chore: bump ata-validator from 0.5.1 to 1.13.1

[dependabot]

Bumps ata-validator from 0.5.1 to 1.13.1.

Release notes

Sourced from ata-validator's releases.

1.13.1

Fixed

• The native engine stops printing to stderr for patterns outside RE2's subset. A pattern with lookahead or a backreference is an expected input, not a fault: construction is probed, and the JavaScript engines answer for the pattern instead. RE2 logged every such probe to stderr anyway, so a schema carrying zod's email pattern printed two C++ error lines on compile while validating correctly. RE2 is now constructed with logging off; verdicts are unchanged.

1.13.0

Changed

• The default browser bundle stops carrying the AOT emitters. lib/aot.js has promised a browser stub via the package.json browser field since the fs-free build, but the mapping was never actually in the field, so every browser bundle shipped the emitters and the embedded safe-regex engine source they pull in, along with the native walker's routing table that only matters when the native addon loads. Both now map to stubs. Emitting validators in a browser still works, through the new ata-validator/aot entry, and the Validator.bundle* statics in a browser bundle throw a message that points there; Validator.loadBundle keeps working in the default bundle, since loading a bundle somebody already built is a runtime act. Measured with the schema-benchmarks rolldown pipeline: minified and gzipped 73,491 to 64,812 bytes, 11.8 percent smaller. The browser-imports guard now bans a token from each excluded file so the mapping cannot regress silently.

Added

• ata-validator/aot: the standalone emitters (toStandalone, toStandaloneModule, bundle, bundleStandalone, bundleCompact, loadBundle) as an explicit, typed import. In Node it is the same module the statics use; in a browser it is the way to opt back into emission without paying for it on pages that never emit.

1.12.1

Fixed

• One format violation reports one error. The error path turns each failing statement of a format check into an error push, and it kept going after pushing, so a single bad value collected one identical error per statement it failed: twelve for date-time on a short string, five for time, two for uuid and hostname. The check now leaves the format block on the first failure. Verdicts are unchanged; only the duplicate copies of the same error are gone. tests/test_format_single_error.js holds every built-in format to exactly one error across 25 invalid values.

1.12.0

Performance

• date-time stopped asking every character where it sits. The scan tested each of nineteen positions against the separator indices before checking the digit; the separators are now read directly by index and each digit becomes its value in the same read that validates it, so the field numbers cost nothing extra. 40.8 to 19.5 ns on a valid value, medians across separate processes. Same answers as before on every month, day and clock boundary and under 150k random mutations.

• uuid reads the four hyphens by index and the 32 hex digits in five runs with fixed bounds, instead of a case-insensitive regular expression. A digit is one unsigned compare and a letter one more after folding case with a single OR. 48.4 to 35.1 ns; 300k mutated and random strings against the old expression with 0 mismatches.

• time reads fixed positions the same way instead of running a regular expression: 15.6 to 12.1 ns, and 200k mutations against the old pattern with 0 mismatches.

• uri reads the scheme from the front and scans the rest once instead of running two regular expressions: 39.3 to 32.8 ns, interleaved medians. The remaining scan then became two tiers, because the measured answer was not the expected one: a hand-written character loop beat the old \s expression in isolation but lost to the engine's scanner inside a compiled validator, since \s is what forced the Unicode machinery in. The first tier asks whether anything sits outside printable ASCII, a one-byte class the engine scans at its own speed and no ordinary URI ever trips; only a string that trips it pays for the loop that knows the exact reserved set. On a nested schema carrying six URLs, 215.5 to 189.4 ns per document, medians across separate processes. uri-reference shares the same scan. Fuzzed over every code point in the BMP in three positions, 0 mismatches.

• The Standard Schema bridge stopped paying for enrichment it throws away. An issue carries a message and a path and nothing else, but ~standard.validate read the rich error list, which builds suggestions, ranks and source frames per error. It now takes the raw, schema-ordered list through the same build the rich path uses, and parsePointerPath walks the pointer in one pass instead of split, filter, map and a regex per segment. A 16-error rejection went from 17.6 to 4.3 microseconds; messages and order are unchanged, and tests/test_standard_schema.js holds issues to exact parity with validate().errors. Schemas using errorMessage keep their custom messages.

Fixed

• The compiled engine refused a lowercase zone letter in time that the interpreter accepted: 00:00:00z answered differently depending on which engine ran the schema, and date-time took either case in both. One implementation now answers for every engine, and it takes both cases, per RFC 3339.

• The ReDoS integration test measured the first call, which includes compiling the schema and the pattern, against a 50 ms budget. On a loaded CI machine that reads as a failure without anything being wrong: the gate exists to separate linear matching from catastrophic backtracking, which differ by minutes, not by milliseconds. It now warms up first and allows 500 ms.

1.11.0

Fixed

• The verdict methods answer the same question as validate() again. With coerceTypes, removeAdditional or a schema default in play, validate() ran the preprocess pass and isValidObject(), isValidJSON() and validateJSON() did not, so the same validator answered true from one and false from another for the same document: validate({ age: '26' }) accepted where isValidObject({ age: '26' }) rejected. Every path now runs the same pass. Verdict methods on a validator configured this way rewrite the input in place, as validate() already did, and the cost of the correction is 0.5 ns on isValidObject and 2.7 ns on isValidJSON, measured interleaved; validators without those options are unchanged. tests/test_verdict_preprocess.js holds all four methods to the same answers.

• The native engine's error codes no longer reach callers untranslated. A type failure answered by the addon came back as code: 3 with no keyword and a docUrl pointing at a page that does not exist, while the same failure from the JavaScript engines came back as ATA1001; both now report the documented code, keyword and link. tests/test_native_error_codes.js holds the table against the enum in include/ata.h, so the two cannot drift apart silently.

• The error generator declined self-referencing schemas by emitting nothing for the reference, which accepted whatever that reference guarded: { properties: { foo: { $ref: "#" } }, additionalProperties: false } accepted { foo: { bar: false } } on that path. It now declines the schema outright and the validator falls back to an engine that answers it correctly. The entry-point agreement test covers the shape.

... (truncated)

Changelog

Sourced from ata-validator's changelog.

1.13.1 - 2026-09-06

Fixed

• The native engine stops printing to stderr for patterns outside RE2's subset. A pattern with lookahead or a backreference is an expected input, not a fault: construction is probed, and the JavaScript engines answer for the pattern instead. RE2 logged every such probe to stderr anyway, so a schema carrying zod's email pattern printed two C++ error lines on compile while validating correctly. RE2 is now constructed with logging off; verdicts are unchanged.

1.13.0 - 2026-09-06

Changed

• The default browser bundle stops carrying the AOT emitters. lib/aot.js has promised a browser stub via the package.json browser field since the fs-free build, but the mapping was never actually in the field, so every browser bundle shipped the emitters and the embedded safe-regex engine source they pull in, along with the native walker's routing table that only matters when the native addon loads. Both now map to stubs. Emitting validators in a browser still works, through the new ata-validator/aot entry, and the Validator.bundle* statics in a browser bundle throw a message that points there; Validator.loadBundle keeps working in the default bundle, since loading a bundle somebody already built is a runtime act. Measured with the schema-benchmarks rolldown pipeline: minified and gzipped 73,491 to 64,812 bytes, 11.8 percent smaller. The browser-imports guard now bans a token from each excluded file so the mapping cannot regress silently.

Added

• ata-validator/aot: the standalone emitters (toStandalone, toStandaloneModule, bundle, bundleStandalone, bundleCompact, loadBundle) as an explicit, typed import. In Node it is the same module the statics use; in a browser it is the way to opt back into emission without paying for it on pages that never emit.

1.12.1 - 2026-09-06

Fixed

• One format violation reports one error. The error path turns each failing statement of a format check into an error push, and it kept going after pushing, so a single bad value collected one identical error per statement it failed: twelve for date-time on a short string, five for time, two for uuid and hostname. The check now leaves the format block on the first failure. Verdicts are unchanged; only the duplicate copies of the same error are gone. tests/test_format_single_error.js holds every built-in format to exactly one error across 25 invalid values.

1.12.0 - 2026-09-06

Performance

• date-time stopped asking every character where it sits. The scan tested each of nineteen positions against the separator indices before checking the digit; the separators are now read directly by index and each digit becomes its value in the same read that validates it, so the field numbers cost nothing extra. 40.8 to 19.5 ns on a valid value, medians across separate processes. Same answers as before on every month, day and clock boundary and under 150k random mutations.

• uuid reads the four hyphens by index and the 32 hex digits in five runs with fixed bounds, instead of a case-insensitive regular expression. A digit is one unsigned compare and a letter one more after folding case with a single OR. 48.4 to 35.1 ns; 300k mutated and random strings against the old expression with 0 mismatches.

• time reads fixed positions the same way instead of running a regular expression: 15.6 to 12.1 ns, and 200k mutations against the old pattern with 0 mismatches.

• uri reads the scheme from the front and scans the rest once instead of running two regular expressions: 39.3 to 32.8 ns, interleaved medians. The remaining scan then became two tiers, because the measured answer was not the expected one: a hand-written character loop beat the old \s expression in isolation but lost to the engine's scanner inside a compiled validator, since \s is what forced the Unicode machinery in. The first tier asks whether anything sits outside printable ASCII, a one-byte class the engine scans at its own speed and no ordinary URI ever trips; only a string that trips it pays for the loop that knows the exact reserved set. On a nested schema carrying six URLs, 215.5 to 189.4 ns per document, medians across separate processes. uri-reference shares the same scan. Fuzzed over every code point in the BMP in three positions, 0 mismatches.

• The Standard Schema bridge stopped paying for enrichment it throws away. An issue carries a message and a path and nothing else, but ~standard.validate read the rich error list, which builds suggestions, ranks and source frames per error. It now takes the raw, schema-ordered list through the same build the rich path uses, and parsePointerPath walks the pointer in one pass instead of split, filter, map and a regex per segment. A 16-error rejection went from 17.6 to 4.3 microseconds; messages and order are unchanged, and tests/test_standard_schema.js holds issues to exact parity with validate().errors. Schemas using errorMessage keep their custom messages.

Fixed

• The compiled engine refused a lowercase zone letter in time that the interpreter accepted: 00:00:00z answered differently depending on which engine ran the schema, and date-time took either case in both. One implementation now answers for every engine, and it takes both cases, per RFC 3339.

• The ReDoS integration test measured the first call, which includes compiling the schema and the pattern, against a 50 ms budget. On a loaded CI machine that reads as a failure without anything being wrong: the gate exists to separate linear matching from catastrophic backtracking, which differ by minutes, not by milliseconds. It now warms up first and allows 500 ms.

1.11.0 - 2026-08-31

Fixed

• The verdict methods answer the same question as validate() again. With coerceTypes, removeAdditional or a schema default in play, validate() ran the preprocess pass and isValidObject(), isValidJSON() and validateJSON() did not, so the same validator answered true from one and false from another for the same document: validate({ age: '26' }) accepted where isValidObject({ age: '26' }) rejected. Every path now runs the same pass. Verdict methods on a validator configured this way rewrite the input in place, as validate() already did, and the cost of the correction is 0.5 ns on isValidObject and 2.7 ns on isValidJSON, measured interleaved; validators without those options are unchanged. tests/test_verdict_preprocess.js holds all four methods to the same answers.

• The native engine's error codes no longer reach callers untranslated. A type failure answered by the addon came back as code: 3 with no keyword and a docUrl pointing at a page that does not exist, while the same failure from the JavaScript engines came back as ATA1001; both now report the documented code, keyword and link. tests/test_native_error_codes.js holds the table against the enum in include/ata.h, so the two cannot drift apart silently.

• The error generator declined self-referencing schemas by emitting nothing for the reference, which accepted whatever that reference guarded: { properties: { foo: { $ref: "#" } }, additionalProperties: false } accepted { foo: { bar: false } } on that path. It now declines the schema outright and the validator falls back to an engine that answers it correctly. The entry-point agreement test covers the shape.

... (truncated)

Commits

• cb95f9f chore: bump to 1.13.1
• a6ec1e1 fix: no stderr from re2 for patterns outside its subset
• 94353ce chore: bump to 1.13.0
• ae018a2 feat: browser bundle drops the aot emitters, ata-validator/aot opts back in
• 085256d chore: bump to 1.12.1
• a21582d fix: one error per format violation
• bf7c4fe ci: build linux-arm64-musl on the arm64 runner instead of qemu
• 1e2742a chore: bump to 1.12.0
• 628045f perf: standard schema issues from the raw error path
• 6fdbcdd perf: fixed-position date-time, time and uuid, two-tier uri scan
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for ata-validator since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #9.