contractual next version by omermorad · Pull Request #15 · codotech/contractual

omermorad · 2026-03-12T16:32:09Z

No description provided.

Change `npx contractual` to `npx @contractual/cli` to ensure the correct package is used from the Verdaccio registry instead of an unrelated `contractual` package from npm.

Changed JSON output from { results: [...] } to { contracts: { name: {...} } } to match expected format in e2e tests and provide better ergonomics for scripting (e.g., parsed.contracts.order.changes).

- @contractual/changesets@0.1.0-dev.0 - @contractual/cli@0.1.0-dev.0 - @contractual/differs.json-schema@0.1.0-dev.0 - @contractual/governance@0.1.0-dev.0 - @contractual/types@0.1.0-dev.0

- Change openapi-diff from ^0.24.1 to ^0.23.7 - Version 0.24.x doesn't exist on npm, latest is 0.23.7 - Fixes npm install errors when using published packages

Update tests to use new contracts object format instead of results array: - Old format: { results: [...] } - New format: { contracts: { contractName: {...} } } Fixes: - --format json test: check for contracts object instead of results array - --severity breaking test: iterate over contracts object - --severity non-breaking test: iterate over contracts object All 17 tests now passing.

- @contractual/cli@0.1.0-dev.1 - @contractual/governance@0.1.0-dev.1

Replace the `openapi-diff` npm package (3.0 only) with a custom OpenAPI differ built on @redocly/openapi-core, supporting both 3.0 and 3.1 specs. Extract shared schema diffing primitives (walker, classifiers, ref-resolver) into @contractual/differs.core so they can be reused across differs. New packages: - @contractual/differs.core — shared walker, classifiers, ref-resolver - @contractual/differs.openapi — OpenAPI 3.0/3.1 differ via Redocly Changes: - @contractual/differs.json-schema now wraps differs.core (backward compat) - @contractual/governance drops openapi-diff dep, registers new differ - @contractual/types extended with 15 OpenAPI structural change types - Add e2e tests for OpenAPI 3.1 (type arrays, type narrowing/widening) Spec version sync: - New utility `updateSpecVersion()` in @contractual/changesets that updates the version field inside spec files (info.version for OpenAPI/AsyncAPI, top-level version for ODCS, skipped for JSON Schema) - Preserves YAML comments/formatting via parseDocument(), detects JSON indent - Creates missing version fields (e.g., missing info object) automatically - Called before bump/setVersion so snapshot copies include the updated version - Per-contract opt-out via `syncVersion: false` in contractual.config.json - CLI flag `--no-sync-version` to skip for all contracts in a run - Integrated into `contract add` command for initial version sync - 22 e2e tests covering all spec types, bump types, missing fields, pre-release, multi-contract, config opt-out, and CLI flag # Conflicts: # pnpm-lock.yaml

- @contractual/changesets@0.1.0-dev.1 - @contractual/cli@0.1.0-dev.2 - @contractual/differs.core@0.1.0-dev.1 - @contractual/differs.json-schema@0.1.0-dev.1 - @contractual/differs.openapi@0.1.0-dev.1 - @contractual/governance@0.1.0-dev.2 - @contractual/types@0.1.0-dev.1

…flow Redocly's bundle with dereference:true creates JS object cycles for circular schemas (e.g. Category referencing itself). Our deepEqual recurses infinitely on these cycles. Fix: use Redocly for bundling only (resolves external refs), then use our own ref-resolver from differs.core which has circular detection and replaces cycles with $circularRef placeholders. Also: - Move @redocly/openapi-core from optional peer dep to regular dep in differs.openapi so users don't need to install it separately - Remove peer dep from governance (gets it transitively) - Add e2e tests for circular ref schemas - Add timeout option to e2e test helper

- @contractual/cli@0.1.0-dev.3 - @contractual/differs.openapi@0.1.0-dev.2 - @contractual/governance@0.1.0-dev.3

- @contractual/changesets@0.1.0-dev.4 - @contractual/cli@0.1.0-dev.4 - @contractual/differs.core@0.1.0-dev.4 - @contractual/differs.json-schema@0.1.0-dev.4 - @contractual/differs.openapi@0.1.0-dev.4 - @contractual/governance@0.1.0-dev.4 - @contractual/types@0.1.0-dev.4

… changes - Adding optional parameter is now non-breaking (was incorrectly breaking) - Adding required parameter uses new parameter-required-added type (breaking) - Detect operation-level metadata changes: description, summary, deprecated - Detect top-level info.description and info.title changes - All metadata changes classified as patch (creates changesets, not breaking)

…nter paths formatChangeMessage() had no cases for OpenAPI structural types (path-added, operation-added, parameter-*, response-*, etc.) so they were falling through to "Unknown change at /paths/~1v2~1media". Now shows "New path added: /v2/media" instead. - Add cases for all 16 OpenAPI structural change types - Decode JSON Pointer paths for display (~1 → /, ~0 → ~) - Add e2e tests for message formatting

- @contractual/changesets@0.1.0-dev.5 - @contractual/cli@0.1.0-dev.5 - @contractual/differs.core@0.1.0-dev.5 - @contractual/differs.json-schema@0.1.0-dev.5 - @contractual/differs.openapi@0.1.0-dev.5 - @contractual/governance@0.1.0-dev.5 - @contractual/types@0.1.0-dev.5

anyOf/oneOf/allOf and conditional schema changes were falling through to the default case, producing "Unknown change" messages in PR comments.

- @contractual/cli@0.1.0-next.0 - @contractual/differs.core@0.1.0-next.0 - @contractual/differs.json-schema@0.1.0-next.0 - @contractual/differs.openapi@0.1.0-next.0 - @contractual/governance@0.1.0-next.0

This reverts commit de318c0.

- @contractual/cli@0.1.0-dev.6 - @contractual/differs.core@0.1.0-dev.6 - @contractual/differs.json-schema@0.1.0-dev.6 - @contractual/differs.openapi@0.1.0-dev.6 - @contractual/governance@0.1.0-dev.6

… double slashes OpenAPI path keys like /v1/extract were producing //v1/extract in changeset output. Decode per-segment and bracket keys containing slashes.

- @contractual/cli@0.1.0-dev.7 - @contractual/differs.core@0.1.0-dev.7 - @contractual/differs.json-schema@0.1.0-dev.7 - @contractual/differs.openapi@0.1.0-dev.7 - @contractual/governance@0.1.0-dev.7

updateYamlSpec parsed leniently with parseDocument() then called doc.toString() unconditionally, which throws 'Document with errors cannot be stringified' whenever the spec has any recoverable parse error (e.g. an under-indented multi-line scalar deep in the file). A cosmetic version sync would then take down the entire release. Now: clean docs use the structured setIn + toString path; docs with parse errors fall back to a surgical in-place splice of just the version field's source range, leaving malformed regions untouched; if the field cannot be located we warn and continue instead of throwing. Numeric-looking versions are kept as strings. Adds a co-located unit test (vitest devDep + lockfile entry) and excludes *.test.ts / *.spec.ts from tsconfig.build.json so tests are never compiled into the published dist.

- @contractual/changesets@0.1.0-dev.6 - @contractual/cli@0.1.0-dev.8

qballer · 2026-06-18T14:13:05Z

Small PR :)

github-advanced-security · 2026-09-29T05:33:55Z

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

Bumps [@inquirer/prompts](https://github.com/SBoudrias/Inquirer.js) from 8.5.2 to 8.7.2. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/SBoudrias/Inquirer.js/releases">@inquirer/prompts's releases</a>.</em></p> <blockquote> <h2><code>@inquirer/prompts</code><a href="https://github.com/8"><code>@8</code></a>.7.2</h2> <h3>What's new</h3> <ul> <li>Fixed a race where keystrokes batched in the same tick as the key that settled a prompt could still reach keypress handlers after the prompt was done, cancelled, or aborted (<code>@inquirer/core</code>, <a href="https://redirect.github.com/SBoudrias/Inquirer.js/pull/2255">#2255</a>, closes <a href="https://redirect.github.com/SBoudrias/Inquirer.js/issues/1816">#1816</a>).</li> <li><code>confirm()</code> now trims surrounding whitespace from answers before matching yes/no keywords (<code>@inquirer/confirm</code>, <a href="https://redirect.github.com/SBoudrias/Inquirer.js/pull/2254">#2254</a>).</li> </ul> <h3>Included</h3> <ul> <li><code>@inquirer/checkbox@^5.2.5</code></li> <li><code>@inquirer/confirm@^6.3.2</code></li> <li><code>@inquirer/editor@^5.3.3</code></li> <li><code>@inquirer/expand@^5.1.5</code></li> <li><code>@inquirer/input@^5.1.6</code></li> <li><code>@inquirer/number@^4.2.3</code></li> <li><code>@inquirer/password@^5.2.2</code></li> <li><code>@inquirer/rawlist@^5.3.5</code></li> <li><code>@inquirer/search@^4.3.3</code></li> <li><code>@inquirer/select@^5.2.5</code></li> </ul> <h2><code>@inquirer/prompts</code><a href="https://github.com/8"><code>@8</code></a>.7.1</h2> <h3>What's new</h3> <ul> <li>All bundled prompts now pin <code>@inquirer/type</code> to an exact version in their published manifests. Since these type definitions leak into consumers' <code>tsc</code> runs, a semver range on the types-only dependency could break downstream TypeScript builds without any change to Inquirer.js itself (<a href="https://redirect.github.com/SBoudrias/Inquirer.js/pull/2247">#2247</a>, fixes <a href="https://redirect.github.com/SBoudrias/Inquirer.js/issues/2244">#2244</a>).</li> </ul> <h3>Included</h3> <ul> <li><code>@inquirer/checkbox@^5.2.4</code></li> <li><code>@inquirer/confirm@^6.3.1</code></li> <li><code>@inquirer/editor@^5.3.2</code></li> <li><code>@inquirer/expand@^5.1.4</code></li> <li><code>@inquirer/input@^5.1.5</code></li> <li><code>@inquirer/number@^4.2.2</code></li> <li><code>@inquirer/password@^5.2.1</code></li> <li><code>@inquirer/rawlist@^5.3.4</code></li> <li><code>@inquirer/search@^4.3.2</code></li> <li><code>@inquirer/select@^5.2.4</code></li> </ul> <h2><code>@inquirer/prompts</code><a href="https://github.com/8"><code>@8</code></a>.7.0</h2> <h3>What's new</h3> <ul> <li><code>password</code> gains the <code>toggleMask</code> option (ctrl+t to reveal the typed value).</li> <li><code>confirm</code> now matches localized yes/no answers per-locale.</li> <li>Prettified prompt and theme types for better IDE display.</li> <li>Added <code>inquirer-grouped-checkbox</code> to the community prompts list (<a href="https://redirect.github.com/SBoudrias/Inquirer.js/pull/2236">#2236</a>).</li> </ul> <h3>Included</h3>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/SBoudrias/Inquirer.js/commit/cbdb34bfc6c245941d80ef88493c50b3d6dbfce6"><code>cbdb34b</code></a> chore: Publish new release</li> <li><a href="https://github.com/SBoudrias/Inquirer.js/commit/8340d2dd764d4b11d4e200412b614f9964ae0691"><code>8340d2d</code></a> fix(<code>@inquirer/core</code>): clear hook effects before settling prompts</li> <li><a href="https://github.com/SBoudrias/Inquirer.js/commit/2475e07186d824d52504095c71c2272d9e7338fe"><code>2475e07</code></a> test(<code>@inquirer/core</code>): cover hook cleanup error semantics</li> <li><a href="https://github.com/SBoudrias/Inquirer.js/commit/15cd8d3b53bfc270633072073c24d6be6ce3d83b"><code>15cd8d3</code></a> fix(confirm): ignore surrounding whitespace in answers</li> <li><a href="https://github.com/SBoudrias/Inquirer.js/commit/9cb0da6c187346c955ab0b788fa1a88c897f16da"><code>9cb0da6</code></a> chore(deps): Bump github/codeql-action/analyze from 4.37.7 to 4.37.9</li> <li><a href="https://github.com/SBoudrias/Inquirer.js/commit/1c750bc55ab4fac310d70db84a7a6ada76c0e854"><code>1c750bc</code></a> chore(deps-dev): Bump the build group with 3 updates (<a href="https://redirect.github.com/SBoudrias/Inquirer.js/issues/2251">#2251</a>)</li> <li><a href="https://github.com/SBoudrias/Inquirer.js/commit/81f1525110990603e9796d48eecde0f8c2d2fc98"><code>81f1525</code></a> chore(deps-dev): Bump <code>@types/node</code> in the types group (<a href="https://redirect.github.com/SBoudrias/Inquirer.js/issues/2252">#2252</a>)</li> <li><a href="https://github.com/SBoudrias/Inquirer.js/commit/7c27f26606a16b6e8f55b51e4431c72658c674c5"><code>7c27f26</code></a> chore(deps-dev): Bump oxfmt in the formatting group (<a href="https://redirect.github.com/SBoudrias/Inquirer.js/issues/2249">#2249</a>)</li> <li><a href="https://github.com/SBoudrias/Inquirer.js/commit/6119088a4e07ec59460c3cd44d06817de97bfdac"><code>6119088</code></a> chore(deps): Bump github/codeql-action/init from 4.37.7 to 4.37.9 (<a href="https://redirect.github.com/SBoudrias/Inquirer.js/issues/2250">#2250</a>)</li> <li><a href="https://github.com/SBoudrias/Inquirer.js/commit/0d167c0aface3f5cf95132ada9bfec7946dd5b74"><code>0d167c0</code></a> chore(deps-dev): Bump the linting group with 4 updates (<a href="https://redirect.github.com/SBoudrias/Inquirer.js/issues/2248">#2248</a>)</li> <li>Additional commits viewable in <a href="https://github.com/SBoudrias/Inquirer.js/compare/@inquirer/prompts@8.5.2...@inquirer/prompts@8.7.2">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for <code>@inquirer/prompts</code> since your current version.</p> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=@inquirer/prompts&package-manager=npm_and_yarn&previous-version=8.5.2&new-version=8.7.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [chalk](https://github.com/chalk/chalk) from 5.6.2 to 6.0.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/chalk/chalk/releases">chalk's releases</a>.</em></p> <blockquote> <h2>v6.0.0</h2> <h3>Breaking</h3> <ul> <li>Require Node.js 22 8a94e0e</li> </ul> <h3>Improvements</h3> <ul> <li>Add underline styles and underline colors (<a href="https://redirect.github.com/chalk/chalk/issues/689">#689</a>) 4c304dd</li> <li>Improve performance 5729845 fa5cff2</li> </ul> <h3>Fixes</h3> <ul> <li>Treat a numeric <code>FORCE_COLOR</code> as an exact level (<a href="https://redirect.github.com/chalk/chalk/issues/688">#688</a>) e912931</li> <li>Downsample <code>ansi256()</code> and <code>bgAnsi256()</code> to 16 colors at level 1 (<a href="https://redirect.github.com/chalk/chalk/issues/687">#687</a>) ff549c5</li> </ul> <hr /> <p><a href="https://github.com/chalk/chalk/compare/v5.6.2...v6.0.0">https://github.com/chalk/chalk/compare/v5.6.2...v6.0.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/chalk/chalk/commit/661317e6f91fe7c90306c2c48ea9354562ee9146"><code>661317e</code></a> 6.0.0</li> <li><a href="https://github.com/chalk/chalk/commit/5729845f33d357e0c21b29b2b16849b72fb8cec4"><code>5729845</code></a> Improve performance</li> <li><a href="https://github.com/chalk/chalk/commit/4c304dd72cce5a036c02e5dd8af52996ae98501f"><code>4c304dd</code></a> Add extended underline styles and underline colors (<a href="https://redirect.github.com/chalk/chalk/issues/689">#689</a>)</li> <li><a href="https://github.com/chalk/chalk/commit/e91293130c7d642c7b91152c3c942743a3b910a7"><code>e912931</code></a> Fix: Treat a numeric <code>FORCE_COLOR</code> as an exact level (<a href="https://redirect.github.com/chalk/chalk/issues/688">#688</a>)</li> <li><a href="https://github.com/chalk/chalk/commit/8a94e0ebfc495dda27f7090fb1a012790b15a76d"><code>8a94e0e</code></a> Require Node.js 22</li> <li><a href="https://github.com/chalk/chalk/commit/fa5cff280e821c928dab716a03beff06529ffaf3"><code>fa5cff2</code></a> Optimize 2-argument calls (<a href="https://redirect.github.com/chalk/chalk/issues/670">#670</a>)</li> <li><a href="https://github.com/chalk/chalk/commit/ff549c534c413a9225322c1ff4e5fc0d97ae5610"><code>ff549c5</code></a> Fix: Downsample <code>ansi256()</code> and <code>bgAnsi256()</code> to 16 colors at level 1 (<a href="https://redirect.github.com/chalk/chalk/issues/687">#687</a>)</li> <li><a href="https://github.com/chalk/chalk/commit/678e5505458d0cf40134e205aed4454e0eeac45c"><code>678e550</code></a> Tweaks</li> <li><a href="https://github.com/chalk/chalk/commit/aa06bb5ac3f14df9fda8cfb54274dfc165ddfdef"><code>aa06bb5</code></a> Fix typos (<a href="https://redirect.github.com/chalk/chalk/issues/664">#664</a>)</li> <li>See full diff in <a href="https://github.com/chalk/chalk/compare/v5.6.2...v6.0.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=chalk&package-manager=npm_and_yarn&previous-version=5.6.2&new-version=6.0.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [rimraf](https://github.com/isaacs/rimraf) from 5.0.10 to 6.1.3. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/isaacs/rimraf/blob/main/CHANGELOG.md">rimraf's changelog</a>.</em></p> <blockquote> <h1>6.1</h1> <ul> <li>Move to native <code>fs/promises</code> usage instead of promisifying manually.</li> </ul> <h1>6.0</h1> <ul> <li>Drop support for nodes before v20</li> <li>Add <code>--version</code> to CLI</li> </ul> <h1>5.0</h1> <ul> <li>No default export, only named exports</li> </ul> <h1>4.4</h1> <ul> <li>Provide Dirent or Stats object as second argument to filter</li> </ul> <h1>4.3</h1> <ul> <li>Return boolean indicating whether the path was fully removed</li> <li>Add filter option</li> <li>bin: add --verbose, -v to print files as they are deleted</li> <li>bin: add --no-verbose, -V to not print files as they are deleted</li> <li>bin: add -i --interactive to be prompted on each deletion</li> <li>bin: add -I --no-interactive to not be prompted on each deletion</li> <li><strong>4.3.1</strong> Fixed inappropriately following symbolic links to directories</li> </ul> <h1>v4.2</h1> <ul> <li>Brought back <code>glob</code> support, using the new and improved glob v9</li> </ul> <h1>v4.1</h1> <ul> <li>Improved hybrid module with no need to look at the <code>.default</code> dangly bit. <code>.default</code> preserved as a reference to <code>rimraf</code> for compatibility with anyone who came to rely on it in v4.0.</li> <li>Accept and ignore <code>-rf</code> and <code>-fr</code> arguments to the bin.</li> </ul> <h1>v4.0</h1> <ul> <li>Remove <code>glob</code> dependency entirely. This library now only accepts actual file and folder names to delete.</li> <li>Accept array of paths or single path.</li> <li>Windows performance and reliability improved.</li> <li>All strategies separated into explicitly exported methods.</li> <li>Drop support for Node.js below version 14</li> <li>rewrite in TypeScript</li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/isaacs/rimraf/commit/f738c781d14fa7bc06f8e39e062d78f701fde3f1"><code>f738c78</code></a> 6.1.3</li> <li><a href="https://github.com/isaacs/rimraf/commit/a164a85093f78e40d8f995b0d8ff3a1856324768"><code>a164a85</code></a> update deps</li> <li><a href="https://github.com/isaacs/rimraf/commit/4635ba7498849cade724bd34c1ec9feae4b56236"><code>4635ba7</code></a> update deps</li> <li><a href="https://github.com/isaacs/rimraf/commit/509c53f8b0298508c3a536dc121bbc0652d3e56f"><code>509c53f</code></a> limit ci workflow permissions</li> <li><a href="https://github.com/isaacs/rimraf/commit/68ce04f9bfb436e66356428e2970c78fa2a76d02"><code>68ce04f</code></a> formatting</li> <li><a href="https://github.com/isaacs/rimraf/commit/37680c5d7f0104042ab8e8fae3e77484dc7687ca"><code>37680c5</code></a> add warning to not pass untrusted input to this method ever</li> <li><a href="https://github.com/isaacs/rimraf/commit/786563d3901763fa77090271d239233aa27e7a3a"><code>786563d</code></a> remove contributing doc, already covered by .github repo</li> <li><a href="https://github.com/isaacs/rimraf/commit/dbeef7399038d0cc467dbac5f91074cd0dc847dd"><code>dbeef73</code></a> contributing</li> <li><a href="https://github.com/isaacs/rimraf/commit/84d27afdbf7a211ecce6e9e73530aeb7278ea5d2"><code>84d27af</code></a> update workflows and standard project junk</li> <li><a href="https://github.com/isaacs/rimraf/commit/cd45498f616f9265dfe1e30640d6424348f75f04"><code>cd45498</code></a> 6.1.2</li> <li>Additional commits viewable in <a href="https://github.com/isaacs/rimraf/compare/v5.0.10...v6.1.3">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=rimraf&package-manager=npm_and_yarn&previous-version=5.0.10&new-version=6.1.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [ora](https://github.com/sindresorhus/ora) from 8.2.0 to 9.4.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/sindresorhus/ora/releases">ora's releases</a>.</em></p> <blockquote> <h2>v9.4.1</h2> <ul> <li>Fix type definitions (<a href="https://redirect.github.com/sindresorhus/ora/issues/257">#257</a>) 431ebc4</li> <li>Fix <code>failText</code> type to accept <code>unknown</code> instead of <code>Error</code>, matching the actual promise rejection value bc3a283</li> </ul> <hr /> <p><a href="https://github.com/sindresorhus/ora/compare/v9.4.0...v9.4.1">https://github.com/sindresorhus/ora/compare/v9.4.0...v9.4.1</a></p> <h2>v9.4.0</h2> <ul> <li>Add <code>successSymbol</code> and <code>failSymbol</code> options to <code>oraPromise</code> 3d2e0a9</li> </ul> <hr /> <p><a href="https://github.com/sindresorhus/ora/compare/v9.3.0...v9.4.0">https://github.com/sindresorhus/ora/compare/v9.3.0...v9.4.0</a></p> <h2>v9.3.0</h2> <ul> <li>Reduce flicker in rendering 2ab4f76</li> </ul> <hr /> <p><a href="https://github.com/sindresorhus/ora/compare/v9.2.0...v9.3.0">https://github.com/sindresorhus/ora/compare/v9.2.0...v9.3.0</a></p> <h2>v9.2.0</h2> <ul> <li>Update <code>stdin-discarder</code> dependency (<a href="https://redirect.github.com/sindresorhus/ora/issues/251">#251</a>) 020eaba</li> </ul> <hr /> <p><a href="https://github.com/sindresorhus/ora/compare/v9.1.0...v9.2.0">https://github.com/sindresorhus/ora/compare/v9.1.0...v9.2.0</a></p> <h2>v9.1.0</h2> <ul> <li>Support external writes to stream (<code>console.log</code>) while spinning d2b543a</li> <li>Replace <code>strip-ansi</code> dependency with native <code>stripVTControlCharacters</code> (<a href="https://redirect.github.com/sindresorhus/ora/issues/249">#249</a>) 68d50e5</li> </ul> <hr /> <p><a href="https://github.com/sindresorhus/ora/compare/v9.0.0...v9.1.0">https://github.com/sindresorhus/ora/compare/v9.0.0...v9.1.0</a></p> <h2>v9.0.0</h2> <h3>Breaking</h3> <ul> <li>Require Node.js 20 7aca06d</li> </ul> <h3>Fixes</h3> <ul> <li>Fix clearing in some cases aa51538</li> <li>Fix <code>frame()</code> not displaying dynamic <code>prefixText</code>/<code>suffixText</code> from functions 0f19f57</li> <li>Fix multiline text exceeding console height leaving garbage when scrolling 45d30ad</li> </ul> <hr />  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/sindresorhus/ora/commit/79cd8c15ac34572cffb3ab53e3d4b6bab6d59ea8"><code>79cd8c1</code></a> 9.4.1</li> <li><a href="https://github.com/sindresorhus/ora/commit/bc3a28363a9873304ffb56420cb55fe83a7f41e8"><code>bc3a283</code></a> Minor tweaks</li> <li><a href="https://github.com/sindresorhus/ora/commit/431ebc40dceb1f700f3b60821f139541dbd7c93d"><code>431ebc4</code></a> Fix type definitions (<a href="https://redirect.github.com/sindresorhus/ora/issues/257">#257</a>)</li> <li><a href="https://github.com/sindresorhus/ora/commit/46a670390249718af7c66452afdc5d78ceb579e9"><code>46a6703</code></a> 9.4.0</li> <li><a href="https://github.com/sindresorhus/ora/commit/3d2e0a907e1141a121e5ed3348d9ea0981ca8a9c"><code>3d2e0a9</code></a> Add <code>successSymbol</code> and <code>failSymbol</code> options to <code>oraPromise</code></li> <li><a href="https://github.com/sindresorhus/ora/commit/f70f613d72f0afb0f4cb0a7fe56268f8abd1a170"><code>f70f613</code></a> Test tweaks</li> <li><a href="https://github.com/sindresorhus/ora/commit/7cf29a75e64409205a6606dada9780ccf5acf6a8"><code>7cf29a7</code></a> Validate some options better</li> <li><a href="https://github.com/sindresorhus/ora/commit/4496362714e1edd414e5347e8d4b337f103f0e15"><code>4496362</code></a> 9.3.0</li> <li><a href="https://github.com/sindresorhus/ora/commit/2ab4f7613879515e29039888115831422f49e1af"><code>2ab4f76</code></a> Reduce flicker in rendering</li> <li><a href="https://github.com/sindresorhus/ora/commit/8d17b13a8b3330af16cfa24c6e3b8a99f678c5c4"><code>8d17b13</code></a> Add FAQ item</li> <li>Additional commits viewable in <a href="https://github.com/sindresorhus/ora/compare/v8.2.0...v9.4.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=ora&package-manager=npm_and_yarn&previous-version=8.2.0&new-version=9.4.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

## Summary Mitigate the reachable glob-parsing stack-exhaustion path identified in the separate risk review for [GHSA-vfj7-8cjw-p6xm](GHSA-vfj7-8cjw-p6xm). - Check the exact resolved pattern before calling `fast-glob`: maximum length 1,024 JavaScript string code units and maximum brace/parenthesis nesting 32. - Use a bounded, non-recursive scan that respects escapes, quotes, character classes, and matching delimiters. - Reject excessive patterns with a clear `ConfigError` without logging the supplied pattern. Literal paths and ordinary glob matching retain their existing behavior. - Add 19 regression cases to the existing configuration E2E suite, covering the reproduced input, boundary limits, quoted/escaped/class closers, mixed nesting, normal matches, and literal paths. No new test files or test infrastructure. - Include the dependency overrides and lockfile updates from #31. The live audit now reports only the two reviewed advisories below, instead of the 23 findings on the original branch. - Keep audit handling inline in the existing GitHub Actions workflow. No scripts folder, custom action, or additional workflow is introduced. ## Verification - `pnpm build`: passed. - `pnpm lint`: passed. - `pnpm test`: 8 passed. - `pnpm test:e2e`: 358 passed, 1 existing skip. - `git diff --check`: passed. - Workflow linting: passed. Existing Node 22/24/26 matrix unchanged. - Live audit gate: passed with the two explicitly accepted risks, not a clean vulnerability report. - Clean-worktree audit: passed after a frozen, scripts-disabled install. This install is required because pnpm returns empty dependency paths without `node_modules`; the gate deliberately rejects incomplete paths. - 17 ephemeral gate probes passed: expiry boundaries, clean reports after expiry, additional low-severity findings, registry/malformed-report errors, unexpected statuses, muted findings, changed advisory IDs/packages/versions, unreviewed cache paths, and inconsistent metadata. No repository test files were added for these probes. ## Scope and remaining risk - Targets `next`. Security changes are also integrated into #31 without rewriting either branch's existing commits. Review this security PR first; #31 retains the separate beta-workflow changes. - Changes the CLI config loader, its existing E2E suite, dependency overrides/lockfile, and existing dependency-audit workflow. No package release versions, CI matrix, rulesets, or release workflows change here. - This addresses the reported recursive glob-input path, not every possible glob-complexity denial of service or every transitive `braces` consumer. - Omer approved two temporary CI risk exceptions on 2026-10-08. They expire at **2026-10-22 05:37:00 UTC**, with no automatic extension: - [braces / GHSA-vfj7-8cjw-p6xm](GHSA-vfj7-8cjw-p6xm), only version 3.0.3. CLI glob guards mitigate the reviewed input path; other tooling consumers remain affected. - [http-cache-semantics / GHSA-ch52-4w7c-c8xp](GHSA-ch52-4w7c-c8xp), only version 4.2.0 through the reviewed root Lerna 9.0.7 paths. Reviewed callers use private caches on fresh runners; this is not approval for shared-cache usage. - Every other advisory remains blocking, regardless of severity. Registry/schema errors fail closed. At expiry, either remaining advisory blocks again; a clean audit still passes. Warnings and the job summary make accepted risk visible. Remove these exceptions when patched; no security alert is dismissed. - The Action still bundles the published CLI. It receives this mitigation only after a separately approved Contractual publication followed by an Action dependency/bundle update. No SHA substitution or release is performed here. - These exceptions apply to CI only. The publishing audit in #31 remains strict; any publishing-gate exception needs separate approval. No approval to merge, create/move tags, publish packages, or create GitHub Releases is implied or exercised.

## Scope - Keep `release-preview.yml`, `release-packages.yml`, `publish-packages.yml`, and `tag-global.yml`; no replacement workflows or new test files. - Use matching beta versioning inputs/commands in preview and preparation, refresh the lockfile, and create scoped Conventional Commit release PRs targeting `next`. - Keep preparation, publishing, and tagging separate. Require manual dispatch, the existing `release` environment approval, and reviewed commit verification for release operations. - Publish only beta package versions to the `beta` dist-tag. Validate immutable tags and registry commit metadata; never move exact-version tags. - Update dependency overrides and the lockfile to available patched versions. No package release versions changed. - Integrate #32's CLI glob hardening, existing E2E regression cases, and approved time-limited CI audit exceptions without rewriting branch history. Review #32 first; this PR retains the separate beta-workflow changes. ## Validation - Workflow linting and `git diff --check` pass. - Combined dependency and CLI changes pass existing build, lint, unit tests (8), and E2E tests (358 passed, 1 existing skip). - Live CI audit gate and 17 ephemeral failure/expiry probes pass. No new test files or test infrastructure were added. The Node 22/24/26 matrix and Lerna configuration are unchanged. - Clean-worktree audit passes with a frozen, scripts-disabled install. The audit workflow now performs that install so pnpm can report the dependency paths required by the exception checks. ## Remaining blockers This is a draft, not approval to merge or release. The underlying audit still reports two high-severity advisories with no patched versions listed. Omer approved temporary CI-only risk exceptions on 2026-10-08, expiring at **2026-10-22 05:37:00 UTC**: - [braces: GHSA-vfj7-8cjw-p6xm](GHSA-vfj7-8cjw-p6xm), only version 3.0.3. CLI length/depth guards mitigate the reviewed glob-input path; tooling consumers remain affected. - [http-cache-semantics: GHSA-ch52-4w7c-c8xp](GHSA-ch52-4w7c-c8xp), only version 4.2.0 through the reviewed root Lerna 9.0.7 paths, whose callers use private caches on fresh runners. The existing dependency-audit workflow enforces this fixed expiry and reports warnings/job summaries. All other findings remain blocking, including low severity; registry and malformed-report errors fail closed. At expiry, either remaining advisory blocks again. Exceptions should be removed when patched, and no security alert is dismissed. **Publishing remains blocked:** `publish-packages.yml` keeps its strict `pnpm audit --audit-level low` gate. Applying these exceptions to publishing was blocked by the approval safeguard and requires separate explicit approval. The manual release/environment approvals remain intact regardless. The Action still needs a separately approved Contractual publication and dependency/bundle update to receive the CLI mitigation. No workflows have been dispatched, and no tags, packages, or releases have been published. Existing history and version tags are unchanged. Omer must explicitly approve any future tagging or publishing operation.

