Bump the npm-prod group across 1 directory with 13 updates

[dependabot]

Bumps the npm-prod group with 13 updates in the / directory:

Package	From	To
@isaacs/ttlcache	1.4.1	2.1.5
@smooai/fetch	3.4.0	3.6.2
@smooai/logger	4.3.0	4.5.4
@standard-schema/spec	1.0.0	1.1.0
arktype	2.1.20	2.2.3
commander	13.1.0	15.0.0
empathic	1.1.0	2.0.1
esm-utils	4.3.0	4.4.2
jiti	2.6.1	2.7.0
json-schema-to-zod	2.6.1	2.8.1
lru-cache	11.1.0	11.5.2
synckit	0.11.12	0.11.13
tsx	4.19.4	4.23.12

Updates @isaacs/ttlcache from 1.4.1 to 2.1.5

Changelog

Sourced from @​isaacs/ttlcache's changelog.

2.1

• Add updateAgeOnHas and checkAgeOnHas options to match corresponding get() options.
• Include items with Infinity expirations in iterations like entries(), keys(), values().

2.0

• refactor as hybrid typescript module (changes export)
• Blue Oak license

1.4

• add checkAgeOnGet option
• Guard against expiration list going missing

1.3.0

• make cache.cancelTimer a public method
• Reduce memory usage by only creating one timer

1.2

• Add support for immortality
• ensure dispose() only happens after full removal
• Clear timeouts so we don't rely on only unref()
• fix error when deleting immortal entries

1.1

• Add setTTL(key, ttl)
• avoid off-by-1ms purge failures

1.0

• Initial release

Commits

• 5e4ccd2 2.1.5
• 5e4a669 Fix named import in README
• 84fa4c8 update project stuff
• 1476f92 2.1.4
• e101894 stack timers for long TTLs
• fe12fe3 move configs out of package.json to config files
• 4d5e71d 2.1.3
• 93bff3b Fix syntax typo in README example
• 6e15c53 2.1.2
• cbfdbd5 correct test name, use t.clock for regularity
• Additional commits viewable in compare view

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Updates @smooai/fetch from 3.4.0 to 3.6.2

Release notes

Sourced from @​smooai/fetch's releases.

v3.6.2

Patch Changes

• 8781ce8: Two places where a green result meant nothing.

  The Go test lane ran go test without -count=1. Go's test cache does not invalidate on a fixture read from outside the package directory, and the connect-timeout suite loads spec/connect-timeout-corpus.json from the repo root — so a deliberately corrupted corpus still returned ok (cached).

  The release workflow gated the PyPI, crates.io, Go-tag and NuGet publishes on steps.changesets.outputs.published == 'true' — i.e. on the npm publish succeeding in that same run. A run dying after npm left the follow-up run with no changesets to consume, published == 'false', every remaining step skipped, and a green check for a release that published nothing. Those steps now gate on being a publish run and are individually idempotent, a concurrency group stops the workflow racing itself, and a final step fails the run if the released version is not live on npm, PyPI, crates.io and the Go tag.

v3.6.1

Patch Changes

• 1b26e3f: The Rust SlidingWindowRateLimiter no longer reports remaining_ms: 0 when it rejects a request. Duration::as_millis truncates, so any sub-millisecond remainder came back as exactly zero — an error telling the caller to wait no time at all while refusing to serve them, which makes a caller that honors remaining_ms spin on the window boundary. It now rounds up to the next whole millisecond, and acquire()'s compensating + 1 is gone.

v3.6.0

Minor Changes

• 193b1e8: The Go port gains a real response-validation entry point: RequestOptions.Validate func(data any) []string. Returning messages fails the request with a *SchemaValidationError carrying them, which DefaultRetryOptions already treats as non-retryable. Until now SchemaValidationError was a type the package defined, documented as "returned when response body validation fails", and never constructed — and the README's language matrix promised callers would get one. Go has no Standard Schema equivalent, so this is the seam rather than a bundled validator. Leaving Validate unset is behavior-identical.

Patch Changes

• 932f253: The Rust crate smooai-fetch now uses rustls instead of native-tls. reqwest's default-tls pulled in openssl-sys, which needs a system OpenSSL and its headers at build time — a cross-compile and container-image hazard for a library consumed across the platform. openssl-sys and native-tls are gone from the lockfile. http2 and charset are re-enabled explicitly, because disabling reqwest's default features would otherwise have silently downgraded every consumer to HTTP/1.1.

v3.5.1

Patch Changes

• cd9f9ed: CI runs one job per language instead of a single serial validate job, so a failure in one port no longer hides the verdict of the other four. Two test-visibility gaps closed alongside it: vitest --passWithNoTests is gone (an empty TypeScript suite went green), and the Rust lane now runs --all-features, which is what actually compiles tests/trace_propagation_tests.rs — three real trace-propagation tests sat behind #![cfg(feature = "otel")] and reported "0 passed; ok" to a bare cargo test.

v3.5.0

Minor Changes

• a5434b0: Add an optional, default-off connect timeout to all five ports. It bounds only the connection-establishment phase, so a black-holed connect — a SYN to a dead pod IP still lingering in a ClusterIP's iptables — fails in ~that window and the configured retry can land on a live endpoint, instead of stalling until the whole-request timeout. Slow-but-alive handlers are unaffected, and leaving it unset preserves the previous behavior exactly.

  • TypeScript: connectTimeoutMs / FetchBuilder.withConnectTimeout(ms). Node only, via an undici Agent dispatcher; undici is an optional peer dependency, imported lazily and only when a connect timeout is requested. Ignored in browser/worker builds, which expose no such knob.
  • Python: TimeoutOptions(connect_timeout_ms=...), mapped to httpx.Timeout(connect=...).
  • Rust: FetchOptions::connect_timeout_ms / FetchBuilder::with_connect_timeout, mapped to reqwest's connect_timeout.
  • Go: ClientBuilder.WithConnectTimeout(d), applied to a cloned default transport's dialer. A caller-supplied *http.Client is left untouched.
  • .NET: SmooFetchOptions.ConnectTimeout / SmooFetchBuilder.WithConnectTimeout(ts), mapped to SocketsHttpHandler.ConnectTimeout. Not applied to IHttpClientFactory-owned handlers, which own their own handler.

  All five regression tests read their knobs from spec/connect-timeout-corpus.json so the timing thresholds cannot drift apart per language.

Patch Changes

• 5c8c71e: Drop two runtime dependencies from the published package.

  @faker-js/faker — a test-data generator — was a runtime dependency, imported at module load, solely to build cosmetic names for the internal mollitia modules (smooai-fetch-retry-blue-cat). Those names only need to be unique within the process, so they come from a counter now.

  @standard-schema/utils was declared but never imported by anything in src/; it reaches this package transitively through @smooai/utils, which declares it itself.

  The remaining runtime dependencies (mollitia, lodash.merge, @smooai/logger, @smooai/utils, @standard-schema/spec) are each load-bearing and stay.

... (truncated)

Changelog

Sourced from @​smooai/fetch's changelog.

3.6.2

Patch Changes

• 8781ce8: Two places where a green result meant nothing.

  The Go test lane ran go test without -count=1. Go's test cache does not invalidate on a fixture read from outside the package directory, and the connect-timeout suite loads spec/connect-timeout-corpus.json from the repo root — so a deliberately corrupted corpus still returned ok (cached).

  The release workflow gated the PyPI, crates.io, Go-tag and NuGet publishes on steps.changesets.outputs.published == 'true' — i.e. on the npm publish succeeding in that same run. A run dying after npm left the follow-up run with no changesets to consume, published == 'false', every remaining step skipped, and a green check for a release that published nothing. Those steps now gate on being a publish run and are individually idempotent, a concurrency group stops the workflow racing itself, and a final step fails the run if the released version is not live on npm, PyPI, crates.io and the Go tag.

3.6.1

Patch Changes

• 1b26e3f: The Rust SlidingWindowRateLimiter no longer reports remaining_ms: 0 when it rejects a request. Duration::as_millis truncates, so any sub-millisecond remainder came back as exactly zero — an error telling the caller to wait no time at all while refusing to serve them, which makes a caller that honors remaining_ms spin on the window boundary. It now rounds up to the next whole millisecond, and acquire()'s compensating + 1 is gone.

3.6.0

Minor Changes

• 193b1e8: The Go port gains a real response-validation entry point: RequestOptions.Validate func(data any) []string. Returning messages fails the request with a *SchemaValidationError carrying them, which DefaultRetryOptions already treats as non-retryable. Until now SchemaValidationError was a type the package defined, documented as "returned when response body validation fails", and never constructed — and the README's language matrix promised callers would get one. Go has no Standard Schema equivalent, so this is the seam rather than a bundled validator. Leaving Validate unset is behavior-identical.

Patch Changes

• 932f253: The Rust crate smooai-fetch now uses rustls instead of native-tls. reqwest's default-tls pulled in openssl-sys, which needs a system OpenSSL and its headers at build time — a cross-compile and container-image hazard for a library consumed across the platform. openssl-sys and native-tls are gone from the lockfile. http2 and charset are re-enabled explicitly, because disabling reqwest's default features would otherwise have silently downgraded every consumer to HTTP/1.1.

3.5.1

Patch Changes

• cd9f9ed: CI runs one job per language instead of a single serial validate job, so a failure in one port no longer hides the verdict of the other four. Two test-visibility gaps closed alongside it: vitest --passWithNoTests is gone (an empty TypeScript suite went green), and the Rust lane now runs --all-features, which is what actually compiles tests/trace_propagation_tests.rs — three real trace-propagation tests sat behind #![cfg(feature = "otel")] and reported "0 passed; ok" to a bare cargo test.

3.5.0

Minor Changes

• a5434b0: Add an optional, default-off connect timeout to all five ports. It bounds only the connection-establishment phase, so a black-holed connect — a SYN to a dead pod IP still lingering in a ClusterIP's iptables — fails in ~that window and the configured retry can land on a live endpoint, instead of stalling until the whole-request timeout. Slow-but-alive handlers are unaffected, and leaving it unset preserves the previous behavior exactly.

  • TypeScript: connectTimeoutMs / FetchBuilder.withConnectTimeout(ms). Node only, via an undici Agent dispatcher; undici is an optional peer dependency, imported lazily and only when a connect timeout is requested. Ignored in browser/worker builds, which expose no such knob.
  • Python: TimeoutOptions(connect_timeout_ms=...), mapped to httpx.Timeout(connect=...).
  • Rust: FetchOptions::connect_timeout_ms / FetchBuilder::with_connect_timeout, mapped to reqwest's connect_timeout.
  • Go: ClientBuilder.WithConnectTimeout(d), applied to a cloned default transport's dialer. A caller-supplied *http.Client is left untouched.
  • .NET: SmooFetchOptions.ConnectTimeout / SmooFetchBuilder.WithConnectTimeout(ts), mapped to SocketsHttpHandler.ConnectTimeout. Not applied to IHttpClientFactory-owned handlers, which own their own handler.

  All five regression tests read their knobs from spec/connect-timeout-corpus.json so the timing thresholds cannot drift apart per language.

Patch Changes

• 5c8c71e: Drop two runtime dependencies from the published package.

  @faker-js/faker — a test-data generator — was a runtime dependency, imported at module load, solely to build cosmetic names for the internal mollitia modules (smooai-fetch-retry-blue-cat). Those names only need to be unique within the process, so they come from a counter now.

... (truncated)

Commits

• 5c7c733 🦋 New version release (#115)
• 8781ce8 Two green signals that meant nothing: Go's test cache, and the publish gate (...
• 20c62f1 🦋 New version release (#113)
• 1b26e3f Stop the rate limiter reporting "0ms remaining" while rejecting (#112)
• 75e4cc6 🦋 New version release (#111)
• 193b1e8 Give Go's SchemaValidationError something that actually produces it (#108)
• 932f253 SMOODEV-2032: Rust smooai-fetch uses rustls, not native-tls (#105)
• 1e7bb97 🦋 New version release (#110)
• cd9f9ed Split CI into per-language jobs, and make two silent suites report (#106)
• 1c7301a 🦋 New version release (#109)
• Additional commits viewable in compare view

Updates @smooai/logger from 4.3.0 to 4.5.4

Release notes

Sourced from @​smooai/logger's releases.

v4.5.4

Patch Changes

• 96efa6b: Bump uuid to ^11.1.1, gate each registry publish on that registry, and stop Go caching the parity corpus.
  • uuid 9.0.1 → 11.1.1. The moderate advisory (missing buffer bounds check in v3/v5/v6 when buf is provided) is not reachable here — logger only ever calls v4() with no arguments — but every consumer of @smooai/logger was inheriting the advisory and having to carry its own pnpm.overrides pin. Fixed at the source instead. @types/uuid dropped; uuid 11 ships its own.
  • Publish steps no longer gate on steps.changesets.outputs.published. That output is true only when the publish command shipped something in that run, so a run that died after npm left the other four behind — and the follow-up run, with no changesets left, reported published=false, skipped all four, and went green having published nothing. That is exactly how 4.5.1 and 4.5.2 stranded crates.io, NuGet and the Go tag at 4.5.0. Each step now asks its own registry whether the version is already there, which also lets a re-run heal a partial release.
  • go:test gains -count=1. Go currently refuses to cache parity_corpus_test.go because it reads ../parity-corpus.json from outside the package dir — verified — but a parity guarantee should not rest on that.

v4.5.3

Patch Changes

• be2b735: Commit the repo's formatting and stop the release pipeline from dirtying its own working tree.

  Dropping cargo publish --allow-dirty surfaced what the flag had been hiding: release.yml's own Format step ran pnpm format, which rewrites files and never commits them, so cargo publish a few steps later saw a dirty tree. Every crate published from this repo silently carried uncommitted reformatting.

  main was format-drifted across seven files with nothing checking — PR checks ran oxlint but never a formatter, and pnpm format:check did not exist.

  • The formatting is committed; pnpm format is now a no-op on main.
  • New format:check (oxfmt + ruff + cargo fmt + gofmt) runs in PR checks.
  • release.yml's Format becomes Format check — check, never rewrite.
  • The changesets version lifecycle now ends with oxfmt --write CHANGELOG.md package.json, because changeset version emits both in a shape oxfmt disagrees with; without it the next release PR would land unformatted and break cargo publish --locked again.

  This release also re-publishes to crates.io, NuGet, and the Go module tag, which stalled at 4.5.0 while npm and PyPI went to 4.5.2.

v4.5.2

Patch Changes

• ad58fce: Sync non-npm manifest versions during the version bump instead of after publish, and guard it.

  ci:publish ran pnpm build && changeset publish && pnpm version:sync — the sync happened after the publish, mutating manifests in the CI workspace that were then thrown away. So every git tag shipped stale version constants, and cargo publish --allow-dirty existed only to paper over the dirt. With 4.4.0 published on npm, the repo was carrying 3.2.3 in python/pyproject.toml, python/uv.lock and go/version.go, 3.1.2 in rust/logger/Cargo.toml

... (truncated)

Changelog

Sourced from @​smooai/logger's changelog.

4.5.4

Patch Changes

• 96efa6b: Bump uuid to ^11.1.1, gate each registry publish on that registry, and stop Go caching the parity corpus.
  • uuid 9.0.1 → 11.1.1. The moderate advisory (missing buffer bounds check in v3/v5/v6 when buf is provided) is not reachable here — logger only ever calls v4() with no arguments — but every consumer of @smooai/logger was inheriting the advisory and having to carry its own pnpm.overrides pin. Fixed at the source instead. @types/uuid dropped; uuid 11 ships its own.
  • Publish steps no longer gate on steps.changesets.outputs.published. That output is true only when the publish command shipped something in that run, so a run that died after npm left the other four behind — and the follow-up run, with no changesets left, reported published=false, skipped all four, and went green having published nothing. That is exactly how 4.5.1 and 4.5.2 stranded crates.io, NuGet and the Go tag at 4.5.0. Each step now asks its own registry whether the version is already there, which also lets a re-run heal a partial release.
  • go:test gains -count=1. Go currently refuses to cache parity_corpus_test.go because it reads ../parity-corpus.json from outside the package dir — verified — but a parity guarantee should not rest on that.

4.5.3

Patch Changes

• be2b735: Commit the repo's formatting and stop the release pipeline from dirtying its own working tree.

  Dropping cargo publish --allow-dirty surfaced what the flag had been hiding: release.yml's own Format step ran pnpm format, which rewrites files and never commits them, so cargo publish a few steps later saw a dirty tree. Every crate published from this repo silently carried uncommitted reformatting.

  main was format-drifted across seven files with nothing checking — PR checks ran oxlint but never a formatter, and pnpm format:check did not exist.

  • The formatting is committed; pnpm format is now a no-op on main.
  • New format:check (oxfmt + ruff + cargo fmt + gofmt) runs in PR checks.
  • release.yml's Format becomes Format check — check, never rewrite.
  • The changesets version lifecycle now ends with oxfmt --write CHANGELOG.md package.json, because changeset version emits both in a shape oxfmt disagrees with; without it the next release PR would land unformatted and break cargo publish --locked again.

  This release also re-publishes to crates.io, NuGet, and the Go module tag, which stalled at 4.5.0 while npm and PyPI went to 4.5.2.

4.5.2

Patch Changes

• ad58fce: Sync non-npm manifest versions during the version bump instead of after publish, and guard it.

  ci:publish ran pnpm build && changeset publish && pnpm version:sync — the sync happened after the publish, mutating manifests in the CI workspace that were then thrown away. So every

... (truncated)

Commits

• 7da6390 🦋 New version release (#195)
• 96efa6b Bump uuid, gate publishes per-registry, and stop Go caching the corpus (#194)
• 0ae6414 🦋 New version release (#193)
• be2b735 Commit the formatting, and stop the release from dirtying its own tree (#192)
• 3da9740 Stop the release reporting failure when the changeset PR is already green (#191)
• 6a96863 🦋 New version release (#190)
• 83fdb83 Sync the non-npm manifests to 4.5.1 (one-time, unblocks the release) (#189)
• 1301d0b 🦋 New version release (#188)
• ad58fce Sync manifest versions during the bump, not after publish, and guard it (#186)
• cb917c2 Make the parity corpus real: five loaders, and a Python drift it caught (#183)
• Additional commits viewable in compare view

Updates @standard-schema/spec from 1.0.0 to 1.1.0

Release notes

Sourced from @​standard-schema/spec's releases.

v1.1.0

Adds the Standard JSON Schema specification.

Please refer to the README and standardschema.dev for more details.

Commits

• 2c4e37f Merge pull request #134 from standard-schema/json-schema
• 395ee95 Add json-integrate
• 1a5ccf3 Improve json-integrate
• 1dbb6d2 Improve docs
• b081dbb Update site
• 87bc20f Add pullfrog.yml workflow
• 3a1b9ea Add examples table
• f16ef72 Update website
• ea2436d Update JSON Schema compatibility table with Valibot details
• 727c24a update arktype implementation version and pr
• Additional commits viewable in compare view

Updates arktype from 2.1.20 to 2.2.3

Changelog

Sourced from arktype's changelog.

2.2.3

Fix type.fn.raw throwing at runtime

type.fn.raw is documented as an untyped alias of type.fn, but was undefined at runtime and threw type.fn.raw is not a function when called. It now references the underlying parser directly, so it parses, runs, and validates like type.fn without type-level inference. Thanks to @​aarsh767.

Anchor versioned UUID validation

string.uuid no longer accepts strings that merely contain a UUID. The internal #versioned pattern is now anchored like the individual version keywords, so leading or trailing content is rejected. Thanks to @​WolfieLeader.

Fix inferred output of declared morphs

The output side of a declared definition now wraps its preinferred value in Out<...>, matching the inference of the equivalent definition without declare. Thanks to @​eralmansouri.

Allow Object.prototype method names as keys

Keys like constructor, toString, and hasOwnProperty are no longer incorrectly reported as duplicate keys, since duplicate detection now uses a prototype-free record. Thanks to @​kaigritun.

2.2.2

Fix precompilation of private aliases

A private alias referenced only within its own scope is no longer skipped during JIT precompilation, so its optimized traversal is bound correctly instead of falling back to the unbound reference.

Harden ArkErrors JSON serialization

ArkErrors doubles as a Standard Schema issues array, so JSON.stringify no longer assumes every indexed entry is an ArkError with a toJSON method (e.g. plain issue-shaped entries from other validators). Inherited array methods (map, filter, slice, …) now return a plain Array via Symbol.species, preventing callbacks that return primitives from producing a malformed ArkErrors.

2.2.1

Improve regex inference for zero-min quantifiers on numeric patterns

// was: Regex<`${number}`>
// now: Regex<"" | `${number}`>
regex("^\\d*$")

See arkregex CHANGELOG for full notes.

2.2.0

Full announcement: https://arktype.io/docs/blog/2.2

type.fn - Validated functions

Define functions with runtime-validated parameters and return types. Supports defaults, optionals, and variadics.

const len = type.fn("string | unknown[]", ":", "number")(s => s.length)
</tr></table> 

... (truncated)

Commits

• 03b1f01 release: arktype 2.2.3 + dependents (#1635)
• eb93f33 fix: allow prototype method names as object keys (#1586)
• f067dbf fix declare type issue (#1578) (#1579)
• b18db2c fix(type): anchor UUID #versioned regex to reject partial matches (#1602)
• 07a9e9c fix(type): wire up type.fn.raw at runtime (#1631)
• ab66f64 release: arktype 2.2.2 + dependents (#1633)
• 11e2e49 fix private alias precompilation (#1632)
• d0c43a9 refactor(repo): drop tsx, rely on native Node type stripping (#1620)
• 93cb501 release: arkregex 0.0.6 + dependents; publish @​ark/fast-check
• 3ad19d5 2.2.0 (#1594)
• Additional commits viewable in compare view

Updates commander from 13.1.0 to 15.0.0

Release notes

Sourced from commander's releases.

v15.0.0

Commander 15 is ESM only. This is expected to be seamless for ESM consumers, but some CommonJS consumers may hit issues with tooling requiring configuration for ESM-only dependencies. See Migration Tips below.

The release of Commander 15 moves Commander 14 into maintenance. Commander 14 will get security updates for 12 months (to May 2027). For more info see Release Policy.

Added

• show excess command-arguments in error message (#2384)

Fixed

• Breaking: only lone --no-* option sets default option value to true, default not implicitly set when define both positive and negative option in either order (#2405)
• update example to use compatible character for MINGW64 (#2475)

Changed

• Breaking: migrated Commander implementation from CommonJS to ESM (#2464)
• Breaking: Commander 15 requires Node.js v22.12.0 or higher (for require(esm)).
• dev: switch tests from Jest to node:test test runner (#2463)

Deleted

• Breaking: removed deprecated export of commander/esm.mjs (#2464)

Migration Tips

Commander 15 is ESM only, but this does not mean you need to migrate to ESM to use it. Importing ESM from CommonJS is supported by Node.js, and Bun, and Deno. Hopefully it Just Works for you! However, you may be using a different runtime or some other part of your setup that may not yet natively support importing ESM from CommonJS, such as your testing framework or bundler.

If you have problems using Commander 15 in your environment, one option is stay on Commander 14 for now. Commander 14 will get security updates until May 2027 and things will hopefully improve for your setup in the meantime.

v15.0.0-0

Commander 15 is ESM only. This is expected to be seamless for ESM consumers, but some CommonJS consumers may hit issues with tooling requiring configuration for ESM-only dependencies. See Migration Tips below.

The release of Commander 15 in May 2026 will move Commander 14 into maintenance. Commander 14 will get security updates for 12 months (to May 2027). For more info see Release Policy.

Added

• show excess command-arguments in error message (#2384)

Fixed

• Breaking: only lone --no-* option sets default option value to true, default not implicitly set when define both positive and negative option in either order (#2405)
• update example to use compatible character for MINGW64 (#2475)

... (truncated)

Changelog

Sourced from commander's changelog.

[15.0.0] (2026-05-29)

Commander 15 is ESM only. This is expected to be seamless for ESM consumers, but some CommonJS consumers may hit issues with tooling requiring configuration for ESM-only dependencies. See Migration Tips below.

The release of Commander 15 moves Commander 14 into maintenance. Commander 14 will get security updates for 12 months (to May 2027). For more info see Release Policy.

Added

• show excess command-arguments in error message (#2384)

Fixed

• Breaking: only lone --no-* option sets default option value to true, default not implicitly set when define both positive and negative option in either order (#2405)
• update example to use compatible character for MINGW64 (#2475)

Changed

• Breaking: migrated Commander implementation from CommonJS to ESM (#2464)
• Breaking: Commander 15 requires Node.js v22.12.0 or higher (for require(esm)).
• dev: switch tests from Jest to node:test test runner (#2463)

Deleted

• Breaking: removed deprecated export of commander/esm.mjs (#2464)

Migration Tips

Commander 15 is ESM only, but this does not mean you need to migrate to ESM to use it. Importing ESM from CommonJS is supported by Node.js, and Bun, and Deno. Hopefully it Just Works for you! However, you may be using a different runtime or some other part of your setup that may not yet natively support importing ESM from CommonJS, such as your testing framework or bundler.

If you have problems using Commander 15 in your environment, one option is stay on Commander 14 for now. Commander 14 will get security updates until May 2027 and things will hopefully improve for your setup in the meantime.

[15.0.0-0] (2026-02-22)

(Released as 15.0.0)

[14.0.3] (2026-01-31)

Added

• Release Policy document (#2462)

Changes

• old major versions now supported for 12 months instead of just previous major version, to give predictable end-of-life date (#2462)
• clarify typing for deprecated callback parameter to .outputHelp() (#2427)

... (truncated)

Commits

• ba6d13d Fix release dates in changelog (#2523)
• a752ed9 Pin GitHub actions with hash (#2521)
• 74d5dfe Drop EOL node 20 from test matrix, and add node 26 (#2520)
• 6df9b68 Update details for 15.0.0 release (#2519)
• 01ce5d0 Remove jest esm examples (#2517)
• d785d8b Update dependencies (#2518)
• 9098b48 Update dependencies (#2506)
• 373f660 Use node:util stripVTControlCharacters instead of own code (#2486)
• 987f289 Use simple match in test (to avoid warning about expensive regex) (#2485)
• 0ea3bb3 Update dependecies and lint (#2489)
• Additional commits viewable in compare view

Updates empathic from 1.1.0 to 2.0.1

Release notes

Sourced from empathic's releases.

v2.0.0

Breaking

• Replaced options.stop (which was exclusive) with options.last (now inclusive): 4076495

  Note: Applies to all exports within empathic/find, empathic/package, and empathic/walk.

Features

• Add find.file() and find.dir() exports: bbe9b42, b441e3b

Chores

• bump oxc versions: 79c3e72, 2b8ca36

---

Full Changelog: lukeed/empathic@v1.1.0...v2.0.0

Commits

• 71fff27 2.0.1
• 410cbe7 fix: add ESM types (#11)
• f77a45a chore(ci): setup npm trusted publishing (#13)
• f5f944a 2.0.0
• 535b41e 2.0.0-next.0
• b441e3b chore: update find.dir fixture
• bbe9b42 feat: add find.file and find.dir exports
• 2b8ca36 chore: regen lockfile
• 79c3e72 chore: bump oxc versions
• 4076495 break: replace options.stop (exclusive) with options.last (inclusive)
• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for empathic since your current version.

Updates esm-utils from 4.3.0 to 4.4.2

Release notes

Sourced from esm-utils's releases.

Release 4.4.2

• Avoid using ??= (de48b32)

Release 4.4.1

What's Changed

• Update dependencies (9d9b018)

Full Changelog: fisker/esm-utils@v4.3.0...v4.4.1

Commits

• 161d53f chore: release v4.4.2
• de48b32 Avoid using ??=
• 1bea617 chore: release v4.4.1
• cc09925 Make ESLint happy
• f3c3d85 Update scripts
• 9d9b018 Update dependencies
• ae95495 chore(deps): update dependency prettier to v3.5.3 (#579)
• ef2d9b4 chore(deps): update dependency sort-package-json to v2.15.1 (#578)
• 621350d chore(deps): update dependency sort-package-json to v2.15.0 (#577)
• f0908d1 chore(deps): update dependency prettier to v3.5.2 (#576)
• Additional commits viewable in compare view

Updates jiti from 2.6.1 to 2.7.0

Release notes

Sourced from jiti's releases.

v2.7.0

compare changes

🚀 Enhancements

• Add explicit resource management (using/await using) support (#422)
• Support opt-in tsconfigPaths (#427)
• Support virtual modules (#428)
• Add jiti/static subpath (#430)

🔥 Performance

• interopDefault: Add caching to reduce proxy overhead by ~2x (#421)

🩹 Fixes

• require: Passthrough resolve options (#412)
• require: Fallback to transpilation when tryNative fails (#413)
• Fallback for ENAMETOOLONG when evaluating esm (#429)

📦 Build

• Upgrade rspack to v2 (55194fb)
• Experimental rolldown config (8c0243f)

✅ Tests

• Ignore jsx test for bun/cjs (3a744ca)

❤️ Contributors

• Pooya Parsa (@​pi0)
• Kricsleo (@​kricsleo)
• Espen Hovlandsdal (@​rexxars)
• Rintaro Itokawa (@​re-taro)
• Matteo Collina (@​mcollina)
• Mario Zechner (@​badlogic)

Changelog

Sourced from jiti's changelog.

v2.7.0

compare changes

🚀 Enhancements

• Add explicit resource management (using/await using) support (#422)
• Support opt-in tsconfigPaths (#427)
• Support virtual modules option (#428)
• Add jiti/static export (#430)

🔥 Performance

• interopDefault: Add caching to reduce proxy overhead by ~2x (#421)

🩹 Fixes

• require: Passthrough resolve options (#412)
• ci: Skip --coverage flag for node 18 (fe264b4)
• require: Fallback to transpilation when tryNative fails (#413)
• Fallback for ENAMETOOLONG when evaluating esm (#429)

📦 Build

• Upgrade rspack (55194fb)
• Experimental rolldown config (8c0243f)

🏡 Chore

• Fix lint issues (4045c7a)
• Update deps (e88ac44)
• Update deps (498e8d7)
• Add missing prettier dep (650bc48)
• Lint (058d91a)
• Init agents.md (c49c54e)
• Update agents.md (4deba16)
• Update deps (08fc868)
• Update tsconfig (8c7822e)
• Update release script (27fe3f2)

✅ Tests

• Ignore jsx test for bun/cjs (3a744ca)
• Update (9ee314f)

🤖 CI

• Update node test matrix (0abda72)

❤️ Contributors

... (truncated)

Commits

• fd3bb28 chore(release): v2.7.0
• 27fe3f2 chore: update release script
• 4fcd2f2 fix: fallback for ENAMETOOLONG when evaluating esm (#429)
• 8c0243f build: experimental rolldown config
• 55194fb build: upgrade rspack
• 0abda72 ci: update node test matrix
• 8c7822e chore: update tsconfig
• 08fc868 chore: update deps
• 5d552e3 feat: add jiti/static export (#430)
• ae790b0 feat: support virtual modules option (#428)
• Additional commits viewable in compare view

Updates json-schema-to-zod from 2.6.1 to 2.8.1

Commits

• See full diff in compare view

Updates lru-cache from 11.1.0 to 11.5.2

Changelog

Sourced from lru-cache's changelog.

cringe lorg

11.5

• Add backgroundFetchSize option, defaulting to 1, to set an effective size for provisional background fetch objects while in flight, if they do not shadow an existing stale entry.

11.4

• Add cache property to status objects, in order to differentiate which cache is emitting the metric or trace.
• Several small bugs regarding fetch behavior edge cases.
  • onInsert does not fire for background fetch internal promises.
  • dispose() and disposeAfter() now fire for the stale value left behind when an in-process background fetch is pre-empted by eviction.
  • fetchMethod that returns a non-Promise value is handled correctly.
  • No Error is created, or abort() signaled, when a background fetch promise is resolved. (Presumably the implementation is done by that point.)

11.3

• Add observability features, expand the coverage of LRUCache.Status objects.

11.2

• Add the perf option to specify performance, Date, or any other object with a now() method that returns a number.

11.1

• Add the onInsert method

11.0

• Drop support for node less than v20

10.4

• Accidental minor update, should've been patch.

10.3

• add forceFetch() method
• set disposeReason to 'expire' when it's the result of a TTL

... (truncated)

Commits

• 16b3a91 11.5.2
• 0b0a77e fire autopurge again if the first time isn't stale
• cd98065 11.5.1
• 281f49d work with exactOptionalPropertyTypes

[changeset-bot]

⚠️ No Changeset found

Latest commit: 9e52a8b

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR