contractual next version by omermorad · Pull Request #15 · codotech/contractual

omermorad · 2026-03-12T16:32:09Z

No description provided.

Change `npx contractual` to `npx @contractual/cli` to ensure the correct package is used from the Verdaccio registry instead of an unrelated `contractual` package from npm.

Changed JSON output from { results: [...] } to { contracts: { name: {...} } } to match expected format in e2e tests and provide better ergonomics for scripting (e.g., parsed.contracts.order.changes).

- @contractual/changesets@0.1.0-dev.0 - @contractual/cli@0.1.0-dev.0 - @contractual/differs.json-schema@0.1.0-dev.0 - @contractual/governance@0.1.0-dev.0 - @contractual/types@0.1.0-dev.0

- Change openapi-diff from ^0.24.1 to ^0.23.7 - Version 0.24.x doesn't exist on npm, latest is 0.23.7 - Fixes npm install errors when using published packages

Update tests to use new contracts object format instead of results array: - Old format: { results: [...] } - New format: { contracts: { contractName: {...} } } Fixes: - --format json test: check for contracts object instead of results array - --severity breaking test: iterate over contracts object - --severity non-breaking test: iterate over contracts object All 17 tests now passing.

- @contractual/cli@0.1.0-dev.1 - @contractual/governance@0.1.0-dev.1

Replace the `openapi-diff` npm package (3.0 only) with a custom OpenAPI differ built on @redocly/openapi-core, supporting both 3.0 and 3.1 specs. Extract shared schema diffing primitives (walker, classifiers, ref-resolver) into @contractual/differs.core so they can be reused across differs. New packages: - @contractual/differs.core — shared walker, classifiers, ref-resolver - @contractual/differs.openapi — OpenAPI 3.0/3.1 differ via Redocly Changes: - @contractual/differs.json-schema now wraps differs.core (backward compat) - @contractual/governance drops openapi-diff dep, registers new differ - @contractual/types extended with 15 OpenAPI structural change types - Add e2e tests for OpenAPI 3.1 (type arrays, type narrowing/widening) Spec version sync: - New utility `updateSpecVersion()` in @contractual/changesets that updates the version field inside spec files (info.version for OpenAPI/AsyncAPI, top-level version for ODCS, skipped for JSON Schema) - Preserves YAML comments/formatting via parseDocument(), detects JSON indent - Creates missing version fields (e.g., missing info object) automatically - Called before bump/setVersion so snapshot copies include the updated version - Per-contract opt-out via `syncVersion: false` in contractual.config.json - CLI flag `--no-sync-version` to skip for all contracts in a run - Integrated into `contract add` command for initial version sync - 22 e2e tests covering all spec types, bump types, missing fields, pre-release, multi-contract, config opt-out, and CLI flag # Conflicts: # pnpm-lock.yaml

- @contractual/changesets@0.1.0-dev.1 - @contractual/cli@0.1.0-dev.2 - @contractual/differs.core@0.1.0-dev.1 - @contractual/differs.json-schema@0.1.0-dev.1 - @contractual/differs.openapi@0.1.0-dev.1 - @contractual/governance@0.1.0-dev.2 - @contractual/types@0.1.0-dev.1

…flow Redocly's bundle with dereference:true creates JS object cycles for circular schemas (e.g. Category referencing itself). Our deepEqual recurses infinitely on these cycles. Fix: use Redocly for bundling only (resolves external refs), then use our own ref-resolver from differs.core which has circular detection and replaces cycles with $circularRef placeholders. Also: - Move @redocly/openapi-core from optional peer dep to regular dep in differs.openapi so users don't need to install it separately - Remove peer dep from governance (gets it transitively) - Add e2e tests for circular ref schemas - Add timeout option to e2e test helper

- @contractual/cli@0.1.0-dev.3 - @contractual/differs.openapi@0.1.0-dev.2 - @contractual/governance@0.1.0-dev.3