## Summary - Reuse the release branch already created by [Prepare Release](https://github.com/codotech/contractual/actions/runs/37761823475), without rerunning version preparation or rewriting history. - Prepare all seven public Contractual packages as `0.1.0-beta.0`, with generated package changelogs. - Target `next`; this PR does not tag or publish anything. ## Verification - Preparation completed installation, build, unit tests, and E2E tests before versioning. - The workflow failed only when creating the PR because Actions PR creation was disabled. - PR checks must now validate the prepared version commit before review and merge. ## Release gates - CI retains only the two approved temporary advisory exceptions, expiring at 2026-10-22 05:37:00 UTC. - The publishing workflow still uses its strict audit gate. No release-time exception is approved by this PR. - Omer must separately approve the exact publication commit, package versions, and any tag or release operation. - After an approved Contractual publication, update and rebuild contractual-action against the published betas through its own PR to next. Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

## Scope - Apply Omer's explicit 2026-10-08 approval for the two reviewed publishing-audit risk exceptions. This is preparation only, not approval to dispatch publication, tag, publish packages, or create releases. - Change only the audit step in the existing `publish-packages.yml`; use the same native inline audit logic and fixed expiry as CI. - No package versions, source code, dependencies, scripts, custom actions, test files, or other workflows change. ## Exact exceptions and expiry Both exceptions expire at **2026-10-22 05:37:00 UTC**, with no extension: - [GHSA-vfj7-8cjw-p6xm](GHSA-vfj7-8cjw-p6xm): only `braces@3.0.3`. The merged CLI glob size/depth guards mitigate the reviewed input path; tooling consumers remain affected. - [GHSA-ch52-4w7c-c8xp](GHSA-ch52-4w7c-c8xp): only `http-cache-semantics@4.2.0` through the reviewed root `lerna@9.0.7` dependency paths. Reviewed callers use private caches on fresh runners; this does not authorize shared-cache usage. Every other advisory remains blocking regardless of severity. Registry errors, unexpected statuses, invalid reports, muted findings, missing dependency paths, and inconsistent counts fail closed. At expiry, either remaining advisory blocks again; a clean report still passes. Accepted risks remain visible in warnings and the job summary. Remove the exceptions when patches are available; no security alert is dismissed. ## Preserved release safeguards - Manual dispatch on `next`, the `release` environment approval, and exact approved-commit verification remain unchanged. - Beta-only package metadata, immutable-tag checks, registry ownership/commit checks, and the `beta` dist-tag remain unchanged. - A structural comparison confirmed that replacing the new audit step with the original single-line audit reproduces the previous workflow exactly. - Contractual only: this does not change contractual-action's release audit. ## Validation - Frozen install, build, lint: passed. - Existing unit tests: 8 passed. - Existing E2E suite: 358 passed, 1 existing skip. - Actionlint and whitespace checks: passed. - Audit logic/expiry parity with CI and unchanged release safeguards: passed. - Only the read-only audit step was executed locally against the live registry; 19 ephemeral expiry/failure probes passed. No new test files were added. The separately approved Codecov allowlist correction is applied directly in repository settings, adding only its exact `actions/github-script` dependency. [Coverage rerun](https://github.com/codotech/contractual/actions/runs/37787811167) is green. **Nothing has been merged, tagged, or published by this work. No release workflow has been dispatched.**

feat: contractual pivot - schema lifecycle orchestrator (#14)

e011f15

omermorad self-assigned this Mar 12, 2026

omermorad added the next label Mar 12, 2026

omermorad added 4 commits March 15, 2026 00:23

feat: commands major refactor (#16)

91ed06b

fix: remove provenance from packages before publishing to Verdaccio

541f2c6

fix(e2e): use scoped package name for npx commands

2d44ffb

Change `npx contractual` to `npx @contractual/cli` to ensure the correct package is used from the Verdaccio registry instead of an unrelated `contractual` package from npm.

fix(cli): update diff JSON output format to use contracts object

8c6e6cd

Changed JSON output from { results: [...] } to { contracts: { name: {...} } } to match expected format in e2e tests and provide better ergonomics for scripting (e.g., parsed.contracts.order.changes).

omermorad force-pushed the next branch from b864350 to 8c6e6cd Compare March 27, 2026 16:34

omermorad and others added 2 commits March 27, 2026 16:38

chore(*): version packages [skip ci]

a18dcec

- @contractual/changesets@0.1.0-dev.0 - @contractual/cli@0.1.0-dev.0 - @contractual/differs.json-schema@0.1.0-dev.0 - @contractual/governance@0.1.0-dev.0 - @contractual/types@0.1.0-dev.0

fix(governance): use correct openapi-diff version

4963cb0

- Change openapi-diff from ^0.24.1 to ^0.23.7 - Version 0.24.x doesn't exist on npm, latest is 0.23.7 - Fixes npm install errors when using published packages

omermorad force-pushed the next branch from 9effabd to 4963cb0 Compare April 2, 2026 16:56

omermorad and others added 18 commits April 2, 2026 20:00

chore(*): version packages [skip ci]

cb3d62c

- @contractual/cli@0.1.0-dev.1 - @contractual/governance@0.1.0-dev.1

chore(*): version packages [skip ci]

99ad70f

- @contractual/cli@0.1.0-dev.3 - @contractual/differs.openapi@0.1.0-dev.2 - @contractual/governance@0.1.0-dev.3

chore(*): align all packages to 0.1.0-dev.3 [skip ci]

6a8c464

fix(differs.core): add message formatters for composition change types

9a0bfe3

anyOf/oneOf/allOf and conditional schema changes were falling through to the default case, producing "Unknown change" messages in PR comments.

chore(*): version packages [skip ci]

de318c0

- @contractual/cli@0.1.0-next.0 - @contractual/differs.core@0.1.0-next.0 - @contractual/differs.json-schema@0.1.0-next.0 - @contractual/differs.openapi@0.1.0-next.0 - @contractual/governance@0.1.0-next.0

Revert "chore(*): version packages [skip ci]"

6299962

This reverts commit de318c0.

chore(*): version packages [skip ci]

8e6b939

- @contractual/cli@0.1.0-dev.6 - @contractual/differs.core@0.1.0-dev.6 - @contractual/differs.json-schema@0.1.0-dev.6 - @contractual/differs.openapi@0.1.0-dev.6 - @contractual/governance@0.1.0-dev.6

fix(differs.core): decode JSON Pointer segments individually to avoid…

2d599e0

… double slashes OpenAPI path keys like /v1/extract were producing //v1/extract in changeset output. Decode per-segment and bracket keys containing slashes.

chore(*): version packages [skip ci]

03684be

- @contractual/cli@0.1.0-dev.7 - @contractual/differs.core@0.1.0-dev.7 - @contractual/differs.json-schema@0.1.0-dev.7 - @contractual/differs.openapi@0.1.0-dev.7 - @contractual/governance@0.1.0-dev.7

omermorad force-pushed the next branch from d2b6a8a to db5231b Compare June 18, 2026 12:31

chore(*): version packages [skip ci]

53d3a39

- @contractual/changesets@0.1.0-dev.6 - @contractual/cli@0.1.0-dev.8

github-advanced-security Bot found potential problems Sep 29, 2026

View reviewed changes

Comment thread .github/workflows/release-preview.yml Fixed

Comment thread .github/workflows/release-preview.yml Fixed

github-advanced-security Bot found potential problems Sep 29, 2026

View reviewed changes

Comment thread packages/governance/linters/json-schema-ajv.ts Fixed

omermorad mentioned this pull request Sep 29, 2026

fix(*): address security findings on next #19

Merged

omermorad and others added 10 commits September 29, 2026 09:12

fix(*): address security findings on next (#19)

2466cd3

fix(*): prepare next workflow and release safeguards (#17)

361ad40

fix(*): remediate dependency and code scanning vulnerabilities (#18)

ee6d9a3

omermorad had a problem deploying to release October 8, 2026 10:11 — with GitHub Actions Failure

omermorad and others added 2 commits October 8, 2026 16:52

Navigation Menu

Repository navigation

contractual next version - #15

contractual next version#15
omermorad wants to merge 38 commits into
masterfrom
next

omermorad commented Mar 12, 2026

Uh oh!

qballer commented Jun 18, 2026

Uh oh!

github-advanced-security AI commented Sep 29, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

This branch had an error being deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

omermorad commented Mar 12, 2026

Uh oh!

qballer commented Jun 18, 2026

Uh oh!

github-advanced-security AI commented Sep 29, 2026

What Enabling Code Scanning Means:

Uh oh!

Uh oh!

Uh oh!

Uh oh!

This branch had an error being deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants