[dependabot]

Bumps the npm group with 5 updates:

Package	From	To
@types/estree	1.0.9	1.0.10
ata-validator	1.61.1	1.61.3
effect	4.0.7	4.1.0
joi	18.3.0	18.3.1
unplugin-macros	0.23.3	0.23.4

Updates @types/estree from 1.0.9 to 1.0.10

Commits

• See full diff in compare view

Updates ata-validator from 1.61.1 to 1.61.3

Release notes

Sourced from ata-validator's releases.

1.61.3

The validator disappears from the bundle at the framework boundary, and a command that says what a schema change does to documents.

A validator handed to a Standard Schema consumer and never called by the file's own code used to take the full compiled wrapper, 13 KB gzipped with the error pipeline. ata-validator/compiled-standard is the wrapper that carries ~standard alone, on a module that writes plain errors, 733 bytes gzipped; @ata-project/unplugin 0.11.2 picks it where it sees that handover, through Hono's sValidator, hono-openapi, TanStack Form, oRPC, tRPC's .input() and Elysia's hooks, following the call to its import through the file's constants. Bundled with esbuild and gzipped, one validator with an email field, a length, a range and a default:

app	framework alone	ata runtime	plugin 0.11.1	plugin 0.11.2
Hono route for Workers	7.7 KB	66.7 KB	21.0 KB	12.2 KB
Elysia route, { body } hook	106.8 KB	258.4 KB	120.1 KB	110.1 KB
tRPC procedure, .input()	4.6 KB	156.1 KB	18.0 KB	7.8 KB

The issues are the runtime's, held issue for issue on 3,972 answers over 559 suite schemas, and the Hono and Elysia apps answer the same requests with the same responses from both builds. In a fresh process the Hono app imports in 0.99 ms and answers its first request in 9.97 ms against 0.71 and 9.41 with no validation at all.

ata diff <old> <new> reports which documents the old schema accepts and the new one rejects, and the reverse, grouped by the rule that decides them, with the project's own samples preferred as examples. Exit code 1 when the new schema rejects what the old one accepted, so a pull request that tightens a schema fails the check until someone looks.

Checked against 1.61.2, interleaved, both from worktrees (Apple M4 Pro, Node 25.2.1, pure JS): nothing moved.

	1.61.2	1.61.3
ten routes to first validated request	8.70 ms	8.71 ms
request accepted, verdict	40.4 ns	39.6 ns
request rejected, error list read	88.1 ns	88.5 ns
same, code generation blocked, accepted	147.5 ns	149.0 ns
same, code generation blocked, errors read	479.7 ns	478.6 ns
runtime first load in a browser, gzipped	54,522 B	54,521 B
ata-validator/lite, gzipped	57,829 B	57,829 B
compiled module, gzipped	1,868 B	1,868 B

Added

• ata diff <old> <new>: what a change to a schema does to documents. The documents ata verify makes, from both schemas, plus the project's samples, are checked by a Validator built from each schema; the ones the old schema accepts and the new one rejects, and the reverse, are reported grouped by the rule that decides them, with one example each. Exit code 1 when the new schema rejects what the old one accepted, so a pull request that tightens a schema fails the check until someone looks. lib/schema-diff.js, tests/test_schema_diff.js.
• ata-validator/compiled-standard: bareStandard(mod, schema), the compiled-module wrapper for a validator that is only ever handed to a Standard Schema consumer (a router's validator middleware, a form library, an RPC layer) and never called by its own code. Such a consumer reads ~standard alone, and an issue is a message and a path, so the wrapper is built on a module written with plainErrors: true and carries no error pipeline: 733 bytes gzipped, standing alone as an ES module. The issues, the input after defaults and the Standard JSON Schema document are the runtime's on every suite case the compiler takes (tests/test_compiled_standard.js). @ata-project/unplugin uses it where it sees that handover, through Hono's sValidator, hono-openapi, TanStack Form, oRPC, tRPC's .input() and Elysia's hooks: a Hono route bundled for Cloudflare Workers goes from 21.0 to 12.2 KB gzipped against 7.7 KB for Hono alone, an Elysia route from 120.1 to 110.1 against 106.8, a tRPC procedure from 18.0 to 7.8 against 4.6.

1.61.2

Ready for Bun's ahead-of-time compiler, which landed on Bun's main branch on 2026-10-27.

