feat: bump @expressots/core from 4.0.0-preview.3.4 to 4.0.0

[dependabot]

Bumps @expressots/core from 4.0.0-preview.3.4 to 4.0.0.

Release notes

Sourced from @​expressots/core's releases.

ExpressoTS 4.0.0 — stable release of the v4 line.

Highlights

• Bootstrap-first API: bootstrap(App) with AppExpress; AppFactory is now internal
• Subpath exports: @expressots/core/testing, /di, /render, /path-resolver
• Strict TypeScript: strictNullChecks + noImplicitAny enabled across the codebase
• Leaner install: single shared declaration tree (~0.8 MB smaller unpacked, 879 files), sideEffects declared for safe tree-shaking
• Validation: validationRegistry singleton; optional peers for zod, yup, class-validator
• Agent-ready: llms.txt ships in the package
• TypeScript 7-clean configs with a ts7-compat CI gate (toolchain remains TS 5.x)

Breaking changes

• Removed deprecated APIs: root AppFactory export, v3 InMemoryDataProvider/InMemoryDataTable, LazyServiceIdentifer typo alias, Logger#formatMessage, AppContainer#viewContainerBindings
• Node.js >= 20.19.0 required

Full details in CHANGELOG.md.

Changelog

Sourced from @​expressots/core's changelog.

4.0.0 (2026-07-16)

Stable release. Closes the v4 preview line with a production hardening pass.

Breaking Changes

• removed deprecated APIs: AppFactory is no longer exported (it remains the internal engine behind bootstrap()); the v3 InMemoryDataProvider/InMemoryDataTable were removed (use InMemoryDBProvider); the LazyServiceIdentifer typo alias was removed (use LazyServiceIdentifier); Logger#formatMessage (legacy) and AppContainer#viewContainerBindings (use getFormattedBindingsView() or introspect()) were removed.
• engines: minimum Node.js is now 20.19.0 (aligned across all @​expressots packages).

Features

• subpath exports: @expressots/core/testing, @expressots/core/di, @expressots/core/render, and @expressots/core/path-resolver are now importable directly for a leaner dependency surface. The root export keeps the full surface for compatibility.
• validation: new validationRegistry shared singleton export, matching the adapter documentation (validationRegistry.register(createZodValidator())).
• optional validator peers: zod, yup, and class-validator are now declared as optional peerDependencies, so package managers surface version compatibility without forcing an install.
• llms.txt: the published package now ships an llms.txt summary of the public API for AI coding agents.

Build System

• TypeScript 7 compatibility: build configs no longer use the removed downlevelIteration and moduleResolution: "node" options (now node16 with explicit rootDir); the codebase type-checks cleanly under TypeScript 7. The toolchain itself remains TypeScript 5.x.
• published manifest is now stripped of devDependencies, scripts, and repo-only tooling config by release:prepare.
• type declarations now ship once (lib/cjs/types) and serve both the CJS and ESM entry points; the previously duplicated lib/esm/types tree is gone, cutting the installed size by about 1.5 MB.
• sideEffects is now declared so bundlers can tree-shake safely without dropping decorator registration modules.
• correction to earlier notes: subpath exports first ship in this release; preview.3 only exposed the root entry point.

Commits

• c9fc87e chore(release): bump to 4.0.0
• 6089114 chore(core): production hardening for 4.0 GA
• eaa54bb fix(ci): regenerate package-lock.json with npm 10 for npm ci
• 24808ea feat: add zod as a dependency and enhance ZodValidatorAdapter tests
• f176d16 fix(test): skip zod schema tests when optional peer is absent
• 74e1209 chore: update package-lock.json to remove unused chalk dependencies and add a...
• ca2bdd6 chore: remove @​codecov/vite-plugin from package.json and package-lock.json
• 92783cb Merge pull request #866 from expressots/test/coverage-codeql-paths
• 236e614 test(coverage): cover CodeQL security fix paths for codecov patch
• 56cfe84 Merge pull request #865 from expressots/feature/v4.0
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)