the official suite on all three dialects.
• toStandaloneModule(schema, { positions: true }) also exports validateJSON(text): parse, validate, and on failure attach a dataFrame (byteOffset, length, line, col, text) to every error by walking the original text once. The mapping goes through instancePath, so a key that appears in several sections frames each error on its own occurrence, which a first-occurrence string search does not. A syntax error is the single ATA9001 error with a frame on the document. The walker is the runtime's own buildDataPositionMap, embedded verbatim so the two cannot drift, and it costs about 5 KB in the module (1.7 KB gzipped), which is why it is opt-in.
• toStandaloneModule(schema, { parse: true })'s parse(data) now fills declared default values for absent optional properties (object and array defaults are fresh per call) and is emitted for composed schemas under the same proof the unevaluated* error generators use: in-place applicators are admitted when every property name they mention is already declared in the node's own properties. The common config shape, if/then/else over declared fields with root unevaluatedProperties: false, now gets a parse that enforces the conditional, rejects undeclared keys, and returns the ready object. Two default shapes decline because they are where parse and the runtime would disagree: a required property with a default, and a default the property's own schema rejects.
• Every emitted module exports schemaHash, a 16 character content hash of the schema it was compiled from, over canonical JSON so key order does not matter, computed from the schema as the caller wrote it so dialect normalization does not break the comparison. schemaHash(schema) from ata-validator/build computes the same value; a build detects a stale artifact by comparing the two instead of embedding its own fingerprint.
• The agreement between compiled modules and the runtime is now a stated contract, in docs/STABILITY.md and the API reference: same version, same verdict on every document, enforced by the differential test in every CI run, with the emitters declining or degrading loudly where they cannot prove equivalence.
• The compat shim exports attachDataFrames(errors, text): the same one-pass mapping for Ajv-shaped errors, for callers that keep the source text around. Not an Ajv API; it exists because hand-written line finders based on a string search get repeated keys wrong.

1.24.0

Added

• A schema-directed scanner: isValidJSON() answers the verdict from the JSON text without building the document. Parsing is about three quarters of the cost of a request that only needs yes or no, and a rejection now stops at the byte that caused it. The scanner compiles per schema, on the codegen path only, after 64 calls (generating one costs about 20 µs, so a caller that checks one document never pays), and it declines anything outside its supported core: type, properties, required, additionalProperties, items, prefixItems, the length, size and range keywords, pattern, format, const, enum, local $ref (inlined, acyclic, no base-changing keywords below the root), allOf (merged, with the additionalProperties cross-branch rule written out in full), and unevaluated* where it is provably a synonym for additionalProperties/items. Whatever it cannot answer it declines at compile time or bails from at runtime, and the parse path takes over unchanged. tests/test_scanner_differential.js holds the scanner and validate() to the same verdict on the same text: 413,130 comparisons over the official suite, a malformed-JSON corpus and generated corruptions, zero disagreements, and the count must stay at zero.
  • Cross-process medians against the same call forced through JSON.parse: accepted documents 1.19x to 1.43x by size; rejection at the first element 37x at 4 KB and 385x at 41 KB.
  • Generated config schemas are first-class: up to 4096 properties per node, and past 48 names the dispatch is a rolling hash accumulated during the key scan, one lookup in a Map passed outside the source, one startsWith to confirm, bodies shared per distinct subschema, and an in-order fast path for machine-written JSON that resynchronises across omitted optional keys. A 26.6 KB config with 1300 declared properties: 136.7 µs by parse-and-validate, 43.8 µs by scan.
  • isValidJSON also remembers the last (text, verdict) pair, since the verdict is a pure function of the text: a drift monitor re-reading an unchanged file answers in 0.44 µs by native string compare. Withheld when user formats or custom keywords are present, since user functions may not be pure.

... (truncated)

Changelog

Sourced from ata-validator's changelog.

1.27.1 - 2026-09-17

Fixed

• A default fills a property the instance does not carry, and both engines asked key in data to find out, which also answers for what the instance inherits: a property named constructor never received its default, and one named __proto__ sent its nested defaults to Object.prototype, since the interpreter's applier walked data.__proto__ as the parent. Both now ask Object.hasOwn. tests/test_defaults_own_keys.js holds it for either engine. Reported and fixed by @​d4tocchini in #43.
• Completing that report, every remaining prototype-unsafe write and walk in the defaults machinery is closed. The nested-defaults applier now refuses to walk a parent the instance does not carry as an own key, which was the reachable pollution: a schema declaring a property named __proto__ with nested defaults, no matter what the input held, resolved data.__proto__ to Object.prototype and wrote the child defaults onto it, for every object in the realm, on both engines. Fills of a property named __proto__ go through Object.defineProperty, because plain assignment of that name rewrites the object's prototype instead of creating a property; type coercion skips that name for the same reason, and the raw value still goes through validation. The AOT parse() emitter gets the same treatment defensively (computed keys in literals, Object.hasOwn presence checks, defineProperty for the one dangerous name), and its record loop, whose keys come from the input, now keeps a JSON-parsed own __proto__ key as an own key in the output instead of silently rewriting the output's prototype.

1.27.0 - 2026-09-17

Added

• parse() is now emitted for the record shape: additionalProperties as a schema, which is what z.record and every generator's map type compile to, with or without declared properties beside it. The key set is open by declaration, so keeping every key is exact, and every undeclared value is rebuilt against the one schema that governs it, stripping unknown keys inside it the same way a declared property's rebuild would. Defaults under a record value are not filled, because the runtime's useDefaults does not fill them there and parse() output stays equal to validate().data. Still declined, loudly: additionalProperties: true (the value is unconstrained, and this pass only copies what it can prove), applicators next to a record (a branch could constrain some keys' values beyond the record schema), and patternProperties (a key matching several patterns must satisfy all of them at once, which the rebuild cannot pick a shape for).
• onWarning now receives a second argument, { kind }, naming which capability degraded: 'error-detail' or 'parse'. A build that requested both can tell the warnings apart instead of treating any warning as degraded errors. build() result warnings carry the same kind field. Existing single-argument callbacks keep working unchanged.

Fixed

• Two more fixed-name collisions in the generated-code path, the same family as the patternProperties helper-scope bug in 1.26.0: a record whose values are themselves records (additionalProperties nested in itself) generated an inner loop that redeclared the outer loop's variables and threw ReferenceError: Cannot access '_av' before initialization at validation time, and patternProperties inside a patternProperties value schema had the same collision on its own loop variables. All three loop names now carry a unique suffix. The combined error generator already did this; the boolean generator now matches it.

1.26.0 - 2026-09-17

Added

• toStandaloneModule(schema, { parse: true }) inlines local, acyclic $refs before the clone proof runs, so schemas that keep their shapes in $defs and reference them, which is every schema a generator emits, now get a parse(). Only a node that is exactly a $ref plus annotations is inlined; a cycle, an external reference or a constraining sibling keyword leaves the reference in place and the clone declines as before. Defaults follow the runtime exactly: a default written next to the $ref fills, a default written inside the referenced definition does not, because validate() with useDefaults draws the same line and parse() must not be more generous than validate(). A new test holds parse() output equal to the runtime's validate().data on the same input.
• When parse: true is requested and the clone still cannot be proven, the decline is loud: onWarning fires with the reason, and the emitted module carries a NOTE comment saying it has no parse export. Previously the only way to notice was reading the export list.

Fixed

• The runtime compiler built patternProperties (and combined additionalProperties) child validators with new Function, which discarded the parent's helper scope: a child schema that needed a compiled pattern or format helper threw ReferenceError at validation time. Child checks are now generated inline in the parent validator and share its helper bindings. Reported and fixed by @​jdalton in #46.
• The TypeScript declarations emitted next to a compiled module now declare the schemaHash export; 1.25.0 added it to every module but not to the generated .d.mts, so importing it by name failed type checking while working at runtime.

1.25.0 - 2026-09-17

Fixed

• Emitted standalone modules compiled their regex patterns on every call. The compiler stores each pattern both as a closure variable and as an inline const _reN = __ataSafeRe(...) in the stored source; in process the inline line never runs (the closure binds the compiled matcher once), but every emitter placed it inside the emitted function, where it shadowed the module-scope binding and rebuilt the matcher per call. A schema with one pattern validated at 202 thousand ops/s as a standalone module while the in-process path ran at millions. Patterns are now declared once at load scope in all four emitters (toStandalone, toStandaloneModule, bundleStandalone, bundleCompact); the same document on the same schema now measures 27.0 million ops/s, 134x. bundleCompact needed care: its deduplication keyed on body text alone, and with the pattern no longer in the body, two schemas differing only in their pattern would have merged, so the key now includes the factory-scope declarations.

Added

• Provably local unevaluated* compiles real error detail on the generated-code path, and therefore in standalone modules. When every occurrence of unevaluatedProperties/unevaluatedItems sits on a node with no $ref and no patternProperties, and every in-place applicator (allOf, anyOf, oneOf, if/then/else) contributes only property names the node's own properties already declares, the keyword is exactly additionalProperties/items in disguise and both the error and combined generators now emit it as such, keeping the keyword's own identity: one error per stray key with params.unevaluatedProperty (ATA7003), one error with params.limit for extra items. toStandaloneModule with error detail requested no longer degrades on these schemas; a config schema of the common if/then/else plus root unevaluatedProperties: false shape ships an AOT module with the same per-field errors the runtime reports. Schemas where the annotations cannot be proven local (unevaluated* next to a $ref, cousin-visible shapes) still decline, loudly, as before. Verified by the error-shape differential (2,816 cases), the engine differential (18,126 cases) and the official suite on all three dialects.
• toStandaloneModule(schema, { positions: true }) also exports validateJSON(text): parse, validate, and on failure attach a dataFrame (byteOffset, length, line, col, text) to every error by walking the original text once. The mapping goes through instancePath, so a key that appears in several sections frames each error on its own occurrence, which a first-occurrence string search does not. A syntax error is the single ATA9001 error with a frame on the document. The walker is the runtime's own buildDataPositionMap, embedded verbatim so the two cannot drift, and it costs about 5 KB in the module (1.7 KB gzipped), which is why it is opt-in.
• toStandaloneModule(schema, { parse: true })'s parse(data) now fills declared default values for absent optional properties (object and array defaults are fresh per call) and is emitted for composed schemas under the same proof the unevaluated* error generators use: in-place applicators are admitted when every property name they mention is already declared in the node's own properties. The common config shape, if/then/else over declared fields with root unevaluatedProperties: false, now gets a parse that enforces the conditional, rejects undeclared keys, and returns the ready object. Two default shapes decline because they are where parse and the runtime would disagree: a required property with a default, and a default the property's own schema rejects.
• Every emitted module exports schemaHash, a 16 character content hash of the schema it was compiled from, over canonical JSON so key order does not matter, computed from the schema as the caller wrote it so dialect normalization does not break the comparison. schemaHash(schema) from ata-validator/build computes the same value; a build detects a stale artifact by comparing the two instead of embedding its own fingerprint.
• The agreement between compiled modules and the runtime is now a stated contract, in docs/STABILITY.md and the API reference: same version, same verdict on every document, enforced by the differential test in every CI run, with the emitters declining or degrading loudly where they cannot prove equivalence.
• The compat shim exports attachDataFrames(errors, text): the same one-pass mapping for Ajv-shaped errors, for callers that keep the source text around. Not an Ajv API; it exists because hand-written line finders based on a string search get repeated keys wrong.

1.24.0 - 2026-09-16

Added

• A schema-directed scanner: isValidJSON() answers the verdict from the JSON text without building the document. Parsing is about three quarters of the cost of a request that only needs yes or no, and a rejection now stops at the byte that caused it. The scanner compiles per schema, on the codegen path only, after 64 calls (generating one costs about 20 µs, so a caller that checks one document never pays), and it declines anything outside its supported core: type, properties, required, additionalProperties, items, prefixItems, the length, size and range keywords, pattern, format, const, enum, local $ref (inlined, acyclic, no base-changing keywords below the root), allOf (merged, with the additionalProperties cross-branch rule written out in full), and unevaluated* where it is provably a synonym for additionalProperties/items. Whatever it cannot answer it declines at compile time or bails from at runtime, and the parse path takes over unchanged. tests/test_scanner_differential.js holds the scanner and validate() to the same verdict on the same text: 413,130 comparisons over the official suite, a malformed-JSON corpus and generated corruptions, zero disagreements, and the count must stay at zero.

... (truncated)

Commits

• f721139 release: 1.27.1
• cc4b229 fix: close the remaining prototype-unsafe writes in defaults and parse
• 1852818 defaults: a property is an own key or absent (#43)
• f4dff88 release: 1.27.0
• aedcd33 feat: parse() for the record shape, warning kinds, and two more fixed-name co...
• d0b982a release: 1.26.0
• 7a04153 feat: parse() for local acyclic $ref, and a loud decline when parse cannot be...
• 1cf6920 fix: preserve pattern property helper scope (#46)
• 3ff5115 fix: generated types declare the schemaHash export
• 0d244cf bench: bundle harness pins ata-validator ^1.25.0
• Additional commits viewable in compare view

Updates @pmndrs/detect-gpu from 6.0.21 to 6.0.22

Commits

• 7310901 chore: release v6.0.22
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[changeset-bot]

⚠️ No Changeset found

Latest commit: 31efc15

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[dependabot]

Looks like these dependencies are no longer being updated by Dependabot, so this is no longer needed.