chore: bump ata-validator from 0.5.1 to 1.12.1

[dependabot]

Bumps ata-validator from 0.5.1 to 1.12.1.

Release notes

Sourced from ata-validator's releases.

1.12.1

Fixed

• One format violation reports one error. The error path turns each failing statement of a format check into an error push, and it kept going after pushing, so a single bad value collected one identical error per statement it failed: twelve for date-time on a short string, five for time, two for uuid and hostname. The check now leaves the format block on the first failure. Verdicts are unchanged; only the duplicate copies of the same error are gone. tests/test_format_single_error.js holds every built-in format to exactly one error across 25 invalid values.

1.12.0

Performance

• date-time stopped asking every character where it sits. The scan tested each of nineteen positions against the separator indices before checking the digit; the separators are now read directly by index and each digit becomes its value in the same read that validates it, so the field numbers cost nothing extra. 40.8 to 19.5 ns on a valid value, medians across separate processes. Same answers as before on every month, day and clock boundary and under 150k random mutations.

• uuid reads the four hyphens by index and the 32 hex digits in five runs with fixed bounds, instead of a case-insensitive regular expression. A digit is one unsigned compare and a letter one more after folding case with a single OR. 48.4 to 35.1 ns; 300k mutated and random strings against the old expression with 0 mismatches.

• time reads fixed positions the same way instead of running a regular expression: 15.6 to 12.1 ns, and 200k mutations against the old pattern with 0 mismatches.

• uri reads the scheme from the front and scans the rest once instead of running two regular expressions: 39.3 to 32.8 ns, interleaved medians. The remaining scan then became two tiers, because the measured answer was not the expected one: a hand-written character loop beat the old \s expression in isolation but lost to the engine's scanner inside a compiled validator, since \s is what forced the Unicode machinery in. The first tier asks whether anything sits outside printable ASCII, a one-byte class the engine scans at its own speed and no ordinary URI ever trips; only a string that trips it pays for the loop that knows the exact reserved set. On a nested schema carrying six URLs, 215.5 to 189.4 ns per document, medians across separate processes. uri-reference shares the same scan. Fuzzed over every code point in the BMP in three positions, 0 mismatches.

• The Standard Schema bridge stopped paying for enrichment it throws away. An issue carries a message and a path and nothing else, but ~standard.validate read the rich error list, which builds suggestions, ranks and source frames per error. It now takes the raw, schema-ordered list through the same build the rich path uses, and parsePointerPath walks the pointer in one pass instead of split, filter, map and a regex per segment. A 16-error rejection went from 17.6 to 4.3 microseconds; messages and order are unchanged, and tests/test_standard_schema.js holds issues to exact parity with validate().errors. Schemas using errorMessage keep their custom messages.

Fixed

• The compiled engine refused a lowercase zone letter in time that the interpreter accepted: 00:00:00z answered differently depending on which engine ran the schema, and date-time took either case in both. One implementation now answers for every engine, and it takes both cases, per RFC 3339.

• The ReDoS integration test measured the first call, which includes compiling the schema and the pattern, against a 50 ms budget. On a loaded CI machine that reads as a failure without anything being wrong: the gate exists to separate linear matching from catastrophic backtracking, which differ by minutes, not by milliseconds. It now warms up first and allows 500 ms.

1.11.0

Fixed

• The verdict methods answer the same question as validate() again. With coerceTypes, removeAdditional or a schema default in play, validate() ran the preprocess pass and isValidObject(), isValidJSON() and validateJSON() did not, so the same validator answered true from one and false from another for the same document: validate({ age: '26' }) accepted where isValidObject({ age: '26' }) rejected. Every path now runs the same pass. Verdict methods on a validator configured this way rewrite the input in place, as validate() already did, and the cost of the correction is 0.5 ns on isValidObject and 2.7 ns on isValidJSON, measured interleaved; validators without those options are unchanged. tests/test_verdict_preprocess.js holds all four methods to the same answers.

• The native engine's error codes no longer reach callers untranslated. A type failure answered by the addon came back as code: 3 with no keyword and a docUrl pointing at a page that does not exist, while the same failure from the JavaScript engines came back as ATA1001; both now report the documented code, keyword and link. tests/test_native_error_codes.js holds the table against the enum in include/ata.h, so the two cannot drift apart silently.

• The error generator declined self-referencing schemas by emitting nothing for the reference, which accepted whatever that reference guarded: { properties: { foo: { $ref: "#" } }, additionalProperties: false } accepted { foo: { bar: false } } on that path. It now declines the schema outright and the validator falls back to an engine that answers it correctly. The entry-point agreement test covers the shape.

• ipv6 gave two different answers depending on which engine ran it, and neither was right. The compiled path refused an IPv4-mapped address such as ::ffff:192.168.1.1, the interpreted path accepted ::ffff:1.2.3.4.5, and both accepted a group of five hex digits like 12345::1. One implementation now answers for every engine, following RFC 4291, checked against Node's own net.isIPv6 and the suite's corpus.

• date-time refuses dates that do not exist. The check ran a regular expression for the shape and then handed the string to Date.parse, which rolls an out-of-range day into the next month, so 2026-02-30T00:00:00Z, 2026-02-29T00:00:00Z and 2026-12-31T24:00:00Z were all accepted. The month, the day count for that month in that year, the clock and the offset are now checked directly, per RFC 3339. Schemas that relied on the old leniency will see those values rejected.

• Data that points back at itself no longer exhausts the stack. A document with a cycle, which JSON text cannot express but an in-memory object graph can, threw RangeError: Maximum call stack size exceeded on the compiled path while the interpreted engine settled on an answer, so the two engines disagreed. Both now follow the same rule: a value already being checked against a schema is a fixed point and counts as satisfied, and a cycle no longer hides a real violation elsewhere in the document. Validation runs a fast pass that only counts depth and a guarded pass that runs when that depth is exceeded, so ordinary documents pay one integer operation per recursive call. Measured interleaved on a self-referencing schema: a four-node document 22.2 to 30.6 ns, a 200-node document 2077 to 1178 ns, non-recursive schemas unchanged at 3.8 ns. tests/test_cyclic_input.js holds all three engines to the same answers.

Performance

• ipv6 and hostname read the string once as well: 54.7 to 29.6 ns and 45.5 to 28.2 ns, interleaved medians. ipv6 no longer allocates two arrays per check; hostname keeps the answers of the expression it replaces, fuzzed over 300k strings with 0 mismatches.

• date-time reads the string once, with no regular expression, no date object and no allocation: 95.0 to 39.4 ns on a valid value with a Z, 103.8 to 45.3 ns with a numeric offset, interleaved medians. Fuzzed against a reference that spells out RFC 3339, with 0 mismatches over 300k strings; tests/test_formats_single_pass.js keeps both the predicate and the generated form on it.

• A constructed Validator is roughly three times smaller on the heap until it is used. The public methods and the Standard Schema entry moved from per-instance closures built in the constructor to memoized prototype accessors, and the JSON position cache is only allocated when the JSON text path first needs it. Measured per instance on a 10-key object schema, double-gc deltas over 2000 instances: 1.61 KB to 0.43 KB with a shared schema object, 2.33 KB to 1.12 KB when each instance owns its schema, 3.93 KB to 3.30 KB once compiled and used. Construction alone went from 1504 to 855 ns; construction plus first validate pays about 0.9 microseconds more, once, because the compile step's method assignments now go through a defining setter. The hot validate() path is unchanged, measured interleaved. Detached method references (const f = v.validate) still work; tests/test_lazy_instance.js pins the shape.

1.10.0

... (truncated)

Changelog

Sourced from ata-validator's changelog.

1.12.1 - 2026-09-06

Fixed

• One format violation reports one error. The error path turns each failing statement of a format check into an error push, and it kept going after pushing, so a single bad value collected one identical error per statement it failed: twelve for date-time on a short string, five for time, two for uuid and hostname. The check now leaves the format block on the first failure. Verdicts are unchanged; only the duplicate copies of the same error are gone. tests/test_format_single_error.js holds every built-in format to exactly one error across 25 invalid values.

1.12.0 - 2026-09-06

Performance

• date-time stopped asking every character where it sits. The scan tested each of nineteen positions against the separator indices before checking the digit; the separators are now read directly by index and each digit becomes its value in the same read that validates it, so the field numbers cost nothing extra. 40.8 to 19.5 ns on a valid value, medians across separate processes. Same answers as before on every month, day and clock boundary and under 150k random mutations.

• uuid reads the four hyphens by index and the 32 hex digits in five runs with fixed bounds, instead of a case-insensitive regular expression. A digit is one unsigned compare and a letter one more after folding case with a single OR. 48.4 to 35.1 ns; 300k mutated and random strings against the old expression with 0 mismatches.

• time reads fixed positions the same way instead of running a regular expression: 15.6 to 12.1 ns, and 200k mutations against the old pattern with 0 mismatches.

• uri reads the scheme from the front and scans the rest once instead of running two regular expressions: 39.3 to 32.8 ns, interleaved medians. The remaining scan then became two tiers, because the measured answer was not the expected one: a hand-written character loop beat the old \s expression in isolation but lost to the engine's scanner inside a compiled validator, since \s is what forced the Unicode machinery in. The first tier asks whether anything sits outside printable ASCII, a one-byte class the engine scans at its own speed and no ordinary URI ever trips; only a string that trips it pays for the loop that knows the exact reserved set. On a nested schema carrying six URLs, 215.5 to 189.4 ns per document, medians across separate processes. uri-reference shares the same scan. Fuzzed over every code point in the BMP in three positions, 0 mismatches.

• The Standard Schema bridge stopped paying for enrichment it throws away. An issue carries a message and a path and nothing else, but ~standard.validate read the rich error list, which builds suggestions, ranks and source frames per error. It now takes the raw, schema-ordered list through the same build the rich path uses, and parsePointerPath walks the pointer in one pass instead of split, filter, map and a regex per segment. A 16-error rejection went from 17.6 to 4.3 microseconds; messages and order are unchanged, and tests/test_standard_schema.js holds issues to exact parity with validate().errors. Schemas using errorMessage keep their custom messages.

Fixed

• The compiled engine refused a lowercase zone letter in time that the interpreter accepted: 00:00:00z answered differently depending on which engine ran the schema, and date-time took either case in both. One implementation now answers for every engine, and it takes both cases, per RFC 3339.

• The ReDoS integration test measured the first call, which includes compiling the schema and the pattern, against a 50 ms budget. On a loaded CI machine that reads as a failure without anything being wrong: the gate exists to separate linear matching from catastrophic backtracking, which differ by minutes, not by milliseconds. It now warms up first and allows 500 ms.

1.11.0 - 2026-08-31

Fixed

• The verdict methods answer the same question as validate() again. With coerceTypes, removeAdditional or a schema default in play, validate() ran the preprocess pass and isValidObject(), isValidJSON() and validateJSON() did not, so the same validator answered true from one and false from another for the same document: validate({ age: '26' }) accepted where isValidObject({ age: '26' }) rejected. Every path now runs the same pass. Verdict methods on a validator configured this way rewrite the input in place, as validate() already did, and the cost of the correction is 0.5 ns on isValidObject and 2.7 ns on isValidJSON, measured interleaved; validators without those options are unchanged. tests/test_verdict_preprocess.js holds all four methods to the same answers.

• The native engine's error codes no longer reach callers untranslated. A type failure answered by the addon came back as code: 3 with no keyword and a docUrl pointing at a page that does not exist, while the same failure from the JavaScript engines came back as ATA1001; both now report the documented code, keyword and link. tests/test_native_error_codes.js holds the table against the enum in include/ata.h, so the two cannot drift apart silently.

• The error generator declined self-referencing schemas by emitting nothing for the reference, which accepted whatever that reference guarded: { properties: { foo: { $ref: "#" } }, additionalProperties: false } accepted { foo: { bar: false } } on that path. It now declines the schema outright and the validator falls back to an engine that answers it correctly. The entry-point agreement test covers the shape.

• ipv6 gave two different answers depending on which engine ran it, and neither was right. The compiled path refused an IPv4-mapped address such as ::ffff:192.168.1.1, the interpreted path accepted ::ffff:1.2.3.4.5, and both accepted a group of five hex digits like 12345::1. One implementation now answers for every engine, following RFC 4291, checked against Node's own net.isIPv6 and the suite's corpus.

• date-time refuses dates that do not exist. The check ran a regular expression for the shape and then handed the string to Date.parse, which rolls an out-of-range day into the next month, so 2026-02-30T00:00:00Z, 2026-02-29T00:00:00Z and 2026-12-31T24:00:00Z were all accepted. The month, the day count for that month in that year, the clock and the offset are now checked directly, per RFC 3339. Schemas that relied on the old leniency will see those values rejected.

• Data that points back at itself no longer exhausts the stack. A document with a cycle, which JSON text cannot express but an in-memory object graph can, threw RangeError: Maximum call stack size exceeded on the compiled path while the interpreted engine settled on an answer, so the two engines disagreed. Both now follow the same rule: a value already being checked against a schema is a fixed point and counts as satisfied, and a cycle no longer hides a real violation elsewhere in the document. Validation runs a fast pass that only counts depth and a guarded pass that runs when that depth is exceeded, so ordinary documents pay one integer operation per recursive call. Measured interleaved on a self-referencing schema: a four-node document 22.2 to 30.6 ns, a 200-node document 2077 to 1178 ns, non-recursive schemas unchanged at 3.8 ns. tests/test_cyclic_input.js holds all three engines to the same answers.

Performance

• ipv6 and hostname read the string once as well: 54.7 to 29.6 ns and 45.5 to 28.2 ns, interleaved medians. ipv6 no longer allocates two arrays per check; hostname keeps the answers of the expression it replaces, fuzzed over 300k strings with 0 mismatches.

• date-time reads the string once, with no regular expression, no date object and no allocation: 95.0 to 39.4 ns on a valid value with a Z, 103.8 to 45.3 ns with a numeric offset, interleaved medians. Fuzzed against a reference that spells out RFC 3339, with 0 mismatches over 300k strings; tests/test_formats_single_pass.js keeps both the predicate and the generated form on it.

• A constructed Validator is roughly three times smaller on the heap until it is used. The public methods and the Standard Schema entry moved from per-instance closures built in the constructor to memoized prototype accessors, and the JSON position cache is only allocated when the JSON text path first needs it. Measured per instance on a 10-key object schema, double-gc deltas over 2000 instances: 1.61 KB to 0.43 KB with a shared schema object, 2.33 KB to 1.12 KB when each instance owns its schema, 3.93 KB to 3.30 KB once compiled and used. Construction alone went from 1504 to 855 ns; construction plus first validate pays about 0.9 microseconds more, once, because the compile step's method assignments now go through a defining setter. The hot validate() path is unchanged, measured interleaved. Detached method references (const f = v.validate) still work; tests/test_lazy_instance.js pins the shape.

1.10.0 - 2026-08-30

... (truncated)

Commits

• 085256d chore: bump to 1.12.1
• a21582d fix: one error per format violation
• bf7c4fe ci: build linux-arm64-musl on the arm64 runner instead of qemu
• 1e2742a chore: bump to 1.12.0
• 628045f perf: standard schema issues from the raw error path
• 6fdbcdd perf: fixed-position date-time, time and uuid, two-tier uri scan
• 26c7c8e merge: single-pass uri
• efcffd9 perf: read uri in one pass
• df8f8d1 docs: record the ReDoS gate change
• ad32a3f test: measure the ReDoS gate after warmup, with a budget that fits CI
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for ata-validator since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #8.