- @contractual/changesets@0.1.0-dev.4 - @contractual/cli@0.1.0-dev.4 - @contractual/differs.core@0.1.0-dev.4 - @contractual/differs.json-schema@0.1.0-dev.4 - @contractual/differs.openapi@0.1.0-dev.4 - @contractual/governance@0.1.0-dev.4 - @contractual/types@0.1.0-dev.4

… changes - Adding optional parameter is now non-breaking (was incorrectly breaking) - Adding required parameter uses new parameter-required-added type (breaking) - Detect operation-level metadata changes: description, summary, deprecated - Detect top-level info.description and info.title changes - All metadata changes classified as patch (creates changesets, not breaking)

…nter paths formatChangeMessage() had no cases for OpenAPI structural types (path-added, operation-added, parameter-*, response-*, etc.) so they were falling through to "Unknown change at /paths/~1v2~1media". Now shows "New path added: /v2/media" instead. - Add cases for all 16 OpenAPI structural change types - Decode JSON Pointer paths for display (~1 → /, ~0 → ~) - Add e2e tests for message formatting

- @contractual/changesets@0.1.0-dev.5 - @contractual/cli@0.1.0-dev.5 - @contractual/differs.core@0.1.0-dev.5 - @contractual/differs.json-schema@0.1.0-dev.5 - @contractual/differs.openapi@0.1.0-dev.5 - @contractual/governance@0.1.0-dev.5 - @contractual/types@0.1.0-dev.5

anyOf/oneOf/allOf and conditional schema changes were falling through to the default case, producing "Unknown change" messages in PR comments.

- @contractual/cli@0.1.0-next.0 - @contractual/differs.core@0.1.0-next.0 - @contractual/differs.json-schema@0.1.0-next.0 - @contractual/differs.openapi@0.1.0-next.0 - @contractual/governance@0.1.0-next.0

This reverts commit de318c0.

- @contractual/cli@0.1.0-dev.6 - @contractual/differs.core@0.1.0-dev.6 - @contractual/differs.json-schema@0.1.0-dev.6 - @contractual/differs.openapi@0.1.0-dev.6 - @contractual/governance@0.1.0-dev.6

… double slashes OpenAPI path keys like /v1/extract were producing //v1/extract in changeset output. Decode per-segment and bracket keys containing slashes.

- @contractual/cli@0.1.0-dev.7 - @contractual/differs.core@0.1.0-dev.7 - @contractual/differs.json-schema@0.1.0-dev.7 - @contractual/differs.openapi@0.1.0-dev.7 - @contractual/governance@0.1.0-dev.7

updateYamlSpec parsed leniently with parseDocument() then called doc.toString() unconditionally, which throws 'Document with errors cannot be stringified' whenever the spec has any recoverable parse error (e.g. an under-indented multi-line scalar deep in the file). A cosmetic version sync would then take down the entire release. Now: clean docs use the structured setIn + toString path; docs with parse errors fall back to a surgical in-place splice of just the version field's source range, leaving malformed regions untouched; if the field cannot be located we warn and continue instead of throwing. Numeric-looking versions are kept as strings. Adds a co-located unit test (vitest devDep + lockfile entry) and excludes *.test.ts / *.spec.ts from tsconfig.build.json so tests are never compiled into the published dist.

- @contractual/changesets@0.1.0-dev.6 - @contractual/cli@0.1.0-dev.8

qballer · 2026-06-18T14:13:05Z

Small PR :)

github-advanced-security · 2026-09-29T05:33:55Z

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

Bumps [@inquirer/prompts](https://github.com/SBoudrias/Inquirer.js) from 8.5.2 to 8.7.2. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/SBoudrias/Inquirer.js/releases">@inquirer/prompts's releases</a>.</em></p> <blockquote> <h2><code>@inquirer/prompts</code><a href="https://github.com/8"><code>@8</code></a>.7.2</h2> <h3>What's new</h3> <ul> <li>Fixed a race where keystrokes batched in the same tick as the key that settled a prompt could still reach keypress handlers after the prompt was done, cancelled, or aborted (<code>@inquirer/core</code>, <a href="https://redirect.github.com/SBoudrias/Inquirer.js/pull/2255">#2255</a>, closes <a href="https://redirect.github.com/SBoudrias/Inquirer.js/issues/1816">#1816</a>).</li> <li><code>confirm()</code> now trims surrounding whitespace from answers before matching yes/no keywords (<code>@inquirer/confirm</code>, <a href="https://redirect.github.com/SBoudrias/Inquirer.js/pull/2254">#2254</a>).</li> </ul> <h3>Included</h3> <ul> <li><code>@inquirer/checkbox@^5.2.5</code></li> <li><code>@inquirer/confirm@^6.3.2</code></li> <li><code>@inquirer/editor@^5.3.3</code></li> <li><code>@inquirer/expand@^5.1.5</code></li> <li><code>@inquirer/input@^5.1.6</code></li> <li><code>@inquirer/number@^4.2.3</code></li> <li><code>@inquirer/password@^5.2.2</code></li> <li><code>@inquirer/rawlist@^5.3.5</code></li> <li><code>@inquirer/search@^4.3.3</code></li> <li><code>@inquirer/select@^5.2.5</code></li> </ul> <h2><code>@inquirer/prompts</code><a href="https://github.com/8"><code>@8</code></a>.7.1</h2> <h3>What's new</h3> <ul> <li>All bundled prompts now pin <code>@inquirer/type</code> to an exact version in their published manifests. Since these type definitions leak into consumers' <code>tsc</code> runs, a semver range on the types-only dependency could break downstream TypeScript builds without any change to Inquirer.js itself (<a href="https://redirect.github.com/SBoudrias/Inquirer.js/pull/2247">#2247</a>, fixes <a href="https://redirect.github.com/SBoudrias/Inquirer.js/issues/2244">#2244</a>).</li> </ul> <h3>Included</h3> <ul> <li><code>@inquirer/checkbox@^5.2.4</code></li> <li><code>@inquirer/confirm@^6.3.1</code></li> <li><code>@inquirer/editor@^5.3.2</code></li> <li><code>@inquirer/expand@^5.1.4</code></li> <li><code>@inquirer/input@^5.1.5</code></li> <li><code>@inquirer/number@^4.2.2</code></li> <li><code>@inquirer/password@^5.2.1</code></li> <li><code>@inquirer/rawlist@^5.3.4</code></li> <li><code>@inquirer/search@^4.3.2</code></li> <li><code>@inquirer/select@^5.2.4</code></li> </ul> <h2><code>@inquirer/prompts</code><a href="https://github.com/8"><code>@8</code></a>.7.0</h2> <h3>What's new</h3> <ul> <li><code>password</code> gains the <code>toggleMask</code> option (ctrl+t to reveal the typed value).</li> <li><code>confirm</code> now matches localized yes/no answers per-locale.</li> <li>Prettified prompt and theme types for better IDE display.</li> <li>Added <code>inquirer-grouped-checkbox</code> to the community prompts list (<a href="https://redirect.github.com/SBoudrias/Inquirer.js/pull/2236">#2236</a>).</li> </ul> <h3>Included</h3>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/SBoudrias/Inquirer.js/commit/cbdb34bfc6c245941d80ef88493c50b3d6dbfce6"><code>cbdb34b</code></a> chore: Publish new release</li> <li><a href="https://github.com/SBoudrias/Inquirer.js/commit/8340d2dd764d4b11d4e200412b614f9964ae0691"><code>8340d2d</code></a> fix(<code>@inquirer/core</code>): clear hook effects before settling prompts</li> <li><a href="https://github.com/SBoudrias/Inquirer.js/commit/2475e07186d824d52504095c71c2272d9e7338fe"><code>2475e07</code></a> test(<code>@inquirer/core</code>): cover hook cleanup error semantics</li> <li><a href="https://github.com/SBoudrias/Inquirer.js/commit/15cd8d3b53bfc270633072073c24d6be6ce3d83b"><code>15cd8d3</code></a> fix(confirm): ignore surrounding whitespace in answers</li> <li><a href="https://github.com/SBoudrias/Inquirer.js/commit/9cb0da6c187346c955ab0b788fa1a88c897f16da"><code>9cb0da6</code></a> chore(deps): Bump github/codeql-action/analyze from 4.37.7 to 4.37.9</li> <li><a href="https://github.com/SBoudrias/Inquirer.js/commit/1c750bc55ab4fac310d70db84a7a6ada76c0e854"><code>1c750bc</code></a> chore(deps-dev): Bump the build group with 3 updates (<a href="https://redirect.github.com/SBoudrias/Inquirer.js/issues/2251">#2251</a>)</li> <li><a href="https://github.com/SBoudrias/Inquirer.js/commit/81f1525110990603e9796d48eecde0f8c2d2fc98"><code>81f1525</code></a> chore(deps-dev): Bump <code>@types/node</code> in the types group (<a href="https://redirect.github.com/SBoudrias/Inquirer.js/issues/2252">#2252</a>)</li> <li><a href="https://github.com/SBoudrias/Inquirer.js/commit/7c27f26606a16b6e8f55b51e4431c72658c674c5"><code>7c27f26</code></a> chore(deps-dev): Bump oxfmt in the formatting group (<a href="https://redirect.github.com/SBoudrias/Inquirer.js/issues/2249">#2249</a>)</li> <li><a href="https://github.com/SBoudrias/Inquirer.js/commit/6119088a4e07ec59460c3cd44d06817de97bfdac"><code>6119088</code></a> chore(deps): Bump github/codeql-action/init from 4.37.7 to 4.37.9 (<a href="https://redirect.github.com/SBoudrias/Inquirer.js/issues/2250">#2250</a>)</li> <li><a href="https://github.com/SBoudrias/Inquirer.js/commit/0d167c0aface3f5cf95132ada9bfec7946dd5b74"><code>0d167c0</code></a> chore(deps-dev): Bump the linting group with 4 updates (<a href="https://redirect.github.com/SBoudrias/Inquirer.js/issues/2248">#2248</a>)</li> <li>Additional commits viewable in <a href="https://github.com/SBoudrias/Inquirer.js/compare/@inquirer/prompts@8.5.2...@inquirer/prompts@8.7.2">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for <code>@inquirer/prompts</code> since your current version.</p> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=@inquirer/prompts&package-manager=npm_and_yarn&previous-version=8.5.2&new-version=8.7.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [chalk](https://github.com/chalk/chalk) from 5.6.2 to 6.0.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/chalk/chalk/releases">chalk's releases</a>.</em></p> <blockquote> <h2>v6.0.0</h2> <h3>Breaking</h3> <ul> <li>Require Node.js 22 8a94e0e</li> </ul> <h3>Improvements</h3> <ul> <li>Add underline styles and underline colors (<a href="https://redirect.github.com/chalk/chalk/issues/689">#689</a>) 4c304dd</li> <li>Improve performance 5729845 fa5cff2</li> </ul> <h3>Fixes</h3> <ul> <li>Treat a numeric <code>FORCE_COLOR</code> as an exact level (<a href="https://redirect.github.com/chalk/chalk/issues/688">#688</a>) e912931</li> <li>Downsample <code>ansi256()</code> and <code>bgAnsi256()</code> to 16 colors at level 1 (<a href="https://redirect.github.com/chalk/chalk/issues/687">#687</a>) ff549c5</li> </ul> <hr /> <p><a href="https://github.com/chalk/chalk/compare/v5.6.2...v6.0.0">https://github.com/chalk/chalk/compare/v5.6.2...v6.0.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/chalk/chalk/commit/661317e6f91fe7c90306c2c48ea9354562ee9146"><code>661317e</code></a> 6.0.0</li> <li><a href="https://github.com/chalk/chalk/commit/5729845f33d357e0c21b29b2b16849b72fb8cec4"><code>5729845</code></a> Improve performance</li> <li><a href="https://github.com/chalk/chalk/commit/4c304dd72cce5a036c02e5dd8af52996ae98501f"><code>4c304dd</code></a> Add extended underline styles and underline colors (<a href="https://redirect.github.com/chalk/chalk/issues/689">#689</a>)</li> <li><a href="https://github.com/chalk/chalk/commit/e91293130c7d642c7b91152c3c942743a3b910a7"><code>e912931</code></a> Fix: Treat a numeric <code>FORCE_COLOR</code> as an exact level (<a href="https://redirect.github.com/chalk/chalk/issues/688">#688</a>)</li> <li><a href="https://github.com/chalk/chalk/commit/8a94e0ebfc495dda27f7090fb1a012790b15a76d"><code>8a94e0e</code></a> Require Node.js 22</li> <li><a href="https://github.com/chalk/chalk/commit/fa5cff280e821c928dab716a03beff06529ffaf3"><code>fa5cff2</code></a> Optimize 2-argument calls (<a href="https://redirect.github.com/chalk/chalk/issues/670">#670</a>)</li> <li><a href="https://github.com/chalk/chalk/commit/ff549c534c413a9225322c1ff4e5fc0d97ae5610"><code>ff549c5</code></a> Fix: Downsample <code>ansi256()</code> and <code>bgAnsi256()</code> to 16 colors at level 1 (<a href="https://redirect.github.com/chalk/chalk/issues/687">#687</a>)</li> <li><a href="https://github.com/chalk/chalk/commit/678e5505458d0cf40134e205aed4454e0eeac45c"><code>678e550</code></a> Tweaks</li> <li><a href="https://github.com/chalk/chalk/commit/aa06bb5ac3f14df9fda8cfb54274dfc165ddfdef"><code>aa06bb5</code></a> Fix typos (<a href="https://redirect.github.com/chalk/chalk/issues/664">#664</a>)</li> <li>See full diff in <a href="https://github.com/chalk/chalk/compare/v5.6.2...v6.0.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=chalk&package-manager=npm_and_yarn&previous-version=5.6.2&new-version=6.0.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [rimraf](https://github.com/isaacs/rimraf) from 5.0.10 to 6.1.3. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/isaacs/rimraf/blob/main/CHANGELOG.md">rimraf's changelog</a>.</em></p> <blockquote> <h1>6.1</h1> <ul> <li>Move to native <code>fs/promises</code> usage instead of promisifying manually.</li> </ul> <h1>6.0</h1> <ul> <li>Drop support for nodes before v20</li> <li>Add <code>--version</code> to CLI</li> </ul> <h1>5.0</h1> <ul> <li>No default export, only named exports</li> </ul> <h1>4.4</h1> <ul> <li>Provide Dirent or Stats object as second argument to filter</li> </ul> <h1>4.3</h1> <ul> <li>Return boolean indicating whether the path was fully removed</li> <li>Add filter option</li> <li>bin: add --verbose, -v to print files as they are deleted</li> <li>bin: add --no-verbose, -V to not print files as they are deleted</li> <li>bin: add -i --interactive to be prompted on each deletion</li> <li>bin: add -I --no-interactive to not be prompted on each deletion</li> <li><strong>4.3.1</strong> Fixed inappropriately following symbolic links to directories</li> </ul> <h1>v4.2</h1> <ul> <li>Brought back <code>glob</code> support, using the new and improved glob v9</li> </ul> <h1>v4.1</h1> <ul> <li>Improved hybrid module with no need to look at the <code>.default</code> dangly bit. <code>.default</code> preserved as a reference to <code>rimraf</code> for compatibility with anyone who came to rely on it in v4.0.</li> <li>Accept and ignore <code>-rf</code> and <code>-fr</code> arguments to the bin.</li> </ul> <h1>v4.0</h1> <ul> <li>Remove <code>glob</code> dependency entirely. This library now only accepts actual file and folder names to delete.</li> <li>Accept array of paths or single path.</li> <li>Windows performance and reliability improved.</li> <li>All strategies separated into explicitly exported methods.</li> <li>Drop support for Node.js below version 14</li> <li>rewrite in TypeScript</li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/isaacs/rimraf/commit/f738c781d14fa7bc06f8e39e062d78f701fde3f1"><code>f738c78</code></a> 6.1.3</li> <li><a href="https://github.com/isaacs/rimraf/commit/a164a85093f78e40d8f995b0d8ff3a1856324768"><code>a164a85</code></a> update deps</li> <li><a href="https://github.com/isaacs/rimraf/commit/4635ba7498849cade724bd34c1ec9feae4b56236"><code>4635ba7</code></a> update deps</li> <li><a href="https://github.com/isaacs/rimraf/commit/509c53f8b0298508c3a536dc121bbc0652d3e56f"><code>509c53f</code></a> limit ci workflow permissions</li> <li><a href="https://github.com/isaacs/rimraf/commit/68ce04f9bfb436e66356428e2970c78fa2a76d02"><code>68ce04f</code></a> formatting</li> <li><a href="https://github.com/isaacs/rimraf/commit/37680c5d7f0104042ab8e8fae3e77484dc7687ca"><code>37680c5</code></a> add warning to not pass untrusted input to this method ever</li> <li><a href="https://github.com/isaacs/rimraf/commit/786563d3901763fa77090271d239233aa27e7a3a"><code>786563d</code></a> remove contributing doc, already covered by .github repo</li> <li><a href="https://github.com/isaacs/rimraf/commit/dbeef7399038d0cc467dbac5f91074cd0dc847dd"><code>dbeef73</code></a> contributing</li> <li><a href="https://github.com/isaacs/rimraf/commit/84d27afdbf7a211ecce6e9e73530aeb7278ea5d2"><code>84d27af</code></a> update workflows and standard project junk</li> <li><a href="https://github.com/isaacs/rimraf/commit/cd45498f616f9265dfe1e30640d6424348f75f04"><code>cd45498</code></a> 6.1.2</li> <li>Additional commits viewable in <a href="https://github.com/isaacs/rimraf/compare/v5.0.10...v6.1.3">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=rimraf&package-manager=npm_and_yarn&previous-version=5.0.10&new-version=6.1.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [ora](https://github.com/sindresorhus/ora) from 8.2.0 to 9.4.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/sindresorhus/ora/releases">ora's releases</a>.</em></p> <blockquote> <h2>v9.4.1</h2> <ul> <li>Fix type definitions (<a href="https://redirect.github.com/sindresorhus/ora/issues/257">#257</a>) 431ebc4</li> <li>Fix <code>failText</code> type to accept <code>unknown</code> instead of <code>Error</code>, matching the actual promise rejection value bc3a283</li> </ul> <hr /> <p><a href="https://github.com/sindresorhus/ora/compare/v9.4.0...v9.4.1">https://github.com/sindresorhus/ora/compare/v9.4.0...v9.4.1</a></p> <h2>v9.4.0</h2> <ul> <li>Add <code>successSymbol</code> and <code>failSymbol</code> options to <code>oraPromise</code> 3d2e0a9</li> </ul> <hr /> <p><a href="https://github.com/sindresorhus/ora/compare/v9.3.0...v9.4.0">https://github.com/sindresorhus/ora/compare/v9.3.0...v9.4.0</a></p> <h2>v9.3.0</h2> <ul> <li>Reduce flicker in rendering 2ab4f76</li> </ul> <hr /> <p><a href="https://github.com/sindresorhus/ora/compare/v9.2.0...v9.3.0">https://github.com/sindresorhus/ora/compare/v9.2.0...v9.3.0</a></p> <h2>v9.2.0</h2> <ul> <li>Update <code>stdin-discarder</code> dependency (<a href="https://redirect.github.com/sindresorhus/ora/issues/251">#251</a>) 020eaba</li> </ul> <hr /> <p><a href="https://github.com/sindresorhus/ora/compare/v9.1.0...v9.2.0">https://github.com/sindresorhus/ora/compare/v9.1.0...v9.2.0</a></p> <h2>v9.1.0</h2> <ul> <li>Support external writes to stream (<code>console.log</code>) while spinning d2b543a</li> <li>Replace <code>strip-ansi</code> dependency with native <code>stripVTControlCharacters</code> (<a href="https://redirect.github.com/sindresorhus/ora/issues/249">#249</a>) 68d50e5</li> </ul> <hr /> <p><a href="https://github.com/sindresorhus/ora/compare/v9.0.0...v9.1.0">https://github.com/sindresorhus/ora/compare/v9.0.0...v9.1.0</a></p> <h2>v9.0.0</h2> <h3>Breaking</h3> <ul> <li>Require Node.js 20 7aca06d</li> </ul> <h3>Fixes</h3> <ul> <li>Fix clearing in some cases aa51538</li> <li>Fix <code>frame()</code> not displaying dynamic <code>prefixText</code>/<code>suffixText</code> from functions 0f19f57</li> <li>Fix multiline text exceeding console height leaving garbage when scrolling 45d30ad</li> </ul> <hr />  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/sindresorhus/ora/commit/79cd8c15ac34572cffb3ab53e3d4b6bab6d59ea8"><code>79cd8c1</code></a> 9.4.1</li> <li><a href="https://github.com/sindresorhus/ora/commit/bc3a28363a9873304ffb56420cb55fe83a7f41e8"><code>bc3a283</code></a> Minor tweaks</li> <li><a href="https://github.com/sindresorhus/ora/commit/431ebc40dceb1f700f3b60821f139541dbd7c93d"><code>431ebc4</code></a> Fix type definitions (<a href="https://redirect.github.com/sindresorhus/ora/issues/257">#257</a>)</li> <li><a href="https://github.com/sindresorhus/ora/commit/46a670390249718af7c66452afdc5d78ceb579e9"><code>46a6703</code></a> 9.4.0</li> <li><a href="https://github.com/sindresorhus/ora/commit/3d2e0a907e1141a121e5ed3348d9ea0981ca8a9c"><code>3d2e0a9</code></a> Add <code>successSymbol</code> and <code>failSymbol</code> options to <code>oraPromise</code></li> <li><a href="https://github.com/sindresorhus/ora/commit/f70f613d72f0afb0f4cb0a7fe56268f8abd1a170"><code>f70f613</code></a> Test tweaks</li> <li><a href="https://github.com/sindresorhus/ora/commit/7cf29a75e64409205a6606dada9780ccf5acf6a8"><code>7cf29a7</code></a> Validate some options better</li> <li><a href="https://github.com/sindresorhus/ora/commit/4496362714e1edd414e5347e8d4b337f103f0e15"><code>4496362</code></a> 9.3.0</li> <li><a href="https://github.com/sindresorhus/ora/commit/2ab4f7613879515e29039888115831422f49e1af"><code>2ab4f76</code></a> Reduce flicker in rendering</li> <li><a href="https://github.com/sindresorhus/ora/commit/8d17b13a8b3330af16cfa24c6e3b8a99f678c5c4"><code>8d17b13</code></a> Add FAQ item</li> <li>Additional commits viewable in <a href="https://github.com/sindresorhus/ora/compare/v8.2.0...v9.4.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=ora&package-manager=npm_and_yarn&previous-version=8.2.0&new-version=9.4.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

feat: contractual pivot - schema lifecycle orchestrator (#14)

e011f15

omermorad self-assigned this Mar 12, 2026

omermorad added the next label Mar 12, 2026

omermorad added 4 commits March 15, 2026 00:23

feat: commands major refactor (#16)

91ed06b

fix: remove provenance from packages before publishing to Verdaccio

541f2c6

fix(e2e): use scoped package name for npx commands

2d44ffb

Change `npx contractual` to `npx @contractual/cli` to ensure the correct package is used from the Verdaccio registry instead of an unrelated `contractual` package from npm.

fix(cli): update diff JSON output format to use contracts object

8c6e6cd

Changed JSON output from { results: [...] } to { contracts: { name: {...} } } to match expected format in e2e tests and provide better ergonomics for scripting (e.g., parsed.contracts.order.changes).

omermorad force-pushed the next branch from b864350 to 8c6e6cd Compare March 27, 2026 16:34

omermorad and others added 2 commits March 27, 2026 16:38

chore(*): version packages [skip ci]

a18dcec

- @contractual/changesets@0.1.0-dev.0 - @contractual/cli@0.1.0-dev.0 - @contractual/differs.json-schema@0.1.0-dev.0 - @contractual/governance@0.1.0-dev.0 - @contractual/types@0.1.0-dev.0

fix(governance): use correct openapi-diff version

4963cb0

- Change openapi-diff from ^0.24.1 to ^0.23.7 - Version 0.24.x doesn't exist on npm, latest is 0.23.7 - Fixes npm install errors when using published packages

omermorad force-pushed the next branch from 9effabd to 4963cb0 Compare April 2, 2026 16:56

omermorad and others added 18 commits April 2, 2026 20:00

chore(*): version packages [skip ci]

cb3d62c

- @contractual/cli@0.1.0-dev.1 - @contractual/governance@0.1.0-dev.1

chore(*): version packages [skip ci]

99ad70f

- @contractual/cli@0.1.0-dev.3 - @contractual/differs.openapi@0.1.0-dev.2 - @contractual/governance@0.1.0-dev.3

chore(*): align all packages to 0.1.0-dev.3 [skip ci]

6a8c464

fix(differs.core): add message formatters for composition change types

9a0bfe3

anyOf/oneOf/allOf and conditional schema changes were falling through to the default case, producing "Unknown change" messages in PR comments.

chore(*): version packages [skip ci]

de318c0

- @contractual/cli@0.1.0-next.0 - @contractual/differs.core@0.1.0-next.0 - @contractual/differs.json-schema@0.1.0-next.0 - @contractual/differs.openapi@0.1.0-next.0 - @contractual/governance@0.1.0-next.0

Revert "chore(*): version packages [skip ci]"

6299962

This reverts commit de318c0.

chore(*): version packages [skip ci]

8e6b939

- @contractual/cli@0.1.0-dev.6 - @contractual/differs.core@0.1.0-dev.6 - @contractual/differs.json-schema@0.1.0-dev.6 - @contractual/differs.openapi@0.1.0-dev.6 - @contractual/governance@0.1.0-dev.6

fix(differs.core): decode JSON Pointer segments individually to avoid…

2d599e0

… double slashes OpenAPI path keys like /v1/extract were producing //v1/extract in changeset output. Decode per-segment and bracket keys containing slashes.

chore(*): version packages [skip ci]

03684be

- @contractual/cli@0.1.0-dev.7 - @contractual/differs.core@0.1.0-dev.7 - @contractual/differs.json-schema@0.1.0-dev.7 - @contractual/differs.openapi@0.1.0-dev.7 - @contractual/governance@0.1.0-dev.7

omermorad force-pushed the next branch from d2b6a8a to db5231b Compare June 18, 2026 12:31

chore(*): version packages [skip ci]

53d3a39

- @contractual/changesets@0.1.0-dev.6 - @contractual/cli@0.1.0-dev.8

github-advanced-security Bot found potential problems Sep 29, 2026

View reviewed changes

Comment thread .github/workflows/release-preview.yml Fixed

Comment thread .github/workflows/release-preview.yml Fixed

github-advanced-security Bot found potential problems Sep 29, 2026

View reviewed changes

Comment thread packages/governance/linters/json-schema-ajv.ts Fixed

omermorad mentioned this pull request Sep 29, 2026

fix(*): address security findings on next #19

Merged

omermorad and others added 8 commits September 29, 2026 09:12

fix(*): address security findings on next (#19)

2466cd3

fix(*): prepare next workflow and release safeguards (#17)

361ad40

fix(*): remediate dependency and code scanning vulnerabilities (#18)

ee6d9a3

Navigation Menu

contractual next version - #15

contractual next version#15
omermorad wants to merge 34 commits into
masterfrom
next

omermorad commented Mar 12, 2026

Uh oh!

qballer commented Jun 18, 2026

Uh oh!

github-advanced-security AI commented Sep 29, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

omermorad commented Mar 12, 2026

Uh oh!

qballer commented Jun 18, 2026

Uh oh!

github-advanced-security AI commented Sep 29, 2026

What Enabling Code Scanning Means:

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants