deps: bump the minor group across 1 directory with 4 updates

[dependabot]

Bumps the minor group with 4 updates in the / directory: @cldmv/jsonv, @cldmv/prettier-plugin-jsonv, @cldmv/vitest-runner and ws.

Updates @cldmv/jsonv from 1.0.9 to 1.1.1

Release notes

Sourced from @​cldmv/jsonv's releases.

v1.1.1

release: v1.1.1 - include the closing } in template middle/tail tokens…

@​cldmv/jsonv v1.1.1 Changelog

Release Date: September 2026 Release Type: Patch Branch: release/1.1.1

---

Overview

Version 1.1.1 is a correctness patch on top of v1.1.0's AST/token work. Exercising the new parseToAst() output and the tolerant option surfaced nine bugs across parse-mode enforcement, tolerant-mode error reporting, reference resolution, and template-literal lexing — all fixed here, each with regression tests. Three ESLint tooling dependencies are also bumped, and CI's release-merge gate is re-armed against every check-producing workflow.

No public API changes. All v1.1.0 configuration and usage is fully compatible.

---

🐛 Bug Fixes

mode: "json" and mode: "json5" now enforce their feature sets (#65)

ParseOptions.mode was documented to restrict "json" to RFC 8259 JSON and "json5" to JSON5 1.0, but only the comment check was ever wired up — both modes silently accepted the full set of jsonv extensions (unquoted keys, single quotes, trailing commas, hex, Infinity/NaN, and, in "json5", even internal references and templates). Both modes now reject every feature outside their spec with a positioned JsonvSyntaxError naming the feature and the mode, covering every year entry point and parseToAst(). Fixes #52.

Tolerant mode reports collected syntax errors instead of a misleading reference error (#64)

With tolerant: true, parseWithOptions collected syntax errors and then evaluated the partial result anyway, so a document with real syntax errors surfaced an unrelated JsonvReferenceError ("Unresolved reference: b") instead of the errors that were actually collected. When any syntax errors are collected, parseWithOptions now throws a single JsonvAggregateSyntaxError — its own line/column/offset/code are the first error's, its message summarizes the first error plus the total count, and errors holds every collected error in source order. The document is not evaluated. Fixes #59.

Forward-reference chains of any length now resolve (#66)

Internal references resolved in a fixed number of passes, so an acyclic forward-reference chain longer than the pass limit (five or more keys) failed with a spurious "Unresolved reference" error even though nothing was circular. References now resolve by dependency order — recursively resolving a reference as soon as its target has a concrete value — instead of a fixed pass count, so chains of any depth, through member expressions and templates, resolve correctly. True cycles and self-references still throw, pointing at the reference that closes the cycle. Fixes #54.

parseToAst collects lexer errors instead of throwing (#62)

parseToAst() returns { program, comments, tokens, errors } and collected parser errors in errors, but lexer errors (unterminated templates/strings, invalid escapes, year-gated literals) were thrown instead — forcing callers to handle two separate error paths, and hiding every other error in tolerant mode behind the first lexical failure. Lexer errors are now collected into errors alongside parser errors, with the tokens lexed up to the error and a partial program returned. Fixes #51.

Template interpolations balance braces; object/array literals inside ${} are rejected clearly (#57)

While inside a template interpolation, the lexer treated the first } as the end of the interpolation, so an interpolated expression containing its own braces — an object literal, for example — broke parsing with a misleading "Expected ',' or '}'" error pointing at the wrong brace. The lexer now tracks brace depth per interpolation the way a JS lexer tracks a stack of template/brace contexts, so only the balancing } ends the interpolation; an object or array literal directly inside ${} is then explicitly rejected with a clear, correctly positioned error instead of a confusing one. Fixes #50.

Nested templates inside an interpolation now evaluate (#53)

A template literal nested inside another template's interpolation (`a${ `b${a}c` }d`) parsed with correct tokens and spans but threw JsonvReferenceError: Unresolved reference: \<template> on evaluation — reference resolution treated the inner TemplateLiteral node as a named reference instead of evaluating it. Nested templates now evaluate like any other interpolated expression, at any nesting depth, including when referencing another key or appearing inside a forward reference. Fixes #49.

Template middle/tail tokens and quasis now include the closing } (#48)

In parseToAst() output, the TemplateHead token and its quasi included the opening ${, but the } that closes an interpolation belonged to no token and no quasi — so the following TemplateMiddle/TemplateTail segment started one character too late, leaving a one-character gap in the token stream. Tokens now tile the template source with no gaps, matching ESTree/Babel/Espree conventions: a tail/middle token and its quasi start at the closing }. This shifts @cldmv/eslint-plugin-jsonv's TemplateElement ranges by one character; that plugin should be re-checked against this release. Fixes #47.

CR and CRLF in template literals normalize to LF (#56)

... (truncated)

Commits

• cbee3ca release: v1.1.1 - include the closing } in template middle/tail tokens…
• 5bfa55b release: v1.1.0 - return comments and tokens, positioned keys and…
• 4448b47 release: v1.0.10 - expose line, column and offset on parse errors
• See full diff in compare view

Updates @cldmv/prettier-plugin-jsonv from 1.0.6 to 1.1.0

Release notes

Sourced from @​cldmv/prettier-plugin-jsonv's releases.

v1.1.0

release: v1.1.0 - honour prettier's trailingComma option

@​cldmv/prettier-plugin-jsonv v1.1.0 Changelog

Release Date: September 2026 Release Type: Minor Branch: release/1.1.0

---

Overview

A critical correctness fix plus a new formatting option. Every published version through v1.0.6 — the printer's key- and literal-handling code was unchanged since the v1.0.0 initial release — could silently corrupt a .jsonv file on format: unquoted (identifier) keys were printed as the literal string "[object Object]", collapsing every key in an object to the same name; every comment, line and block, was dropped; and numbers were printed from their evaluated value rather than their source text, so numeric separators and non-decimal forms were rewritten (1_000_000 → 1000000, 0b1111_0000 → 240, 0xFF → 255). Because every repo on the canonical CLDMV lint/format config registers this plugin for *.jsonv, and the v4 post-merge lint-format job runs npm run format on next and commits the result, any repo with .jsonv files was one merge away from having them corrupted; a scan of CLDMV's own checkouts at the time the bug was reported found none yet corrupted.

The printer is rewritten around @cldmv/jsonv 1.1.0's parseToAst(), which returns a positioned AST carrying raw text on every literal and identifier key, plus the full comment and token list. Printing is now lossless: keys, strings, numbers and BigInts are printed from their source text rather than their evaluated value, and every comment is attached through Prettier's own comment API so it prints exactly once, in place. Only layout — indentation, line breaks, blank-line runs between entries, and spacing inside template interpolations — is normalized, along with unquoting a quoted key whose content is a plain identifier with no escapes.

The published types are also fixed: the plugin now ships a real, type-checked JsonvPlugin declaration instead of a loosely typed one. On top of the fixes, the plugin now honours Prettier's trailingComma option for object and array literals, matching Prettier's default behavior for JavaScript instead of silently ignoring the setting.

---

🐛 Bug Fixes

Print jsonv losslessly from the source AST (#26, fixes #25)

• Keys: an unquoted (identifier) key is printed from its name, not stringified from the key node — fixing the "[object Object]" corruption. A quoted key is printed verbatim, including its quote character, unless its content is a plain identifier with no escapes, in which case it is unquoted ("host" → host); every other quoted key — one with a space, an escape, a leading digit, or content that reads as a reserved word — is kept exactly as written. This replaces the previous behavior of normalizing every quoted key's quote character to match the singleQuote option.
• Numbers and BigInts: printed from their source text, not their evaluated value — numeric separators, binary/octal/hex literals and their casing, and BigInt's n suffix all survive formatting unchanged.
• Comments: every line and block comment is attached to the AST and printed, including comments in previously-unsupported positions (between a key and its value, inside a member-expression, inside a template interpolation). A line comment's spacing after // is now taken from the source when the comment doesn't start with a letter or digit (a divider like //--- is kept as written); a comment that does start with a letter or digit is still normalized to a single space after //.
• Blank lines: at most one blank line between object/array entries is now preserved when the source had one. Previously every blank line between entries was removed, corruption bug or not.
• Templates: interpolated template literals are now sliced verbatim from the source text between their delimiters, rather than rebuilt from the parser's quasi nodes.

Round-trip tests were added covering every jsonv feature (identifier, numeric and quoted keys; every number form; comments in every position; templates; internal references; trailing commas) across the full @cldmv/jsonv fixture corpus, asserting that parsing the formatted output reproduces the original value, that comments survive, and that formatting is idempotent (format(format(x)) === format(x)).

Publish a typed plugin and type-check the JSDoc (#32, fixes #5)

The published declarations previously typed the plugin only as a generic Prettier Plugin, with no detail about its parser, printer or options. The JSDoc in src/index.mjs is now complete and type-checked, and the generated .d.mts exports a real JsonvPlugin type (parser, printer, language and option definitions) alongside JsonvOptions, JsonvParserOptions, JsonvNode, JsonvProgram, JsonvComment and JsonvYear. The plugin satisfies Prettier's own Plugin type directly, and it is exported both as the default export and by name. A new test:types check compiles a consumer file against the published types and now runs as part of build:ci.

✨ Features

Honour prettier's trailingComma option (#31, fixes #27)

The printer previously never added a trailing comma and ignored Prettier's trailingComma option entirely, even though Prettier 3 defaults to "all" and jsonv allows trailing commas in every year. It now follows Prettier's own JavaScript behavior for object and array literals:

• "all" (Prettier's default) and "es5" add a comma after the last entry of every object or array that breaks across lines. A non-empty object or array is always printed one entry per line, so only an empty one ({ }, []) stays on a single line, and it never gets a comma.
• "none" never adds one.

A trailing comma already in the source is not kept as written — the option normalizes it, adding or removing the comma after the last entry — and the change stays lossless: the parsed value never changes, and a comment next to the last entry stays in place (a: 1, // note keeps the comment after the comma; a: 1 /* note */, keeps it before). Round-trip and idempotency tests cover every trailingComma value across the jsonv fixture corpus, plus every comment placement around a document's last entry.

🔧 CI & tooling

... (truncated)

Commits

• 16f272b release: v1.1.3 - run the in-repo PR mirror job instead of skipping it
• 56b0087 release: v1.1.2 - bump the patch group across 1 directory with 2 updates
• eede8aa release: v1.1.1 - bump the patch group across 1 directory with 2 updates
• 0a57039 release: v1.1.0 - honour prettier's trailingComma option
• See full diff in compare view

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Updates @cldmv/vitest-runner from 1.2.0 to 1.5.1

Release notes

Sourced from @​cldmv/vitest-runner's releases.

v1.5.1

release: v1.5.1 - backfill the missing v1.5.0 changelog

vitest-runner v1.5.1 Changelog

Release Date: September 2026 Release Type: Patch Branch: release/1.5.1

---

Overview

A documentation-only release: v1.5.0 shipped through the automated release-merge gate before its changelog and README What's New update had landed on next, so it released with the raw auto-generated PR-title dump instead of curated notes. This backfills v1.5.0's changelog and promotes the README. No code changes.

---

📚 Documentation

Backfilled the missing v1.5.0 changelog

docs/changelog/v1/v1.5.0.md — the curated release notes for the exclude option (#57, #58) that v1.5.0 shipped without. The README ✨ What's New block is promoted to match.

---

Upgrade notes

No breaking changes — drop-in for v1.5.0. No runtime code changed.

---

Metric	Coverage
Statements	99.6%
Branches	100.0%
Functions	100.0%
Lines	99.6%

Avg: 99.8% · d915e7d · Node lts/*

... (truncated)

Commits

• 7aedb32 release: v1.5.1 - backfill the missing v1.5.0 changelog
• 9e0f31c release: v1.5.0 - add an exclude option for test discovery
• 1241f7f release: v1.4.4 - drop the tsup-availability guard in prepack (#41)
• fade67f release: v1.4.3 - enable minification for the tsup build
• 0685350 release: v1.4.2 - add missing repository/bugs/homepage fields to…
• ee919b6 release: v1.4.1 - README npm badges reference the unscoped package name
• 57542fe release: v1.4.0 - bundle a real dist/ build with tsup, generate the CJS… (#22)
• cf7dcbd release: v1.3.3 - bump the npm_and_yarn group across 1 directory with 2… (#19)
• bf402bd build(deps-dev): bump the npm_and_yarn group across 1 directory with 2 update...
• c36611f Merge branch 'hotfixes' into hotfix-redirect/pr-8
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​cldmv/vitest-runner since your current version.

Updates ws from 8.21.3 to 8.22.0

Release notes

Sourced from ws's releases.

8.22.0

Features

• Introduced the protocols option (8b918b01).

Bug fixes

• Calling websocket.close() with invalid arguments no longer transitions the state to WebSocket.CLOSING (#2337).

Commits

• 297202c [dist] 8.22.0
• 8b918b0 [feature] Introduce the protocols option
• 73e03eb [ci] Update actions/setup-node action to v7
• d9b8954 [fix] Change the ready state after validating the arguments (#2337)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions