chore(deps): update all non-major dependencies (#64)

This PR contains the following updates:

| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [oxfmt](https://oxc.rs/docs/guide/usage/formatter) ([source](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt)) | [`0.60.0` → `0.61.0`](https://renovatebot.com/diffs/npm/oxfmt/0.60.0/0.61.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/oxfmt/0.61.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/oxfmt/0.60.0/0.61.0?slim=true) |
| [rolldown](https://rolldown.rs/) ([source](https://github.com/rolldown/rolldown/tree/HEAD/packages/rolldown)) | [`1.2.0` → `1.2.1`](https://renovatebot.com/diffs/npm/rolldown/1.2.0/1.2.1) | ![age](https://developer.mend.io/api/mc/badges/age/npm/rolldown/1.2.1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/rolldown/1.2.0/1.2.1?slim=true) |

---

### Release Notes

<details>
<summary>oxc-project/oxc (oxfmt)</summary>

### [`v0.61.0`](https://github.com/oxc-project/oxc/compare/oxfmt_v0.60.0...oxfmt_v0.61.0)

[Compare Source](https://github.com/oxc-project/oxc/compare/oxfmt_v0.60.0...oxfmt_v0.61.0)

</details>

<details>
<summary>rolldown/rolldown (rolldown)</summary>

### [`v1.2.1`](https://github.com/rolldown/rolldown/blob/HEAD/CHANGELOG.md#121---2026-07-29)

[Compare Source](https://github.com/rolldown/rolldown/compare/v1.2.0...v1.2.1)

##### 🚀 Features

- dev: support `hotUpdate` hook ([#&#8203;10305](https://github.com/rolldown/rolldown/issues/10305)) by [@&#8203;h-a-n-a](https://github.com/h-a-n-a)
- dev: expose `disableWatcher` through the dev engine bindings ([#&#8203;10474](https://github.com/rolldown/rolldown/issues/10474)) by [@&#8203;shulaoda](https://github.com/shulaoda)
- plugin: surface output-option callbacks in \[PLUGIN\_TIMINGS] ([#&#8203;10411](https://github.com/rolldown/rolldown/issues/10411)) by [@&#8203;IWANABETHATGUY](https://github.com/IWANABETHATGUY)
- `import.meta.ROLLDOWN_FILE_URL_<referenceId>_<urlId>` support to pass context to `resolveFileUrl` hook ([#&#8203;10297](https://github.com/rolldown/rolldown/issues/10297)) by [@&#8203;sapphi-red](https://github.com/sapphi-red)
- dev: skip the HMR update when a module's rebuilt output is unchanged ([#&#8203;10333](https://github.com/rolldown/rolldown/issues/10333)) by [@&#8203;h-a-n-a](https://github.com/h-a-n-a)
- code-splitting: wrap strict execution order modules on demand ([#&#8203;10104](https://github.com/rolldown/rolldown/issues/10104)) by [@&#8203;hyfdev](https://github.com/hyfdev)
- support `import.meta.ROLLDOWN_FILE_URL_*` ([#&#8203;10296](https://github.com/rolldown/rolldown/issues/10296)) by [@&#8203;sapphi-red](https://github.com/sapphi-red)
- implement `resolveFileUrl` plugin hook ([#&#8203;10291](https://github.com/rolldown/rolldown/issues/10291)) by [@&#8203;sapphi-red](https://github.com/sapphi-red)
- magic-string: support storeName on overwrite/update ([#&#8203;10312](https://github.com/rolldown/rolldown/issues/10312)) by [@&#8203;IWANABETHATGUY](https://github.com/IWANABETHATGUY)

##### 🐛 Bug Fixes

- external: keep `__toESM` when the importing module is tree-shaken ([#&#8203;10516](https://github.com/rolldown/rolldown/issues/10516)) by [@&#8203;IWANABETHATGUY](https://github.com/IWANABETHATGUY)
- dev: resolve re-exports from externals through a real import ([#&#8203;10489](https://github.com/rolldown/rolldown/issues/10489)) by [@&#8203;tbvjaos510](https://github.com/tbvjaos510)
- code-splitting: route CJS barrel initialization per consumer ([#&#8203;10488](https://github.com/rolldown/rolldown/issues/10488)) by [@&#8203;hyfdev](https://github.com/hyfdev)
- error: align filename-pattern diagnostics with Rollup's wording ([#&#8203;10501](https://github.com/rolldown/rolldown/issues/10501)) by [@&#8203;IWANABETHATGUY](https://github.com/IWANABETHATGUY)
- plugin: validate emitted prebuilt-chunk file names ([#&#8203;10399](https://github.com/rolldown/rolldown/issues/10399)) by [@&#8203;IWANABETHATGUY](https://github.com/IWANABETHATGUY)
- code-splitting: point a two-argument dynamic import at the chunk that holds the module ([#&#8203;10479](https://github.com/rolldown/rolldown/issues/10479)) by [@&#8203;hyfdev](https://github.com/hyfdev)
- common: align is\_path\_fragment with Rollup's isPathFragment ([#&#8203;10398](https://github.com/rolldown/rolldown/issues/10398)) by [@&#8203;IWANABETHATGUY](https://github.com/IWANABETHATGUY)
- code-splitting: never name an internal chunk export `then` ([#&#8203;10480](https://github.com/rolldown/rolldown/issues/10480)) by [@&#8203;hyfdev](https://github.com/hyfdev)
- code-splitting: avoid creating call-site-triggered entry facades ([#&#8203;10485](https://github.com/rolldown/rolldown/issues/10485)) by [@&#8203;hyfdev](https://github.com/hyfdev)
- code-splitting: collect top-level eager order reasons in every strict build ([#&#8203;10463](https://github.com/rolldown/rolldown/issues/10463)) by [@&#8203;hyfdev](https://github.com/hyfdev)
- code-splitting: let a cross-chunk dynamic importer carry the order trigger ([#&#8203;10456](https://github.com/rolldown/rolldown/issues/10456)) by [@&#8203;hyfdev](https://github.com/hyfdev)
- code-splitting: avoid the dynamic-entry facade when the same-chunk collapse carries the trigger ([#&#8203;10433](https://github.com/rolldown/rolldown/issues/10433)) by [@&#8203;hyfdev](https://github.com/hyfdev)
- binding: forward resolveId options.kind to callable builtin plugins ([#&#8203;10440](https://github.com/rolldown/rolldown/issues/10440)) by [@&#8203;martijnwalraven](https://github.com/martijnwalraven)
- dev: keep the export name of `export * as ns from` ([#&#8203;10476](https://github.com/rolldown/rolldown/issues/10476)) by [@&#8203;tbvjaos510](https://github.com/tbvjaos510)
- code-splitting: only split an entry facade when something else can load its chunk ([#&#8203;10441](https://github.com/rolldown/rolldown/issues/10441)) by [@&#8203;hyfdev](https://github.com/hyfdev)
- code-splitting: fold the runtime chunk back after order lowering ([#&#8203;10414](https://github.com/rolldown/rolldown/issues/10414)) by [@&#8203;hyfdev](https://github.com/hyfdev)
- runtime: don't leave default undefined for cjs that fakes \_\_esModule ([#&#8203;10453](https://github.com/rolldown/rolldown/issues/10453)) by [@&#8203;IWANABETHATGUY](https://github.com/IWANABETHATGUY)
- import-glob: escape generated string literals ([#&#8203;10438](https://github.com/rolldown/rolldown/issues/10438)) by [@&#8203;shantanuraj](https://github.com/shantanuraj)
- preserve-modules: don't assume every chunk mirrors a module ([#&#8203;10442](https://github.com/rolldown/rolldown/issues/10442)) by [@&#8203;hyfdev](https://github.com/hyfdev)
- filter: treat missing hook inputs as non-matches, not panics ([#&#8203;10443](https://github.com/rolldown/rolldown/issues/10443)) by [@&#8203;IWANABETHATGUY](https://github.com/IWANABETHATGUY)
- code-splitting: keep CommonJS modules wrapped under strict execution order ([#&#8203;10405](https://github.com/rolldown/rolldown/issues/10405)) by [@&#8203;hyfdev](https://github.com/hyfdev)
- code-splitting: align dynamicImports metadata with the rewritten import() specifier ([#&#8203;10430](https://github.com/rolldown/rolldown/issues/10430)) by [@&#8203;hyfdev](https://github.com/hyfdev)
- dev: skip user plugin hooks for ?rolldown-lazy proxy modules ([#&#8203;10426](https://github.com/rolldown/rolldown/issues/10426)) by [@&#8203;unknownjedi](https://github.com/unknownjedi)
- treeshake: preserve side-effect-free spread arguments in manual-pure chains ([#&#8203;10432](https://github.com/rolldown/rolldown/issues/10432)) by [@&#8203;IWANABETHATGUY](https://github.com/IWANABETHATGUY)
- treeshake: preserve eagerly evaluated child effects of manual pure chains ([#&#8203;10427](https://github.com/rolldown/rolldown/issues/10427)) by [@&#8203;Nic-Polumeyv](https://github.com/Nic-Polumeyv)
- code-splitting: initialize pure definers behind star re-export barrels under strict execution order ([#&#8203;10409](https://github.com/rolldown/rolldown/issues/10409)) by [@&#8203;hyfdev](https://github.com/hyfdev)
- resolveId: reject string `id` filters (must be a RegExp) ([#&#8203;10412](https://github.com/rolldown/rolldown/issues/10412)) by [@&#8203;IWANABETHATGUY](https://github.com/IWANABETHATGUY)
- code-splitting: collect eager order reasons for on-demand wrapping ([#&#8203;10387](https://github.com/rolldown/rolldown/issues/10387)) by [@&#8203;hyfdev](https://github.com/hyfdev)
- rolldown: apply output.paths to CJS export-star of external modules ([#&#8203;10406](https://github.com/rolldown/rolldown/issues/10406)) by [@&#8203;IWANABETHATGUY](https://github.com/IWANABETHATGUY)
- dev: sourcemaps of lazily compiled chunks ([#&#8203;10386](https://github.com/rolldown/rolldown/issues/10386)) by [@&#8203;tbvjaos510](https://github.com/tbvjaos510)
- plugin: validate emitted file names at emitFile time ([#&#8203;10377](https://github.com/rolldown/rolldown/issues/10377)) by [@&#8203;Nic-Polumeyv](https://github.com/Nic-Polumeyv)
- guarantee tokio runtime release when close rejects ([#&#8203;10381](https://github.com/rolldown/rolldown/issues/10381)) by [@&#8203;shulaoda](https://github.com/shulaoda)
- code-splitting: make strict transitive init registration deterministic and constant-time ([#&#8203;10320](https://github.com/rolldown/rolldown/issues/10320)) by [@&#8203;hyfdev](https://github.com/hyfdev)
- pair tokio runtime acquire and release on wasm to prevent premature shutdown ([#&#8203;10363](https://github.com/rolldown/rolldown/issues/10363)) by [@&#8203;shulaoda](https://github.com/shulaoda)
- don't body-demand modules from simulated facade chunk includes ([#&#8203;10351](https://github.com/rolldown/rolldown/issues/10351)) by [@&#8203;IWANABETHATGUY](https://github.com/IWANABETHATGUY)
- tracing: invalid RD\_LOG filter and RD\_LOG\_OUTPUT=json no longer panic ([#&#8203;10343](https://github.com/rolldown/rolldown/issues/10343)) by [@&#8203;Brooooooklyn](https://github.com/Brooooooklyn)
- code-splitting: treat class definition-time global reads as order-sensitive ([#&#8203;10322](https://github.com/rolldown/rolldown/issues/10322)) by [@&#8203;hyfdev](https://github.com/hyfdev)
- code-splitting: deconflict force-included runtime helper statements ([#&#8203;10336](https://github.com/rolldown/rolldown/issues/10336)) by [@&#8203;hyfdev](https://github.com/hyfdev)
- binding: forward all missing parallel JS plugin hooks ([#&#8203;10345](https://github.com/rolldown/rolldown/issues/10345)) by [@&#8203;Brooooooklyn](https://github.com/Brooooooklyn)
- code-splitting: re-derive chunk exec order after the runtime sweep ([#&#8203;10334](https://github.com/rolldown/rolldown/issues/10334)) by [@&#8203;hyfdev](https://github.com/hyfdev)
- types: add undefined to ExistingRawSourceMap optional properties ([#&#8203;10355](https://github.com/rolldown/rolldown/issues/10355)) by [@&#8203;ocavue](https://github.com/ocavue)
- magic-string: validate relocate ranges before rewiring ([#&#8203;10327](https://github.com/rolldown/rolldown/issues/10327)) by [@&#8203;IWANABETHATGUY](https://github.com/IWANABETHATGUY)
- add EMPTY\_IMPORT\_META warning for non-node CJS output ([#&#8203;10222](https://github.com/rolldown/rolldown/issues/10222)) by [@&#8203;sapphi-red](https://github.com/sapphi-red)
- call `resolveFileUrl` in a deterministic order ([#&#8203;10330](https://github.com/rolldown/rolldown/issues/10330)) by [@&#8203;sapphi-red](https://github.com/sapphi-red)
- magic-string: refuse repeated sendMagicString on a consumed instance ([#&#8203;10331](https://github.com/rolldown/rolldown/issues/10331)) by [@&#8203;IWANABETHATGUY](https://github.com/IWANABETHATGUY)
- magic-string: refuse to use a MagicString after sendMagicString consumed it ([#&#8203;10326](https://github.com/rolldown/rolldown/issues/10326)) by [@&#8203;IWANABETHATGUY](https://github.com/IWANABETHATGUY)
- magic-string: reject non-contiguous moves before rewiring the chunk list ([#&#8203;10311](https://github.com/rolldown/rolldown/issues/10311)) by [@&#8203;IWANABETHATGUY](https://github.com/IWANABETHATGUY)
- handle `./foo/bar` glob pattern the same as `foo/bar` ([#&#8203;10313](https://github.com/rolldown/rolldown/issues/10313)) by [@&#8203;sapphi-red](https://github.com/sapphi-red)
- magic-string: throw instead of panicking when append/prepend splits an edited chunk ([#&#8203;10301](https://github.com/rolldown/rolldown/issues/10301)) by [@&#8203;IWANABETHATGUY](https://github.com/IWANABETHATGUY)
- output: skip separator for empty hoisted functions ([#&#8203;10310](https://github.com/rolldown/rolldown/issues/10310)) by [@&#8203;hyfdev](https://github.com/hyfdev)
- magic-string: don't report a change when edits cancel out ([#&#8203;10299](https://github.com/rolldown/rolldown/issues/10299)) by [@&#8203;IWANABETHATGUY](https://github.com/IWANABETHATGUY)
- sourcemap: map wrapped imported callees ([#&#8203;10288](https://github.com/rolldown/rolldown/issues/10288)) by [@&#8203;hyfdev](https://github.com/hyfdev)
- magic-string: count positional inserts at index 0 on an empty source ([#&#8203;10306](https://github.com/rolldown/rolldown/issues/10306)) by [@&#8203;IWANABETHATGUY](https://github.com/IWANABETHATGUY)
- magic-string: return UTF-16 code units from length() ([#&#8203;10295](https://github.com/rolldown/rolldown/issues/10295)) by [@&#8203;IWANABETHATGUY](https://github.com/IWANABETHATGUY)
- output: skip separator for empty import prelude ([#&#8203;10289](https://github.com/rolldown/rolldown/issues/10289)) by [@&#8203;hyfdev](https://github.com/hyfdev)