Under bun build --compile --aot, code a library generates at run time is interpreted. ata now takes its own interpreted engine there, through the "aot" export condition Bun reads, and that engine keeps a schema with a format on its fastest path. On the ten-field user schema, per document: 502 to 52 ns for isValidObject(), 518 to 54 ns for validate(), against 480 ns for zod 4 under the same compiler. A module from ata build stays at 34 ns.

The same tier-0 change makes format schemas faster wherever the interpreted engine answers: in a browser before the code generator loads, under a strict Content-Security-Policy, and in ata-validator/lite.

Checked against 1.61.1, interleaved, both from worktrees (Apple M4 Pro, Node 25.2.1, pure JS; Bun AOT on the pull request build d0b27e983):

	1.61.1	1.61.2
ten routes to first validated request	8.87 ms	8.79 ms
request accepted, verdict	42.0 ns	42.2 ns
request rejected, error list read	90.8 ns	91.5 ns
same, code generation blocked, accepted	153.1 ns	151.7 ns
same, code generation blocked, errors read	496.5 ns	496.1 ns

... (truncated)

Changelog

Sourced from ata-validator's changelog.

1.61.3 - 2026-10-29

Added

• ata diff <old> <new>: what a change to a schema does to documents. The documents ata verify makes, from both schemas, plus the project's samples, are checked by a Validator built from each schema; the ones the old schema accepts and the new one rejects, and the reverse, are reported grouped by the rule that decides them, with one example each. Exit code 1 when the new schema rejects what the old one accepted, so a pull request that tightens a schema fails the check until someone looks. lib/schema-diff.js, tests/test_schema_diff.js.
• ata-validator/compiled-standard: bareStandard(mod, schema), the compiled-module wrapper for a validator that is only ever handed to a Standard Schema consumer (a router's validator middleware, a form library, an RPC layer) and never called by its own code. Such a consumer reads ~standard alone, and an issue is a message and a path, so the wrapper is built on a module written with plainErrors: true and carries no error pipeline: 733 bytes gzipped, standing alone as an ES module. The issues, the input after defaults and the Standard JSON Schema document are the runtime's on every suite case the compiler takes (tests/test_compiled_standard.js). @ata-project/unplugin uses it where it sees that handover, through Hono's sValidator, hono-openapi, TanStack Form, oRPC, tRPC's .input() and Elysia's hooks: a Hono route bundled for Cloudflare Workers goes from 21.0 to 12.2 KB gzipped against 7.7 KB for Hono alone, an Elysia route from 120.1 to 110.1 against 106.8, a tRPC procedure from 18.0 to 7.8 against 4.6.

1.61.2 - 2026-10-28

Changed

• Tier 0, the shared verdict for flat object schemas, checks format on a string property with the table the interpreted engine reads (formats.formatChecks, moved out of lib/interpreter-core.js) or the caller's own function, so a schema with an email field stays on it; and on the interpreted engine it answers the verdict whether or not validate() came first, which validate()'s own verdict-first path then uses too. On Node's interpreted engine, the ten-field user schema with format: email: an accepted document 86 to 70 ns, a rejected one 33 to 17, validate() 91 to 75 and 35 to 19. Under Bun's ahead-of-time compiler, with the fix below, isValidObject() 78 to 48 ns and validate() 94 to 51, against 483 for zod 4 there. tests/test_tier0_format.js holds tier 0, the interpreted engine and the generated code to the same verdicts on the 6,558 format cases of the official suite. ata-validator/lite grows by 85 bytes gzipped.

Fixed

• Under Bun's ahead-of-time compiler a runtime Validator took generated code again, which the compiler interprets: 487 ns a document against 78 on the interpreted engine. ata told the two apart by Bun.isAOT, which the compiler's pull request has since removed in favour of an "aot" export condition. The package now leads its exports with that condition, naming index.aot.js and index.aot.mjs, which mark the process before the package loads (lib/aot-mark.js), and lists them as side effects so a bundler keeps them. Measured on the pull request's build of 2026-10-27; tests/test_aot_entry.js holds the condition, the entries and the mark.

Commits

• e5372e5 docs: the README opens with the type and the schema, in both directions
• 5abecf0 release: 1.61.3
• 48fce22 perf: the Standard wrapper's ES module drops two constants nothing read; 782 ...
• 1dd439d chore: remove a symlink a measurement left in the tree
• fa04fac feat: ata diff, the documents a schema change rejects or admits, by rule
• f379a19 docs: the Standard-only wrapper through Elysia and tRPC, with the measured bu...
• bd4270e feat: compiled-standard, the wrapper that carries ~standard alone for a valid...
• d7cc081 chore: lockfile for 1.61.2
• bb57c4f release: 1.61.2
• b22eca6 perf: tier 0 checks format on strings and answers the interpreted verdict; un...
• Additional commits viewable in compare view

Updates effect from 4.0.7 to 4.1.0

Release notes

Sourced from effect's releases.

effect@4.1.0

Minor Changes

• #8829 631d4f4 Thanks @​harrysolovay! - Add Schema.isAscii, a check that accepts only ASCII strings, and the matching SchemaRepresentation.isAsciiReviver.

• #8829 7ea1ea2 Thanks @​wmaurer! - Add an optional cause to the AI NetworkError. It holds the HttpClientError the request failed with, stored unchanged and not redacted, so the reason a request failed is no longer lost. The new NetworkError.fromHttpClientError sets it, and all AI providers now use it. NetworkError.fromRequestError is unchanged.

• #8829 a2ccc14 Thanks @​fubhy! - Fix Atom.Serializable to encode to and decode from Schema.Json, matching the JSON codec used by Atom.serializable. Encoded results may now require narrowing; runtime behavior is unchanged.

• #8829 c4d298d Thanks @​okarin1511! - Render inherited CLI flags in a separate INHERITED FLAGS section and add "full", "summary", and "none" modes for inherited and global flags in CliOutput.defaultFormatter. HelpDoc adds inheritedFlags, commandPath, and globalFlagsScope provenance so summaries can point to the appropriate help, with globals always listed on their declaring command. Custom formatters must read ancestor shared flags from HelpDoc.inheritedFlags instead of HelpDoc.flags.

• #10087 ac10e55 Thanks @​effect-bot! - Add runnerJoinDebounce to ShardingConfig. When set, a runner joining the cluster is only added to shard assignments once the healthy runners have stayed unchanged for that duration, or at most four times that duration after the first pending join. A scale-up or a deployment with a large surge then hands each shard off once instead of once per join. Runners that already hold shards and leave or become unhealthy are still published immediately; a pending runner that leaves only restarts the quiet period. While joins are pending, runners take no new shards, so a shard can stay unlocked briefly until each runner publishes. Defaults to 0, which keeps the current behavior.

• #8829 df8dce5 Thanks @​tim-smart! - Add trim and keepEmptyValues options to SchemaGetter.splitKeyValue, SchemaTransformation.splitKeyValue and Config.Record. Both default to false, so existing callers are unaffected.

  OtlpResource.fromConfig now trims OTEL_RESOURCE_ATTRIBUTES keys and values and keeps entries with an empty value as "".

• #8829 0c24a8f Thanks @​sledorze! - Add a maxDepth option to Context.makeUnsafe, controlling how many Context.add calls are kept as overlays before the context is rebased into a flat map. Defaults to 8.

• #8829 2d1fcd4 Thanks @​effect-bot! - Add an onDstOverlap option to Cron and Schedule.cron that chooses which occurrences of local times repeated when clocks fall back are included: "earlier" (default), "later" or "both". It applies to every repeated local time, including ones not caused by daylight saving time.

  Cron.prev now returns the latest matching instant before its input when starting inside a repeated hour. Near a spring-forward gap it no longer throws or returns an instant at or after its input.

• #8829 8f23668 Thanks @​fubhy! - Replace effect/Crypto with family-specific effect/crypto/* services, opaque keys, CryptoError, a configurable WebCrypto reference and key schemas in effect/Schema. Encoding secret or private keys through byte/format schemas requires { allowEncode: true }.

  Breaking changes

  • Use SecureRandom for randomness and UUIDs, and Digest with algorithm values such as Digest.sha256 for hashing. Replace effect/testing/TestCrypto with Layer.mock for the required services.
  • Provide crypto explicitly; it is no longer included in the runtime *Services bundles. NodeCrypto, BunCrypto, DenoCrypto and BrowserCrypto offer individual family layers and a combined layer, supplying SecureRandom where needed. Core modules offer layerWebCrypto.
  • Provide Digest.Digest instead of Crypto.Crypto to SqlMessageStorage and SingleRunner, and instead of EventLogEncryption to SqlEventLogServerEncrypted.makeStorage and layerStorage. Replace EventLogEncryption.sha256String with digest.digestHex(Digest.sha256, bytes).

  Existing workflow ID, activity idempotency key and event log table-name encodings are unchanged.

  Event log encryption, identity key derivation and session authentication now run on Aead, Digest, Signature and SecureRandom. EventLogEncryption.make and EventLogEncryption.layer take those services from context, so Node apps can use the NodeCrypto layers. EventLogEncryption.layerSubtle and the session auth functions use the Web Crypto layers on the WebCrypto reference instead of globalThis.crypto. Existing identities, derived signing keys and encrypted batches are unchanged.

  UUIDv7 and ULID generation is now monotonic below the maximum 48-bit timestamp, including within a millisecond and across clock rollback. Ordering is per SecureRandom instance; the unsafe helpers and model UUIDv7 defaults share per-realm ordering.

• #8829 3f8f359 Thanks @​jem-computer! - Declare decision images as input fields with Decision.Image, and add Decision.locate, which answers with a bounding box around one target in an image field.

  • DecideOptions.images is removed. Add Decision.Image fields to the input schema and refer to each image by its path in instructions:

    // Before
    DecisionModel.decide(Triage, { input: "Checkout error", images: [screenshot] })
    // After
    const Triage = Decision.make({
      input: Schema.Struct({ report: Schema.String, screenshot: Decision.Image }),
      decisions
    })
    DecisionModel.decide(Triage, { input: { report: "Checkout error", screenshot } })

... (truncated)

Changelog

Sourced from effect's changelog.

4.1.0

Minor Changes

• #8829 631d4f4 Thanks @​harrysolovay! - Add Schema.isAscii, a check that accepts only ASCII strings, and the matching SchemaRepresentation.isAsciiReviver.

• #8829 7ea1ea2 Thanks @​wmaurer! - Add an optional cause to the AI NetworkError. It holds the HttpClientError the request failed with, stored unchanged and not redacted, so the reason a request failed is no longer lost. The new NetworkError.fromHttpClientError sets it, and all AI providers now use it. NetworkError.fromRequestError is unchanged.

• #8829 a2ccc14 Thanks @​fubhy! - Fix Atom.Serializable to encode to and decode from Schema.Json, matching the JSON codec used by Atom.serializable. Encoded results may now require narrowing; runtime behavior is unchanged.

• #8829 c4d298d Thanks @​okarin1511! - Render inherited CLI flags in a separate INHERITED FLAGS section and add "full", "summary", and "none" modes for inherited and global flags in CliOutput.defaultFormatter. HelpDoc adds inheritedFlags, commandPath, and globalFlagsScope provenance so summaries can point to the appropriate help, with globals always listed on their declaring command. Custom formatters must read ancestor shared flags from HelpDoc.inheritedFlags instead of HelpDoc.flags.

• #10087 ac10e55 Thanks @​effect-bot! - Add runnerJoinDebounce to ShardingConfig. When set, a runner joining the cluster is only added to shard assignments once the healthy runners have stayed unchanged for that duration, or at most four times that duration after the first pending join. A scale-up or a deployment with a large surge then hands each shard off once instead of once per join. Runners that already hold shards and leave or become unhealthy are still published immediately; a pending runner that leaves only restarts the quiet period. While joins are pending, runners take no new shards, so a shard can stay unlocked briefly until each runner publishes. Defaults to 0, which keeps the current behavior.

• #8829 df8dce5 Thanks @​tim-smart! - Add trim and keepEmptyValues options to SchemaGetter.splitKeyValue, SchemaTransformation.splitKeyValue and Config.Record. Both default to false, so existing callers are unaffected.

  OtlpResource.fromConfig now trims OTEL_RESOURCE_ATTRIBUTES keys and values and keeps entries with an empty value as "".

• #8829 0c24a8f Thanks @​sledorze! - Add a maxDepth option to Context.makeUnsafe, controlling how many Context.add calls are kept as overlays before the context is rebased into a flat map. Defaults to 8.

• #8829 2d1fcd4 Thanks @​effect-bot! - Add an onDstOverlap option to Cron and Schedule.cron that chooses which occurrences of local times repeated when clocks fall back are included: "earlier" (default), "later" or "both". It applies to every repeated local time, including ones not caused by daylight saving time.

  Cron.prev now returns the latest matching instant before its input when starting inside a repeated hour. Near a spring-forward gap it no longer throws or returns an instant at or after its input.

• #8829 8f23668 Thanks @​fubhy! - Replace effect/Crypto with family-specific effect/crypto/* services, opaque keys, CryptoError, a configurable WebCrypto reference and key schemas in effect/Schema. Encoding secret or private keys through byte/format schemas requires { allowEncode: true }.

  Breaking changes

  • Use SecureRandom for randomness and UUIDs, and Digest with algorithm values such as Digest.sha256 for hashing. Replace effect/testing/TestCrypto with Layer.mock for the required services.
  • Provide crypto explicitly; it is no longer included in the runtime *Services bundles. NodeCrypto, BunCrypto, DenoCrypto and BrowserCrypto offer individual family layers and a combined layer, supplying SecureRandom where needed. Core modules offer layerWebCrypto.
  • Provide Digest.Digest instead of Crypto.Crypto to SqlMessageStorage and SingleRunner, and instead of EventLogEncryption to SqlEventLogServerEncrypted.makeStorage and layerStorage. Replace EventLogEncryption.sha256String with digest.digestHex(Digest.sha256, bytes).

  Existing workflow ID, activity idempotency key and event log table-name encodings are unchanged.

  Event log encryption, identity key derivation and session authentication now run on Aead, Digest, Signature and SecureRandom. EventLogEncryption.make and EventLogEncryption.layer take those services from context, so Node apps can use the NodeCrypto layers. EventLogEncryption.layerSubtle and the session auth functions use the Web Crypto layers on the WebCrypto reference instead of globalThis.crypto. Existing identities, derived signing keys and encrypted batches are unchanged.

  UUIDv7 and ULID generation is now monotonic below the maximum 48-bit timestamp, including within a millisecond and across clock rollback. Ordering is per SecureRandom instance; the unsafe helpers and model UUIDv7 defaults share per-realm ordering.

• #8829 3f8f359 Thanks @​jem-computer! - Declare decision images as input fields with Decision.Image, and add Decision.locate, which answers with a bounding box around one target in an image field.

  • DecideOptions.images is removed. Add Decision.Image fields to the input schema and refer to each image by its path in instructions:

    // Before
    DecisionModel.decide(Triage, { input: "Checkout error", images: [screenshot] })
    // After
    const Triage = Decision.make({
      input: Schema.Struct({ report: Schema.String, screenshot: Decision.Image }),
      decisions
    })

... (truncated)

Commits

• 9a91b19 Version Packages (#10038)
• ac10e55 Debounce runner joins in shard assignments (#10073)
• 89b99d2 Document showing an introduction before CLI fallback prompts (#10074)
• 472c469 Require Node 22.19 and use the global WebSocket for Node clients (#10084)
• fb5dbee Release a frozen runner's MySQL shard locks after shardLockExpiration (#10093)
• 8309b94 Restore idle_session_timeout before returning the PostgreSQL shard-lock conne...
• 58713b3 Remove redundant ScopedCache tests (#10092)
• c4a00fc Reject malformed W3C trace flags (#10085)
• a8e5e6c Reject misplaced signs in BigDecimal strings (#10083)
• 7890077 Reject uppercase HTTP trace identifiers (#10086)
• Additional commits viewable in compare view

Updates joi from 18.3.0 to 18.3.1

Commits

• 4009bfb 18.3.1
• 976cf13 Merge pull request #3165 from hapijs/fix/rename-prototype-keys
• 9d82116 fix: rename to prototype-named keys
• 316d08d Merge pull request #3164 from hapijs/fix/messages-proto-language
• 76f5771 fix: reject proto as a messages language
• bc1b041 Merge pull request #3162 from hapijs/fix/email-multiple-split
• 03dc1d9 fix: linear split for email multiple
• See full diff in compare view

Updates unplugin-macros from 0.23.3 to 0.23.4

Release notes

Sourced from unplugin-macros's releases.

v0.23.4

   🐞 Bug Fixes

• Skip Vitest fs module cache for modules importing macros  -  by @​sxzzbot in unplugin/unplugin-macros#180 (83a74)

    View changes on GitHub

Commits

• 4232572 chore: release v0.23.4
• 83a742f fix: skip Vitest fs module cache for modules importing macros (#180)
• 38f19c6 chore(deps): update pnpm to v12.15.0 (#178)
• 80ea7b4 chore(deps): update pnpm to v12.14.0 (#177)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[netlify]

✅ Deploy Preview for schemabenchmarks ready!

Name	Link
🔨 Latest commit	3ee1481
🔍 Latest deploy log	https://app.netlify.com/projects/schemabenchmarks/deploys/6ae4631be0c82208b13d61f3
😎 Deploy Preview	https://deploy-preview-396--schemabenchmarks.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.