Chore/2026 uplift

.changeset/config.json

@@ -1,11 +1,12 @@
 {
-	"$schema": "https://unpkg.com/@changesets/config@2.3.0/schema.json",
-	"changelog": [
-		"@svitejs/changesets-changelog-github-compact",
-		{
-			"repo": "FormidableLabs/react-fast-compare"
-		}
-	],
-	"access": "public",
-	"baseBranch": "master"
-}
+  "$schema": "https://unpkg.com/@changesets/config@4.0.0/schema.json",
+  "changelog": [
+    "@changesets/changelog-github",
+    { "repo": "FormidableLabs/react-fast-compare", "disableThanks": true }
+  ],
+  "access": "public",
+  "baseBranch": "master",
+  "snapshot": {
+    "useCalculatedVersion": true
+  }
+}

.editorconfig

@@ -0,0 +1,14 @@
+# editorconfig.org
+root = true
+
+[*]
+indent_style = space
+indent_size = 2
+end_of_line = lf
+charset = utf-8
+trim_trailing_whitespace = true
+insert_final_newline = true
+max_line_length = 80
+
+[*.md]
+trim_trailing_whitespace = false

.git-blame-ignore-revs

@@ -0,0 +1,10 @@
+# Mechanical churn commits (formatting, lint fixes) that `git blame` should
+# skip. GitHub reads this file automatically. Locally:
+#   git config blame.ignoreRevsFile .git-blame-ignore-revs
+# PRs are squash-merged, so each SHA is added after its PR merges.
+
+# [uplift] chore: format with oxfmt (#143)
+40505673987556571a90f975919ba7e318235660
+
+# [uplift] chore: fix oxlint errors (#144)
+9b6ffb1638bb1c15c79c3c8e7566b4bb2f81f288

.github/pinact.yml

@@ -0,0 +1,11 @@
+# pinact (https://github.com/suzuki-shunsuke/pinact) pins third-party actions to
+# a commit SHA and updates them: `pinact run --update`. See CONTRIBUTING.md.
+version: 3
+# Skip versions published in the last week, like `pnpm dep:check`.
+min_age:
+  value: 7
+rules:
+  # GitHub's own actions stay on version tags (see .github/zizmor.yml).
+  - ignore: true
+    conditions:
+      - expr: ActionRepoOwner in ["actions", "github"]

.github/pull_request_template.md

@@ -12,7 +12,7 @@ Please include a summary of the change and which issue is fixed. Please also inc
 ## Checklist:
 
 - [ ] All tests are passing
-- [ ] Type definitions, if updated, pass both `test-ts-defs` and `test-ts-usage`
-- [ ] Benchmark performance has not significantly decreased
-- [ ] Bundle size has not been significantly impacted
-- [ ] The bundle size badge has been updated to reflect the new size
+- [ ] Changeset added (`pnpm changeset`) if this changes what users get (code, types, published files)
+- [ ] Type definitions, if updated, pass `types:check` and `pack:check`
+- [ ] Benchmark performance (`pnpm bench`, CI job summary) has not significantly decreased
+- [ ] Bundle size (`pnpm size`, CI job summary) has not been significantly impacted

.github/workflows/ci.yml

@@ -1,4 +1,3 @@
----
 name: CI
 
 on:
@@ -8,32 +7,143 @@ on:
   pull_request:
     types: [opened, synchronize, reopened]
 
+# Reset permissions and grant them per job.
+permissions: {}
+
 jobs:
+  # Security audit of the workflows (.github/zizmor.yml), including that
+  # third-party actions are pinned to a commit SHA. Same config as
+  # `pnpm lint:gha`.
+  lint-gha:
+    name: Lint GitHub Actions
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read # to check out repo (actions/checkout)
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - uses: zizmorcore/zizmor-action@53290badfa369cb0bf7ad16342cb62c2fa47ac7b # v0.8.0
+        with:
+          version: 1.31.1
+          # The default, set explicitly: online audits include impostor-commit,
+          # which checks that each SHA pin is a commit in the action's own repo.
+          online-audits: true
+          advanced-security: false
+          annotations: true
+
   test:
+    name: Test on ${{ matrix.os }}
     runs-on: ${{ matrix.os }}
+    permissions:
+      contents: read # to check out repo (actions/checkout)
     strategy:
       matrix:
         os:
           - ubuntu-latest
           - windows-latest
-        node_version:
-          - 18
-    name: Node ${{ matrix.node_version }} on ${{ matrix.os }}
     steps:
       - name: Use LF EOL
         if: ${{ matrix.os == 'windows-latest' }}
         run: |
           git config --global core.autocrlf false
-      - name: Checkout
-        uses: actions/checkout@v4
-      - name: Setup node
-        uses: actions/setup-node@v4
-        with:
-          cache: "yarn"
-          node-version: ${{ matrix.node_version }}
-      - name: Install Dependencies
-        run: yarn install --frozen-lockfile
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+          # The parent commit too, for the size comparison. On pull requests
+          # HEAD is a merge commit, so HEAD^1 is the base it merged onto.
+          fetch-depth: 2
+      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
+      - uses: actions/setup-node@v7
+        with:
+          node-version-file: '.nvmrc'
+          cache: 'pnpm'
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+      # For the `browser` test project (Vitest browser mode).
+      - name: Install browsers
+        if: matrix.os == 'ubuntu-latest'
+        run: pnpm exec playwright install --with-deps --only-shell chromium firefox webkit
+      - name: Check
+        if: matrix.os == 'ubuntu-latest'
+        run: pnpm check
+      # Node project only (v8 coverage doesn't work in Firefox or WebKit).
+      # Reported in the job summary, not gated: Check gates on the tests.
+      - name: Coverage
+        if: matrix.os == 'ubuntu-latest'
+        continue-on-error: true
+        run: pnpm test --project node --coverage
+      - name: Coverage summary
+        if: always() && matrix.os == 'ubuntu-latest'
+        run: |
+          {
+            echo '### Coverage'
+            if [ -f coverage/summary.txt ]; then
+              echo '```'
+              cat coverage/summary.txt
+              echo '```'
+            else
+              echo 'No coverage summary (the Coverage step failed or was skipped).'
+            fi
+          } >> "$GITHUB_STEP_SUMMARY"
+      # Report only: adds the size table to the job summary, never fails.
+      - name: Size
+        if: always() && matrix.os == 'ubuntu-latest'
+        run: pnpm size --base HEAD^1
+      # Format, lint, the packed tarball and the browsers don't depend on the
+      # OS, so Windows only runs the Node tests.
       - name: Test
-        run: yarn test
-      - name: Codecov
-        run: yarn codecov
+        if: matrix.os == 'windows-latest'
+        run: pnpm test --project node
+
+  # The lockfile has React 19 and Preact 11, which the test job covers. This
+  # job runs the Node tests on the oldest versions we check: exactly React
+  # 18.0.0, and the newest Preact 10 (`preact/compat`). The library doesn't
+  # depend on either; this guards its `$$typeof` / `_owner` handling.
+  older-renderers:
+    name: Test (React 18.0.0, Preact 10)
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read # to check out repo (actions/checkout)
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
+      - uses: actions/setup-node@v7
+        with:
+          node-version-file: '.nvmrc'
+          cache: 'pnpm'
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+      # Changes the working tree only; nothing is committed. Outside the
+      # lockfile on purpose, but still under `minimumReleaseAge`, and the job
+      # has no secrets and read-only permissions.
+      - name: Install React 18.0.0 and Preact 10
+        run: | # zizmor: ignore[adhoc-packages]
+          pnpm add --save-dev react@18.0.0 react-dom@18.0.0 preact@^10
+          node -e 'for (const [p, v] of [["react", "18.0.0"], ["react-dom", "18.0.0"], ["preact", "10."]]) { const got = require(`${p}/package.json`).version; console.log(`${p} ${got}`); if (!got.startsWith(v)) throw new Error(`${p} is ${got}, expected ${v}`); }'
+      - name: Test
+        run: pnpm test --project node
+
+  # Report only: `pnpm bench` adds the benchmark tables to the job summary.
+  # Shared runners are too noisy to gate on the numbers; the job fails only
+  # if the benchmark itself breaks.
+  bench:
+    name: Benchmarks
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read # to check out repo (actions/checkout)
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
+      - uses: actions/setup-node@v7
+        with:
+          node-version-file: '.nvmrc'
+          cache: 'pnpm'
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+      - name: Benchmarks
+        run: pnpm bench