chore: bump ata-validator from 0.5.1 to 1.7.1

[dependabot]

Bumps ata-validator from 0.5.1 to 1.7.1.

Release notes

Sourced from ata-validator's releases.

1.7.1: errors are paid for when read

A performance release, prompted by a benchmark from Jason Desrosiers that ran the official suite through prebuilt validators and read only .valid. On that shape ata went from 778 ns to about 150 ns per call: errors are now materialized on first read instead of on every rejection, the interpreted engine compiles schemas into a tree of plain closures (no new Function, so it holds under a CSP), and the verdict path carries no error machinery at all. Error output is unchanged, held byte-for-byte by differential tests over 2,864 suite cases.

Added

• A closure-tree compiler for the interpreted engine. A schema the code generator declines is compiled into a tree of plain closures, one per schema node, with every keyword branch decided at compile time and $ref targets resolved once; no source generation and no new Function, so it works under a CSP and on Workers. Scope: schemas without unevaluatedProperties/unevaluatedItems, and $dynamicRef only in single-resource schemas; everything else keeps the generic evaluator. tests/test_plan_compiler.js holds the compiled tree to byte-identical verdicts and errors against the evaluator over 2,864 suite cases.

Changed

• Plans that check only value-level keywords (most leaves of any schema) skip the evaluator's prologue entirely; $ref resolutions are cached with their planned target on the plan itself; the dynamic scope is pushed and popped in place instead of copied per resource. Rejection results are a small class with the errors accessor on the prototype, since defining a getter inside an object literal builds a closure and an accessor property on every rejection, which was the single largest cost on the rejection path.
• The interpreted engine gained a verdict-only mode: isValidObject() and the internal fast checks walk the schema without constructing a single error object, message string or scratch array. On an interpreter-routed schema the boolean check dropped from 894 ns to 70 ns.
• Object validation for $dynamicRef schemas no longer routes to the native engine. The interpreted engine has scored the same on every $dynamicRef case of the suite since the dynamic-scope fix in 1.7.0, needs no addon, and carries the verdict-only mode; the suite's $dynamicRef rejects dropped from about 1.7 µs to the interpreter's cost.
• String length bounds decide from the UTF-16 length where possible: a string's code point count always sits between half its length and its length, so minLength/maxLength only count code points inside the narrow band where the answer is genuinely uncertain. The surrogate test is a single wraparound compare. The code generator already worked this way; the interpreter and the closure path now match it.
• Errors are paid for when read, not when produced. validate() answers the verdict from the fastest engine for the schema and materializes errors through a cached getter on first access; declaration-order sorting and enrichment (received value, suggestions, source frames) moved with it into one presentation layer. A caller that only reads .valid, which is every gateway check, no longer pays for error construction at all. The output of .errors is byte-for-byte what it was. Measured on a suite-shaped benchmark of prebuilt validators over 1,052 mixed valid and invalid cases, validate().valid went from 778 ns to about 150 ns per call, ahead of every error-capable validator we measured, and a rejection that never has its errors read now costs less than abortEarly mode used to. One observable edge: mutating the data between validate() and the first read of .errors now reflects the mutated data in the errors, and if the mutation makes the data valid the errors fall back to a single generic entry.

1.7.0: every path gives the same verdict

ata has four code generation entry points, a closure compiler, an interpreter, a native walker and a set of buffer APIs. This release adds tests that run the official suite through each of them and fail on any split verdict. They found 157 disagreements between the code generators and 245 between the buffer APIs and validate(), 195 of those in the accepting direction. All are fixed or routed, the tests run in npm test, and the counts are held at zero.

Draft-07 is now read by its own rules, meta-schema references resolve from vendored copies, and the official suite stands at 1298 of 1299, 927 of 927 and 1133 of 1133, the same figures with code generation blocked. The interpreted engine is 4 to 14 times faster, and the linear-time pattern matcher runs a lazy DFA that sits within 1.2 to 3.5 times of V8's RegExp on typical patterns.

Fixed

• The four code generation entry points disagreed with each other on 157 instances of the official suite. Most of it was the closure compiler, the boolean fallback behind isValidObject() when the code generator declines a schema: it ignored unevaluatedProperties and unevaluatedItems outright, treated a self-referencing $ref: "#" as always true, skipped additionalProperties whenever no properties map sat next to it, and passed strings in date-time, time, uri and duration format without checking them. Each of those accepted input it should have rejected. It now declines those schemas, so they reach an engine that handles them. The remaining disagreements were wrong rejections shared by both boolean paths: required, minProperties and maxProperties applied to non-objects, multipleOf had no tolerance for fractional divisors, const and enum compared objects by key order, and items started at index 0 when prefixItems was present. isValidObject() and validate() now agree on every suite instance.
• A dependentSchemas branch carrying additionalProperties: false had that check hoisted out of its condition to the top level of the compiled function, so the restriction applied whether or not the triggering property was present.
• The error path counted a property matched by patternProperties as additional under additionalProperties: false. The same path now reports the real pointer (#/patternProperties/<pattern>/...) for a failing pattern subschema instead of the synthetic #/patternProperties, so source frames resolve for those errors.
• The buffer APIs (isValid, isValidJSON above the simdjson threshold, countValid, batchIsValid, isValidNDJSON, isValidParallel, isValidPrepadded) disagreed with validate() on 245 of 2222 suite cases, and in 195 of those they accepted a document validate() rejects. The native walker behind them does not handle contains, unevaluated*, dependencies, dependentSchemas, dependentRequired, propertyNames, patternProperties, tuple-form items and prefixItems, cross-document $ref, embedded $id, an empty enum, a boolean root schema, Unicode property escapes in pattern, or the hostname, date-time, time, uri-reference and duration formats. For a schema using any of those, every buffer API now parses the bytes and answers through validate(); lib/buffer-gate.js holds the list. Schemas without them keep the zero-copy path. tests/test_buffer_path_parity.js now compares all three dialects, 3359 cases, and holds the disagreement count at zero.
• A value failing a patternProperties subschema was reported at runtime as a generic "value invalid for key" error on the parent object with the synthetic pointer #/patternProperties. The subschema is now generated in place, so the error comes from its own keyword, at the key's path (/x-flag), with the real pointer (#/patternProperties/^x-/type), and source frames resolve for it. Patterns containing / or ' produce a correctly escaped pointer.
• tests/test_codegen_entrypoint_agreement.js drives the whole suite through each entry point directly and fails on any split verdict. It runs as part of npm test.

Added

• A $ref to a dialect's meta-schema (https://json-schema.org/draft/2020-12/schema, http://json-schema.org/draft-07/schema#, any http/https or trailing-# spelling) resolves from copies vendored in lib/metaschemas.js, so "validate this schema against its dialect" works with no registry and no network. A copy supplied through schemas or addSchema() still wins. The 2020-12 meta-schema is eight documents joined by $dynamicRef; see the routing change below.

• validator.engine() reports which engine answers validate() for the schema: 'codegen', 'closure', 'native' or 'interpreter'. A diagnostic for startup logs and benchmarks. Measured over fourteen request-shaped schemas (body, params, query, shared $ref, oneOf, if/then, local $defs), thirteen take the generated path; patternProperties with additionalProperties: false is the one that goes to the interpreter.

• formatMode: 'inject' for toStandaloneModule, bundleStandalone, bundleCompact and build(). The output carries no custom format source; it exports setFormats(map) and looks each format up from that registry at validation time, with a named error if one is missing. This is for formats that cannot be serialized: functions that close over variables, bound functions, or code rewritten by coverage and transpile steps. The default 'embed' is unchanged in behavior, but it now checks each function's source at build time and throws with the format's name when it would not survive embedding, instead of emitting a module that fails on first use.

Changed

• Draft-07 is now read by its own rules rather than as 2020-12 with renamed keywords. A schema object carrying $ref is that reference and nothing else, so sibling keywords, $id included, are ignored, as the draft specifies. A fragment-only $id ("$id": "#name") is a plain-name anchor. A document supplied through schemas or addSchema() that declares no $schema of its own is read under the root's draft. JSON Pointers written against array-form items still resolve after the keyword is normalized to prefixItems. Schemas that declare no $schema are unaffected. Draft 7 on the official suite goes from 916 to 927 of 927.
• The code generator now declines, and the interpreted engine answers, whenever a document reachable through a cross-document $ref uses $dynamicRef, $dynamicAnchor, unevaluatedProperties, unevaluatedItems, or an embedded $id. Before, the generator emitted a vacuous check for such a reference and accepted everything behind it: { "$ref": "https://json-schema.org/draft/2020-12/schema" } accepted { "type": 1 }. These checks now live in one function, sharedCodegenGate, that every entry point runs first. Draft 2020-12 goes from 1294 to 1298 of 1299 and the v1 dialect from 1131 to 1133 of 1133; the one remaining 2020-12 miss needs $vocabulary.
• The interpreted engine extends the dynamic scope whenever evaluation enters a schema resource, not only when it lands on the resource's root. A $dynamicRef reached through first#/$defs/stuff now sees resource first in scope, which closes the last $dynamicRef case the interpreter missed. With code generation blocked the figures are the same as with it: 1298 of 1299, 927 of 927, 1133 of 1133.
• The interpreted engine is between 4 and 14 times faster depending on the schema. Each schema node is resolved once into a fixed-shape plan (type bitmask, compiled pattern, looked-up format, one flag per keyword group) and children are linked at plan time, so the walk reads no schema properties and does no map lookups. On a six-field object schema a warm validate() went from 3786 ns to 343 ns; a $ref-heavy schema from 5354 ns to 366 ns; a recursive $dynamicRef tree from 5302 ns to 526 ns. The compiled path is unchanged at about 44 ns on the same schema.
• The linear-time pattern matcher now runs a lazily built DFA over the Thompson NFA, with cached ASCII transitions and a fallback to the NFA walk past 256 states. On typical anchored patterns it is within 1.2 to 3.5 times of V8's backtracking engine (^[0-9]{5}$ 14 ns against 12 ns, an email pattern 70 ns against 21 ns) while keeping the linear bound: ^(a+)+$ against 100,000 characters takes 1 ms. This matcher backs pattern, patternProperties and propertyNames in every engine and in standalone output, so all of them gain.

v1.6.2

Fixed

• The Standard Schema surface carried no output type. ~standard.validate() returned { value: unknown } and the types carrier the specification defines for inference was missing, so every consumer that reads the validated type off ~standard (Fastify, tRPC, TanStack Form, Drizzle) saw unknown and needed a cast. ~standard is now typed against the validator's own data type, and types.output carries it. Type-only: the runtime object is unchanged, and the specification defines types as never present at runtime.
• Boolean schemas were rejected by the Validator constructor's TypeScript signature. true and false are schemas anywhere JSON Schema allows one, and both have always worked at runtime; only the types disagreed, which made a schema of unknown shape (object | boolean) impossible to pass without a cast. Nested boolean subschemas are still typed as objects, so { properties: { a: true } } needs defineSchema or a cast.

... (truncated)

Changelog

Sourced from ata-validator's changelog.

1.7.1 - 2026-08-23

Added

• A closure-tree compiler for the interpreted engine. A schema the code generator declines is compiled into a tree of plain closures, one per schema node, with every keyword branch decided at compile time and $ref targets resolved once; no source generation and no new Function, so it works under a CSP and on Workers. Scope: schemas without unevaluatedProperties/unevaluatedItems, and $dynamicRef only in single-resource schemas; everything else keeps the generic evaluator. tests/test_plan_compiler.js holds the compiled tree to byte-identical verdicts and errors against the evaluator over 2,864 suite cases.

Changed

• Plans that check only value-level keywords (most leaves of any schema) skip the evaluator's prologue entirely; $ref resolutions are cached with their planned target on the plan itself; the dynamic scope is pushed and popped in place instead of copied per resource. Rejection results are a small class with the errors accessor on the prototype, since defining a getter inside an object literal builds a closure and an accessor property on every rejection, which was the single largest cost on the rejection path.
• The interpreted engine gained a verdict-only mode: isValidObject() and the internal fast checks walk the schema without constructing a single error object, message string or scratch array. On an interpreter-routed schema the boolean check dropped from 894 ns to 70 ns.
• Object validation for $dynamicRef schemas no longer routes to the native engine. The interpreted engine has scored the same on every $dynamicRef case of the suite since the dynamic-scope fix in 1.7.0, needs no addon, and carries the verdict-only mode; the suite's $dynamicRef rejects dropped from about 1.7 µs to the interpreter's cost.
• String length bounds decide from the UTF-16 length where possible: a string's code point count always sits between half its length and its length, so minLength/maxLength only count code points inside the narrow band where the answer is genuinely uncertain. The surrogate test is a single wraparound compare. The code generator already worked this way; the interpreter and the closure path now match it.
• Errors are paid for when read, not when produced. validate() answers the verdict from the fastest engine for the schema and materializes errors through a cached getter on first access; declaration-order sorting and enrichment (received value, suggestions, source frames) moved with it into one presentation layer. A caller that only reads .valid, which is every gateway check, no longer pays for error construction at all. The output of .errors is byte-for-byte what it was. Measured on a suite-shaped benchmark of prebuilt validators over 1,052 mixed valid and invalid cases, validate().valid went from 778 ns to about 150 ns per call, ahead of every error-capable validator we measured, and a rejection that never has its errors read now costs less than abortEarly mode used to. One observable edge: mutating the data between validate() and the first read of .errors now reflects the mutated data in the errors, and if the mutation makes the data valid the errors fall back to a single generic entry.

1.7.0 - 2026-08-23

Fixed

• The four code generation entry points disagreed with each other on 157 instances of the official suite. Most of it was the closure compiler, the boolean fallback behind isValidObject() when the code generator declines a schema: it ignored unevaluatedProperties and unevaluatedItems outright, treated a self-referencing $ref: "#" as always true, skipped additionalProperties whenever no properties map sat next to it, and passed strings in date-time, time, uri and duration format without checking them. Each of those accepted input it should have rejected. It now declines those schemas, so they reach an engine that handles them. The remaining disagreements were wrong rejections shared by both boolean paths: required, minProperties and maxProperties applied to non-objects, multipleOf had no tolerance for fractional divisors, const and enum compared objects by key order, and items started at index 0 when prefixItems was present. isValidObject() and validate() now agree on every suite instance.
• A dependentSchemas branch carrying additionalProperties: false had that check hoisted out of its condition to the top level of the compiled function, so the restriction applied whether or not the triggering property was present.
• The error path counted a property matched by patternProperties as additional under additionalProperties: false. The same path now reports the real pointer (#/patternProperties/<pattern>/...) for a failing pattern subschema instead of the synthetic #/patternProperties, so source frames resolve for those errors.
• The buffer APIs (isValid, isValidJSON above the simdjson threshold, countValid, batchIsValid, isValidNDJSON, isValidParallel, isValidPrepadded) disagreed with validate() on 245 of 2222 suite cases, and in 195 of those they accepted a document validate() rejects. The native walker behind them does not handle contains, unevaluated*, dependencies, dependentSchemas, dependentRequired, propertyNames, patternProperties, tuple-form items and prefixItems, cross-document $ref, embedded $id, an empty enum, a boolean root schema, Unicode property escapes in pattern, or the hostname, date-time, time, uri-reference and duration formats. For a schema using any of those, every buffer API now parses the bytes and answers through validate(); lib/buffer-gate.js holds the list. Schemas without them keep the zero-copy path. tests/test_buffer_path_parity.js now compares all three dialects, 3359 cases, and holds the disagreement count at zero.
• A value failing a patternProperties subschema was reported at runtime as a generic "value invalid for key" error on the parent object with the synthetic pointer #/patternProperties. The subschema is now generated in place, so the error comes from its own keyword, at the key's path (/x-flag), with the real pointer (#/patternProperties/^x-/type), and source frames resolve for it. Patterns containing / or ' produce a correctly escaped pointer.
• tests/test_codegen_entrypoint_agreement.js drives the whole suite through each entry point directly and fails on any split verdict. It runs as part of npm test.

Added

• A $ref to a dialect's meta-schema (https://json-schema.org/draft/2020-12/schema, http://json-schema.org/draft-07/schema#, any http/https or trailing-# spelling) resolves from copies vendored in lib/metaschemas.js, so "validate this schema against its dialect" works with no registry and no network. A copy supplied through schemas or addSchema() still wins. The 2020-12 meta-schema is eight documents joined by $dynamicRef; see the routing change below.

• validator.engine() reports which engine answers validate() for the schema: 'codegen', 'closure', 'native' or 'interpreter'. A diagnostic for startup logs and benchmarks. Measured over fourteen request-shaped schemas (body, params, query, shared $ref, oneOf, if/then, local $defs), thirteen take the generated path; patternProperties with additionalProperties: false is the one that goes to the interpreter.

• formatMode: 'inject' for toStandaloneModule, bundleStandalone, bundleCompact and build(). The output carries no custom format source; it exports setFormats(map) and looks each format up from that registry at validation time, with a named error if one is missing. This is for formats that cannot be serialized: functions that close over variables, bound functions, or code rewritten by coverage and transpile steps. The default 'embed' is unchanged in behavior, but it now checks each function's source at build time and throws with the format's name when it would not survive embedding, instead of emitting a module that fails on first use.

Changed

• Draft-07 is now read by its own rules rather than as 2020-12 with renamed keywords. A schema object carrying $ref is that reference and nothing else, so sibling keywords, $id included, are ignored, as the draft specifies. A fragment-only $id ("$id": "#name") is a plain-name anchor. A document supplied through schemas or addSchema() that declares no $schema of its own is read under the root's draft. JSON Pointers written against array-form items still resolve after the keyword is normalized to prefixItems. Schemas that declare no $schema are unaffected. Draft 7 on the official suite goes from 916 to 927 of 927.
• The code generator now declines, and the interpreted engine answers, whenever a document reachable through a cross-document $ref uses $dynamicRef, $dynamicAnchor, unevaluatedProperties, unevaluatedItems, or an embedded $id. Before, the generator emitted a vacuous check for such a reference and accepted everything behind it: { "$ref": "https://json-schema.org/draft/2020-12/schema" } accepted { "type": 1 }. These checks now live in one function, sharedCodegenGate, that every entry point runs first. Draft 2020-12 goes from 1294 to 1298 of 1299 and the v1 dialect from 1131 to 1133 of 1133; the one remaining 2020-12 miss needs $vocabulary.
• The interpreted engine extends the dynamic scope whenever evaluation enters a schema resource, not only when it lands on the resource's root. A $dynamicRef reached through first#/$defs/stuff now sees resource first in scope, which closes the last $dynamicRef case the interpreter missed. With code generation blocked the figures are the same as with it: 1298 of 1299, 927 of 927, 1133 of 1133.
• The interpreted engine is between 4 and 14 times faster depending on the schema. Each schema node is resolved once into a fixed-shape plan (type bitmask, compiled pattern, looked-up format, one flag per keyword group) and children are linked at plan time, so the walk reads no schema properties and does no map lookups. On a six-field object schema a warm validate() went from 3786 ns to 343 ns; a $ref-heavy schema from 5354 ns to 366 ns; a recursive $dynamicRef tree from 5302 ns to 526 ns. The compiled path is unchanged at about 44 ns on the same schema.
• The linear-time pattern matcher now runs a lazily built DFA over the Thompson NFA, with cached ASCII transitions and a fallback to the NFA walk past 256 states. On typical anchored patterns it is within 1.2 to 3.5 times of V8's backtracking engine (^[0-9]{5}$ 14 ns against 12 ns, an email pattern 70 ns against 21 ns) while keeping the linear bound: ^(a+)+$ against 100,000 characters takes 1 ms. This matcher backs pattern, patternProperties and propertyNames in every engine and in standalone output, so all of them gain.

1.6.2 - 2026-08-19

Fixed

• The Standard Schema surface carried no output type. ~standard.validate() returned { value: unknown } and the types carrier the specification defines for inference was missing, so every consumer that reads the validated type off ~standard (Fastify, tRPC, TanStack Form, Drizzle) saw unknown and needed a cast. ~standard is now typed against the validator's own data type, and types.output carries it. Type-only: the runtime object is unchanged, and the specification defines types as never present at runtime.
• Boolean schemas were rejected by the Validator constructor's TypeScript signature. true and false are schemas anywhere JSON Schema allows one, and both have always worked at runtime; only the types disagreed, which made a schema of unknown shape (object | boolean) impossible to pass without a cast. Nested boolean subschemas are still typed as objects, so { properties: { a: true } } needs defineSchema or a cast.
• The t builder's option bags rejected vendor keywords. t.object({}, { instanceof: 'Date' }) is what a custom keyword package expects to be given, and the option types only allowed the keywords the builder itself emits, so callers wrote as never. Every option bag now accepts unknown keywords alongside the typed ones.
• tests/test_interop_types.ts covers all three under tsc --noEmit.

1.6.1 - 2026-08-09

... (truncated)

Commits

• b5a828c perf: verdict-only compiled variant with no path strings on the hot walk
• 77f27cb docs: state the measured benchmark figure precisely
• e7cb17f perf: compile interpreter plans into a closure tree
• 8a61f2f docs: extend the 1.7.1 changelog with the evaluator work
• 91bc284 perf: leaf fast path, cached ref resolution, in-place dynamic scope, prototyp...
• f876d03 perf: decide string length bounds from the UTF-16 length where possible
• cbf5240 perf: verdict-only interpreter mode, dynamicRef on the interpreted engine, al...
• 2e86a87 perf: materialize errors on first read instead of on every rejection
• d81ca2c docs: mention engine() and the standalone format modes in the readme
• 2609e31 feat: report which engine answers a schema
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for ata-validator since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #3.