##### 🚜 Refactor

- dev: make it easier to customize the runtime ([#&#8203;10338](https://github.com/rolldown/rolldown/issues/10338)) by [@&#8203;sapphi-red](https://github.com/sapphi-red)
- code-splitting: declare CJS carrier namespaces initializer-free ([#&#8203;10513](https://github.com/rolldown/rolldown/issues/10513)) by [@&#8203;hyfdev](https://github.com/hyfdev)
- rollup-tests: avoid relying on `NODE_PATH` env var resolution ([#&#8203;10496](https://github.com/rolldown/rolldown/issues/10496)) by [@&#8203;sapphi-red](https://github.com/sapphi-red)
- code-splitting: derive symbol chunk ownership as pass-local link data ([#&#8203;10449](https://github.com/rolldown/rolldown/issues/10449)) by [@&#8203;hyfdev](https://github.com/hyfdev)
- plugin: share asset emission helpers between copy\_module and asset\_module ([#&#8203;10450](https://github.com/rolldown/rolldown/issues/10450)) by [@&#8203;Nic-Polumeyv](https://github.com/Nic-Polumeyv)
- plugin: dedupe hook binding boilerplate ([#&#8203;10428](https://github.com/rolldown/rolldown/issues/10428)) by [@&#8203;Nic-Polumeyv](https://github.com/Nic-Polumeyv)
- plugin: share the oxc parse preamble between import-glob and dynamic-import-vars ([#&#8203;10452](https://github.com/rolldown/rolldown/issues/10452)) by [@&#8203;Nic-Polumeyv](https://github.com/Nic-Polumeyv)
- implement `GetAstBuilder` on visitor/pass types ([#&#8203;10424](https://github.com/rolldown/rolldown/issues/10424)) by [@&#8203;overlookmotel](https://github.com/overlookmotel)
- pass arrays to AST builder methods ([#&#8203;10419](https://github.com/rolldown/rolldown/issues/10419)) by [@&#8203;overlookmotel](https://github.com/overlookmotel)
- shorten AST builder code ([#&#8203;10418](https://github.com/rolldown/rolldown/issues/10418)) by [@&#8203;overlookmotel](https://github.com/overlookmotel)
- centralize final ESM init metadata ([#&#8203;10376](https://github.com/rolldown/rolldown/issues/10376)) by [@&#8203;hyfdev](https://github.com/hyfdev)
- descriptor-based parallel-plugin detection (getParallelPluginInfo) ([#&#8203;10349](https://github.com/rolldown/rolldown/issues/10349)) by [@&#8203;Brooooooklyn](https://github.com/Brooooooklyn)
- remove AstFactory in favor of new\_\* construction traits ([#&#8203;10353](https://github.com/rolldown/rolldown/issues/10353)) by [@&#8203;Boshen](https://github.com/Boshen)
- enable oxc\_ast's `disable_old_builder` feature ([#&#8203;10316](https://github.com/rolldown/rolldown/issues/10316)) by [@&#8203;Boshen](https://github.com/Boshen)

##### 📚 Documentation

- development-guide: update config.json link line reference ([#&#8203;10523](https://github.com/rolldown/rolldown/issues/10523)) by [@&#8203;dogledogle](https://github.com/dogledogle)
- clarify slash normalization for id hook filter ([#&#8203;10511](https://github.com/rolldown/rolldown/issues/10511)) by [@&#8203;sapphi-red](https://github.com/sapphi-red)
- code-splitting: record the thenable-namespace rule ([#&#8203;10502](https://github.com/rolldown/rolldown/issues/10502)) by [@&#8203;hyfdev](https://github.com/hyfdev)
- clarify that `esmExternalRequirePlugin` must own its externals ([#&#8203;10439](https://github.com/rolldown/rolldown/issues/10439)) by [@&#8203;TheAlexLichter](https://github.com/TheAlexLichter)
- add troubleshooting entry for the [@&#8203;rolldown/binding-](https://github.com/rolldown/binding-)... resolution error ([#&#8203;10390](https://github.com/rolldown/rolldown/issues/10390)) by [@&#8203;Nic-Polumeyv](https://github.com/Nic-Polumeyv)
- add Code Splitting API reference category ([#&#8203;10382](https://github.com/rolldown/rolldown/issues/10382)) by [@&#8203;vittorioexp](https://github.com/vittorioexp)

##### ⚡ Performance

- use VisitJsMut in JavaScript-only AST passes ([#&#8203;10507](https://github.com/rolldown/rolldown/issues/10507)) by [@&#8203;Boshen](https://github.com/Boshen)
- cache the resolved glob matcher for Id/ImporterId filters ([#&#8203;10410](https://github.com/rolldown/rolldown/issues/10410)) by [@&#8203;IWANABETHATGUY](https://github.com/IWANABETHATGUY)
- scope\_hoisting: remove `alloc` field from `ScopeHoistingFinalizer` ([#&#8203;10425](https://github.com/rolldown/rolldown/issues/10425)) by [@&#8203;overlookmotel](https://github.com/overlookmotel)
- reduce string allocations ([#&#8203;10423](https://github.com/rolldown/rolldown/issues/10423)) by [@&#8203;overlookmotel](https://github.com/overlookmotel)
- hmr: remove unnecessary string allocations ([#&#8203;10422](https://github.com/rolldown/rolldown/issues/10422)) by [@&#8203;overlookmotel](https://github.com/overlookmotel)
- avoid allocating static strings via custom builder methods ([#&#8203;10421](https://github.com/rolldown/rolldown/issues/10421)) by [@&#8203;overlookmotel](https://github.com/overlookmotel)
- pass string literals to AST builder methods ([#&#8203;10420](https://github.com/rolldown/rolldown/issues/10420)) by [@&#8203;overlookmotel](https://github.com/overlookmotel)
- use VisitJs in JavaScript-only AST passes ([#&#8203;10396](https://github.com/rolldown/rolldown/issues/10396)) by [@&#8203;Boshen](https://github.com/Boshen)
- plugin: shrink erased plugin debug vtables ([#&#8203;10370](https://github.com/rolldown/rolldown/issues/10370)) by [@&#8203;Boshen](https://github.com/Boshen)
- reuse normalized path buffers ([#&#8203;10315](https://github.com/rolldown/rolldown/issues/10315)) by [@&#8203;hyfdev](https://github.com/hyfdev)

##### 🧪 Testing

- code-splitting: pin CJS barrel fallback triggers and flag-off equivalence ([#&#8203;10514](https://github.com/rolldown/rolldown/issues/10514)) by [@&#8203;hyfdev](https://github.com/hyfdev)
- plugin: cover chunk fileName, absolute chunk name, and Windows drive names ([#&#8203;10400](https://github.com/rolldown/rolldown/issues/10400)) by [@&#8203;IWANABETHATGUY](https://github.com/IWANABETHATGUY)
- code-splitting: cover a single-chunk dynamic import of a wrapped module ([#&#8203;10505](https://github.com/rolldown/rolldown/issues/10505)) by [@&#8203;hyfdev](https://github.com/hyfdev)
- file: remove the unused .dynamic\_import fixture ([#&#8203;10481](https://github.com/rolldown/rolldown/issues/10481)) by [@&#8203;hyfdev](https://github.com/hyfdev)
- treeshake: reduce manual-pure fixture to a minimal smoke test, move matrix to unit tests ([#&#8203;10436](https://github.com/rolldown/rolldown/issues/10436)) by [@&#8203;IWANABETHATGUY](https://github.com/IWANABETHATGUY)
- dev: run vite playgrounds under bundled dev (test-serve-bundled) ([#&#8203;10434](https://github.com/rolldown/rolldown/issues/10434)) by [@&#8203;h-a-n-a](https://github.com/h-a-n-a)
- stop snapshots from silently hiding user code inside the runtime region ([#&#8203;10431](https://github.com/rolldown/rolldown/issues/10431)) by [@&#8203;hyfdev](https://github.com/hyfdev)
- wasi: add tokio runtime lifecycle regression test ([#&#8203;10379](https://github.com/rolldown/rolldown/issues/10379)) by [@&#8203;shulaoda](https://github.com/shulaoda)
- dev: expect preserved hot.data in hmr-whole-chain-dispose ([#&#8203;10380](https://github.com/rolldown/rolldown/issues/10380)) by [@&#8203;h-a-n-a](https://github.com/h-a-n-a)
- code-splitting: pin flag-off wrapped-esm init emission ([#&#8203;10324](https://github.com/rolldown/rolldown/issues/10324)) by [@&#8203;hyfdev](https://github.com/hyfdev)
- sourcemap: fix Windows-only failures in composition fixtures ([#&#8203;10368](https://github.com/rolldown/rolldown/issues/10368)) by [@&#8203;shulaoda](https://github.com/shulaoda)
- generated-code: mark assert external in symbols\_ns2 for deterministic output ([#&#8203;10339](https://github.com/rolldown/rolldown/issues/10339)) by [@&#8203;hyfdev](https://github.com/hyfdev)
- code-splitting: cover entries-aware strict init cycle ([#&#8203;10307](https://github.com/rolldown/rolldown/issues/10307)) by [@&#8203;hyfdev](https://github.com/hyfdev)
- make `just setup-vite` the only entry point that touches `vite/` ([#&#8203;10332](https://github.com/rolldown/rolldown/issues/10332)) by [@&#8203;shulaoda](https://github.com/shulaoda)
- vite-tests: reuse the shared root vite checkout ([#&#8203;10325](https://github.com/rolldown/rolldown/issues/10325)) by [@&#8203;shulaoda](https://github.com/shulaoda)
- test-dev-server: drop the vite submodule, track rolldown-canary ([#&#8203;10319](https://github.com/rolldown/rolldown/issues/10319)) by [@&#8203;shulaoda](https://github.com/shulaoda)
- vite-tests: track the latest rolldown-canary rebased onto vite main ([#&#8203;10318](https://github.com/rolldown/rolldown/issues/10318)) by [@&#8203;shulaoda](https://github.com/shulaoda)
- unify Vite in vite-test and test-dev-server ([#&#8203;10293](https://github.com/rolldown/rolldown/issues/10293)) by [@&#8203;h-a-n-a](https://github.com/h-a-n-a)

##### ⚙️ Miscellaneous Tasks

- scope the binding artifact download to `bindings-*` ([#&#8203;10525](https://github.com/rolldown/rolldown/issues/10525)) by [@&#8203;shulaoda](https://github.com/shulaoda)
- deps: update napi ([#&#8203;10506](https://github.com/rolldown/rolldown/issues/10506)) by [@&#8203;renovate](https://github.com/renovate)\[bot]
- deps: update rollup submodule for tests to v4.62.3 ([#&#8203;10494](https://github.com/rolldown/rolldown/issues/10494)) by [@&#8203;rolldown-guard](https://github.com/rolldown-guard)\[bot]
- deps: upgrade oxc to 0.142.0 ([#&#8203;10497](https://github.com/rolldown/rolldown/issues/10497)) by [@&#8203;shulaoda](https://github.com/shulaoda)
- deps: update test262 submodule for tests ([#&#8203;10495](https://github.com/rolldown/rolldown/issues/10495)) by [@&#8203;rolldown-guard](https://github.com/rolldown-guard)\[bot]
- deps: update github actions ([#&#8203;10460](https://github.com/rolldown/rolldown/issues/10460)) by [@&#8203;renovate](https://github.com/renovate)\[bot]
- deps: update rust crates ([#&#8203;10462](https://github.com/rolldown/rolldown/issues/10462)) by [@&#8203;renovate](https://github.com/renovate)\[bot]
- deps: update npm packages ([#&#8203;10461](https://github.com/rolldown/rolldown/issues/10461)) by [@&#8203;renovate](https://github.com/renovate)\[bot]
- metric: alert Discord when the metric workflow fails ([#&#8203;10447](https://github.com/rolldown/rolldown/issues/10447)) by [@&#8203;IWANABETHATGUY](https://github.com/IWANABETHATGUY)
- metric: mint a short-lived GitHub App token instead of a PAT ([#&#8203;10446](https://github.com/rolldown/rolldown/issues/10446)) by [@&#8203;IWANABETHATGUY](https://github.com/IWANABETHATGUY)
- repo: repair dangling CLAUDE.md symlink ([#&#8203;10451](https://github.com/rolldown/rolldown/issues/10451)) by [@&#8203;hanayashiki](https://github.com/hanayashiki)
- publint/package-metadata fixes and small correctness fixes ([#&#8203;10344](https://github.com/rolldown/rolldown/issues/10344)) by [@&#8203;Brooooooklyn](https://github.com/Brooooooklyn)
- deps: update dependency vite-plus to v0.2.6 ([#&#8203;10404](https://github.com/rolldown/rolldown/issues/10404)) by [@&#8203;renovate](https://github.com/renovate)\[bot]
- add Semgrep scan workflow ([#&#8203;10395](https://github.com/rolldown/rolldown/issues/10395)) by [@&#8203;Boshen](https://github.com/Boshen)
- enable Windows CI with a PR label ([#&#8203;10375](https://github.com/rolldown/rolldown/issues/10375)) by [@&#8203;hyfdev](https://github.com/hyfdev)
- deps: upgrade oxc to 0.141.0 ([#&#8203;10373](https://github.com/rolldown/rolldown/issues/10373)) by [@&#8203;camc314](https://github.com/camc314)
- deps: update napi ([#&#8203;10369](https://github.com/rolldown/rolldown/issues/10369)) by [@&#8203;renovate](https://github.com/renovate)\[bot]
- deps: update test262 submodule for tests ([#&#8203;10367](https://github.com/rolldown/rolldown/issues/10367)) by [@&#8203;rolldown-guard](https://github.com/rolldown-guard)\[bot]
- deps: update taiki-e/install-action action to v2.83.3 ([#&#8203;10358](https://github.com/rolldown/rolldown/issues/10358)) by [@&#8203;renovate](https://github.com/renovate)\[bot]
- deps: update rust crates ([#&#8203;10357](https://github.com/rolldown/rolldown/issues/10357)) by [@&#8203;renovate](https://github.com/renovate)\[bot]
- deps: update npm packages ([#&#8203;10359](https://github.com/rolldown/rolldown/issues/10359)) by [@&#8203;renovate](https://github.com/renovate)\[bot]
- deps: update rust crate syn to v3 ([#&#8203;10362](https://github.com/rolldown/rolldown/issues/10362)) by [@&#8203;renovate](https://github.com/renovate)\[bot]
- deps: update rust crate oxc\_sourcemap to v8.1.2 ([#&#8203;10356](https://github.com/rolldown/rolldown/issues/10356)) by [@&#8203;renovate](https://github.com/renovate)\[bot]
- deps: update dependency vite-plus to v0.2.5 ([#&#8203;10329](https://github.com/rolldown/rolldown/issues/10329)) by [@&#8203;renovate](https://github.com/renovate)\[bot]
- docs: migrate Netlify redirects to Void config ([#&#8203;10282](https://github.com/rolldown/rolldown/issues/10282)) by [@&#8203;tux-tn](https://github.com/tux-tn)
- deps: update dependency rust to v1.97.1 ([#&#8203;10317](https://github.com/rolldown/rolldown/issues/10317)) by [@&#8203;renovate](https://github.com/renovate)\[bot]
- runtime: remove unused `runtime/index.js` ([#&#8203;10302](https://github.com/rolldown/rolldown/issues/10302)) by [@&#8203;IWANABETHATGUY](https://github.com/IWANABETHATGUY)

##### ❤️ New Contributors

- [@&#8203;dogledogle](https://github.com/dogledogle) made their first contribution in [#&#8203;10523](https://github.com/rolldown/rolldown/pull/10523)
- [@&#8203;tbvjaos510](https://github.com/tbvjaos510) made their first contribution in [#&#8203;10489](https://github.com/rolldown/rolldown/pull/10489)
- [@&#8203;martijnwalraven](https://github.com/martijnwalraven) made their first contribution in [#&#8203;10440](https://github.com/rolldown/rolldown/pull/10440)
- [@&#8203;shantanuraj](https://github.com/shantanuraj) made their first contribution in [#&#8203;10438](https://github.com/rolldown/rolldown/pull/10438)
- [@&#8203;Nic-Polumeyv](https://github.com/Nic-Polumeyv) made their first contribution in [#&#8203;10450](https://github.com/rolldown/rolldown/pull/10450)
- [@&#8203;hanayashiki](https://github.com/hanayashiki) made their first contribution in [#&#8203;10451](https://github.com/rolldown/rolldown/pull/10451)
- [@&#8203;unknownjedi](https://github.com/unknownjedi) made their first contribution in [#&#8203;10426](https://github.com/rolldown/rolldown/pull/10426)
- [@&#8203;vittorioexp](https://github.com/vittorioexp) made their first contribution in [#&#8203;10382](https://github.com/rolldown/rolldown/pull/10382)
- [@&#8203;tux-tn](https://github.com/tux-tn) made their first contribution in [#&#8203;10282](https://github.com/rolldown/rolldown/pull/10282)

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNjMuOSIsInVwZGF0ZWRJblZlciI6IjQzLjI2My45IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBzIiwibnBtIl19-->

Reviewed-on: https://gitea.t000-n.de/t.behrendt/validate-json-by-json-schema-action/pulls/64
Reviewed-by: t.behrendt <2+t.behrendt@noreply.localhost>
Co-authored-by: Renovate Bot <renovate@t00n.de>
Co-committed-by: Renovate Bot <renovate@t00n.de>

.editorconfig

@@ -0,0 +1,8 @@
+[*]
+end_of_line = lf
+insert_final_newline = true
+indent_style = space
+indent_size = 2
+charset = utf-8
+trim_trailing_whitespace = true
+max_line_length = 80

.gitea/workflows/cd.yaml

@@ -6,6 +6,7 @@ on:
       - main
     paths:
       - action.yml
+      - dist/**
   workflow_dispatch:
 
 jobs:
@@ -13,14 +14,14 @@ jobs:
     name: Release
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
       - name: Increment tag
         id: tag
-        uses: https://gitea.t000-n.de/t.behrendt/conventional-semantic-git-tag-increment@41b7e04221df8a033bec841d40a097b76e5f67ff # 0.1.29
+        uses: https://gitea.t000-n.de/t.behrendt/conventional-semantic-git-tag-increment@3ab82e6aa1db388a34562f5ce6eedb598651d916 # 0.1.42
         with:
           token: ${{ secrets.GITEA_TOKEN }}
-      - uses: https://gitea.t000-n.de/t.behrendt/actions/release-git-tag@3925c92fc33f3d2bc87d28d21ab691b7e6dd6cdf # 0.2.1
+      - uses: https://gitea.t000-n.de/t.behrendt/actions/release-git-tag@3f772d0a80a510b0f06762be110276c9c8a7b7b8 # 0.2.12
         with:
           tag: ${{ steps.tag.outputs.new-tag }}

.gitea/workflows/ci.yaml

@@ -8,8 +8,61 @@ jobs:
     name: Dry-Run
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - name: Validate JSON
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Validate Renovate Config
         uses: ./
         with:
           json-file: renovate.json
+
+  test:
+    name: Test
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version-file: .nvmrc
+      - name: Cache dependencies
+        id: cache-deps
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: |
+            node_modules
+          key: ${{ runner.os }}-npm-${{ hashFiles('package-lock.json') }}
+      - name: Install dependencies
+        if: steps.cache-deps.outputs.cache-hit != 'true'
+        run: npm ci
+      - name: Typecheck
+        run: npm run typecheck
+      - name: Format code
+        run: npm run format:check
+      - name: Run test
+        run: npm run test
+
+  check-dist:
+    name: Check Dist
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version-file: .nvmrc
+      - name: Cache dependencies
+        id: cache-deps
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: |
+            node_modules
+          key: ${{ runner.os }}-npm-${{ hashFiles('package-lock.json') }}
+      - name: Install dependencies
+        if: steps.cache-deps.outputs.cache-hit != 'true'
+        run: npm ci
+      - run: mv dist dist_orig
+      - run: npm run build
+      - run: |
+          original_hash=$(sha256sum dist_orig/index.js | cut -d' ' -f1)
+          new_hash=$(sha256sum dist/index.js | cut -d' ' -f1)
+          if [ "$original_hash" != "$new_hash" ]; then
+            echo "Build is not up to date. Original hash: $original_hash, new hash: $new_hash"
+            exit 1
+          fi

.gitea/workflows/prerelease.yaml

@@ -8,15 +8,15 @@ jobs:
     name: Release
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
       - name: Increment tag
         id: tag
-        uses: https://gitea.t000-n.de/t.behrendt/conventional-semantic-git-tag-increment@41b7e04221df8a033bec841d40a097b76e5f67ff # 0.1.29
+        uses: https://gitea.t000-n.de/t.behrendt/conventional-semantic-git-tag-increment@3ab82e6aa1db388a34562f5ce6eedb598651d916 # 0.1.42
         with:
           token: ${{ secrets.GITEA_TOKEN }}
           prerelease: true
-      - uses: https://gitea.t000-n.de/t.behrendt/actions/release-git-tag@3925c92fc33f3d2bc87d28d21ab691b7e6dd6cdf # 0.2.1
+      - uses: https://gitea.t000-n.de/t.behrendt/actions/release-git-tag@3f772d0a80a510b0f06762be110276c9c8a7b7b8 # 0.2.12
         with:
-          tag: ${{ steps.tag.outputs.new-tag }}
+          tag: ${{ steps.tag.outputs.new-tag }}

.gitea/workflows/run-tas.yaml

@@ -1,31 +0,0 @@
-name: Run TAS
-
-on:
-  pull_request:
-  workflow_dispatch:
-    inputs:
-      branch:
-        description: "The branch to run TAS on"
-        required: true
-        default: "main"
-  schedule:
-    - cron: "0 6 * * 5"
-
-jobs:
-  run-tas:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/setup-trivy@a6508d695d7bb6137f14372392d5c312c98225cf # 1.4.7
-      - uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/setup-db@a6508d695d7bb6137f14372392d5c312c98225cf # 1.4.7
-      - env:
-          TRIVY_CACHE_DIR: ${{ runner.temp }}/trivy
-        run: |
-          trivy config --cache-dir "$TRIVY_CACHE_DIR" --exit-code 0 --format sarif --output sarif.json .
-      - uses: https://gitea.t000-n.de/t.behrendt/tas-actions/tas-upload-sarif@5e1031a9eff4a83fc17d0893332ad896386c082f # 0.0.3
-        with:
-          tas-base-url: ${{ vars.TAS_BASE_URL }}
-          sarif-file: sarif.json
-          owner: t.behrendt
-          repo: validate-json-by-json-schema-action
-          branch: ${{ inputs.branch || github.head_ref || 'main' }}

.gitignore

@@ -1,138 +1,2 @@
-# ---> Node
-# Logs
-logs
-*.log
-npm-debug.log*
-yarn-debug.log*
-yarn-error.log*
-lerna-debug.log*
-.pnpm-debug.log*
-
-# Diagnostic reports (https://nodejs.org/api/report.html)
-report.[0-9]*.[0-9]*.[0-9]*.[0-9]*.json
-
-# Runtime data
-pids
-*.pid
-*.seed
-*.pid.lock
-
-# Directory for instrumented libs generated by jscoverage/JSCover
-lib-cov
-
-# Coverage directory used by tools like istanbul
+node_modules
 coverage
-*.lcov
-
-# nyc test coverage
-.nyc_output
-
-# Grunt intermediate storage (https://gruntjs.com/creating-plugins#storing-task-files)
-.grunt
-
-# Bower dependency directory (https://bower.io/)
-bower_components
-
-# node-waf configuration
-.lock-wscript
-
-# Compiled binary addons (https://nodejs.org/api/addons.html)
-build/Release
-
-# Dependency directories
-node_modules/
-jspm_packages/
-
-# Snowpack dependency directory (https://snowpack.dev/)
-web_modules/
-
-# TypeScript cache
-*.tsbuildinfo
-
-# Optional npm cache directory
-.npm
-
-# Optional eslint cache
-.eslintcache
-
-# Optional stylelint cache
-.stylelintcache
-
-# Microbundle cache
-.rpt2_cache/
-.rts2_cache_cjs/
-.rts2_cache_es/
-.rts2_cache_umd/
-
-# Optional REPL history
-.node_repl_history
-
-# Output of 'npm pack'
-*.tgz
-
-# Yarn Integrity file
-.yarn-integrity
-
-# dotenv environment variable files
-.env
-.env.development.local
-.env.test.local
-.env.production.local
-.env.local
-
-# parcel-bundler cache (https://parceljs.org/)
-.cache
-.parcel-cache
-
-# Next.js build output
-.next
-out
-
-# Nuxt.js build / generate output
-.nuxt
-dist
-
-# Gatsby files
-.cache/
-# Comment in the public line in if your project uses Gatsby and not Next.js
-# https://nextjs.org/blog/next-9-1#public-directory-support
-# public
-
-# vuepress build output
-.vuepress/dist
-
-# vuepress v2.x temp and cache directory
-.temp
-.cache
-
-# vitepress build output
-**/.vitepress/dist
-
-# vitepress cache directory
-**/.vitepress/cache
-
-# Docusaurus cache and generated files
-.docusaurus
-
-# Serverless directories
-.serverless/
-
-# FuseBox cache
-.fusebox/
-
-# DynamoDB Local files
-.dynamodb/
-
-# TernJS port file
-.tern-port
-
-# Stores VSCode versions used for testing VSCode extensions
-.vscode-test
-
-# yarn v2
-.yarn/cache
-.yarn/unplugged
-.yarn/build-state.yml
-.yarn/install-state.gz
-.pnp.*
-

.npmrc

@@ -0,0 +1 @@
+min-release-age=7

.nvmrc

@@ -0,0 +1,2 @@
+24
+

.oxfmtrc.json

@@ -0,0 +1,4 @@
+{
+  "$schema": "./node_modules/oxfmt/configuration_schema.json",
+  "ignorePatterns": ["dist/**", "node_modules/**", "coverage/**"]
+}

LICENSE

@@ -2,17 +2,17 @@ MIT License
 
 Copyright (c) 2025 t.behrendt
 
-Permission is hereby granted, free of charge, to any person obtaining a copy of this software and 
-associated documentation files (the "Software"), to deal in the Software without restriction, including 
-without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 
-copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the 
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and
+associated documentation files (the "Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the
 following conditions:
 
-The above copyright notice and this permission notice shall be included in all copies or substantial 
+The above copyright notice and this permission notice shall be included in all copies or substantial
 portions of the Software.
 
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT 
-LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO 
-EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER 
-IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE 
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT
+LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO
+EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
+IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
 USE OR OTHER DEALINGS IN THE SOFTWARE.

action.yml

@@ -8,26 +8,5 @@ inputs:
     required: true
 
 runs:
-  using: "composite"
-  steps:
-    - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
-      with:
-        node-version: "latest"
-    - name: Extract schema
-      shell: bash
-      run: |
-        schema=$(jq -r '.["$schema"]' < ${{ inputs.json-file }})
-        if [ -n "$schema" ]; then
-          curl -s $schema > schema.json
-        else
-          echo "No schema found"
-          exit 0
-        fi
-    - name: Update the schema to the latest version
-      shell: bash
-      run: |
-        npx ajv-cli migrate -s schema.json -o schema.json
-    - name: Validate JSON
-      shell: bash
-      run: |
-        npx ajv-cli validate -s schema.json -d ${{ inputs.json-file }} --strict=false
+  using: "node24"
+  main: "dist/index.js"

package.json

@@ -0,0 +1,25 @@
+{
+  "name": "validate-json-by-json-schema-action",
+  "version": "1.0.0",
+  "type": "commonjs",
+  "main": "src/index.ts",
+  "scripts": {
+    "test": "vitest --config vitext.config.ts",
+    "format": "oxfmt",
+    "format:check": "oxfmt --check",
+    "build": "rolldown -c",
+    "typecheck": "tsc --noEmit"
+  },
+  "dependencies": {
+    "@actions/core": "3.0.1",
+    "ajv": "8.20.0"
+  },
+  "devDependencies": {
+    "@types/node": "24.13.3",
+    "@vitest/coverage-v8": "4.1.10",
+    "oxfmt": "0.61.0",
+    "rolldown": "1.2.1",
+    "typescript": "7.0.2",
+    "vitest": "4.1.10"
+  }
+}

renovate.json

@@ -1,7 +1,12 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "extends": [
-    "local>t.behrendt/renovate-configs:common",
-    "local>t.behrendt/renovate-configs:action"
-  ]
+    "local>t.behrendt/renovate-configs:action",
+    "local>t.behrendt/renovate-configs:bun-npm"
+  ],
+  "postUpgradeTasks": {
+    "commands": ["npm ci", "npm run build"],
+    "fileFilters": ["dist/**"],
+    "executionMode": "update"
+  }
 }

rolldown.config.ts

@@ -0,0 +1,11 @@
+import { defineConfig } from "rolldown";
+
+export default defineConfig({
+  input: "src/index.ts",
+  platform: "node",
+  tsconfig: "./tsconfig.json",
+  output: {
+    file: "dist/index.js",
+    format: "cjs",
+  },
+});

src/index.ts

@@ -0,0 +1,3 @@
+import { run } from "./main";
+
+run();

src/main.ts

@@ -0,0 +1,18 @@
+import * as core from "@actions/core";
+import { readFileSync } from "node:fs";
+import { validateJson } from "./validation";
+
+export async function run(): Promise<void> {
+  try {
+    const jsonFilePath = core.getInput("json-file");
+    core.info(`Validating JSON file: ${jsonFilePath}`);
+
+    const json = readFileSync(jsonFilePath, "utf8");
+
+    await validateJson(json);
+
+    core.info("JSON file is valid");
+  } catch (error) {
+    core.setFailed(`Error validating JSON file: ${error}`);
+  }
+}

src/validation.test.ts

@@ -0,0 +1,109 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import { validateJson } from "./validation";
+
+global.fetch = vi.fn();
+
+const validSchema = JSON.stringify({
+  $id: "https://t00n.de/schema.json",
+  title:
+    "JSON schema for Renovate 43.244.4 config files (https://renovatebot.com/)",
+  $schema: "http://json-schema.org/draft-07/schema#",
+  type: "object",
+  properties: {
+    $schema: {
+      type: "string",
+    },
+    name: {
+      type: "string",
+    },
+  },
+  required: ["name"],
+  additionalProperties: false,
+});
+
+describe("validateJson()", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it("throws an error if the JSON file is not valid JSON", async () => {
+    const jsonFile = {
+      despiteThisBeingValidJson: "toString() breaks it, making it invalid",
+    }.toString();
+    await expect(validateJson(jsonFile)).rejects.toThrow(
+      '"[object Object]" is not valid JSON',
+    );
+  });
+
+  it("throws an error if the JSON file does not contain a $schema property", async () => {
+    const jsonFile = JSON.stringify({
+      validJson: true,
+    });
+    await expect(validateJson(jsonFile)).rejects.toThrow(
+      "No schema found in JSON file.",
+    );
+  });
+
+  it("throws an error if the schema cannot be fetched", async () => {
+    vi.mocked(fetch).mockRejectedValue(new Error("Failed to fetch schema"));
+    const jsonFile = JSON.stringify({ $schema: "http://t00n.de/404.json" });
+    await expect(validateJson(jsonFile)).rejects.toThrow(
+      "Failed to fetch schema",
+    );
+  });
+
+  it("throws an error if the schema file is not valid", async () => {
+    vi.mocked(fetch).mockResolvedValue(
+      // @ts-expect-error - mock response
+      {
+        ok: true,
+        text: async () =>
+          ({
+            despiteThisBeingValidJson:
+              "toString() breaks it, making it invalid",
+          }).toString(),
+      },
+    );
+
+    const jsonFile = JSON.stringify({
+      $schema: "https://json-schema.org/draft-07/schema",
+    });
+    await expect(validateJson(jsonFile)).rejects.toThrow(
+      '"[object Object]" is not valid JSON',
+    );
+  });
+
+  it("throws an error if the JSON file does not match the schema", async () => {
+    vi.mocked(fetch).mockResolvedValue(
+      // @ts-expect-error - mock response
+      {
+        ok: true,
+        text: async () => validSchema,
+      },
+    );
+
+    const jsonFile = JSON.stringify({
+      $schema: "https://json-schema.org/draft-07/schema",
+      notTheExpectedField: 42,
+    });
+    await expect(validateJson(jsonFile)).rejects.toThrow(
+      "JSON file is not valid: No errors",
+    );
+  });
+
+  it("does not throw an error if the JSON file is valid", async () => {
+    vi.mocked(fetch).mockResolvedValue(
+      // @ts-expect-error - mock response
+      {
+        ok: true,
+        text: async () => validSchema,
+      },
+    );
+
+    const jsonFile = JSON.stringify({
+      $schema: "https://t00n.de/schema.json",
+      name: "John Doe",
+    });
+    await expect(validateJson(jsonFile)).resolves.toBeUndefined();
+  });
+});

src/validation.ts

@@ -0,0 +1,25 @@
+import Ajv from "ajv";
+
+export const validateJson = async (jsonFileContent: string): Promise<void> => {
+  const jsonObject = JSON.parse(jsonFileContent);
+
+  const schema = jsonObject["$schema"];
+  if (!schema) {
+    throw new Error("No schema found in JSON file.");
+  }
+
+  const schemaUrl = new URL(schema);
+
+  const schemaContent = await fetch(schemaUrl.toString());
+  const schemaText = await schemaContent.text();
+  const schemaObject = JSON.parse(schemaText);
+
+  const validator = new Ajv({
+    strict: false,
+  });
+  const validate = validator.compile(schemaObject);
+  const isValid = validate(jsonObject);
+  if (!isValid) {
+    throw new Error(`JSON file is not valid: ${validator.errorsText()}`);
+  }
+};

tsconfig.json

@@ -0,0 +1,22 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "commonjs",
+    "lib": ["ES2022"],
+    "types": ["node"],
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "forceConsistentCasingInFileNames": true,
+    "removeComments": false,
+    "noImplicitAny": true,
+    "noImplicitReturns": true,
+    "noImplicitThis": true,
+    "noUnusedLocals": true,
+    "noUnusedParameters": true,
+    "exactOptionalPropertyTypes": true,
+    "noImplicitOverride": true
+  },
+  "include": ["src/**/*"],
+  "exclude": ["node_modules", "dist", "**/*.test.ts", "**/*.spec.ts"]
+}

vitext.config.ts

@@ -0,0 +1,11 @@
+import { defineConfig } from "vitest/config";
+
+export default defineConfig({
+  test: {
+    coverage: {
+      enabled: true,
+      provider: "v8",
+      reporter: ["lcov"],
+    },
+  },
+});