Bump @hey-api/openapi-ts from 0.85.2 to 0.97.3 in the npm_and_yarn group across 1 directory

[dependabot]

Bumps the npm_and_yarn group with 1 update in the / directory: @hey-api/openapi-ts.

Updates @hey-api/openapi-ts from 0.85.2 to 0.97.3

Release notes

Sourced from @​hey-api/openapi-ts's releases.

@​hey-api/openapi-ts@​0.95.0

Minor Changes

• plugin(valibot): remove request data schema (#3671) (96f60ad) by @​mrlubos

Validator request schemas

Valibot plugin no longer exports composite request Data schemas. Instead, each layer is exported as a separate schema. If you're using validators with SDKs, you can preserve the composite schema with shouldExtract:

export default {
  input: "hey-api/backend", // sign up at app.heyapi.dev
  output: "src/client",
  plugins: [
    // ...other plugins
    {
      name: "sdk",
      validator: "valibot",
    },
    {
      name: "valibot",
      requests: {
        shouldExtract: true,
      },
    },
  ],
};

• internal: remove plugin.getSymbol() function (#3671) (96f60ad) by @​mrlubos

Removed plugin.getSymbol() function

This function has been removed. You can use plugin.querySymbol() instead. It accepts the same arguments and returns the same result.

• plugin(zod): remove request data schema (#3671) (96f60ad) by @​mrlubos

Validator request schemas

Zod plugin no longer exports composite request Data schemas. Instead, each layer is exported as a separate schema. If you're using validators with SDKs, you can preserve the composite schema with shouldExtract:

export default {
  input: "hey-api/backend", // sign up at app.heyapi.dev
  output: "src/client",
  plugins: [
    // ...other plugins
    {
      name: "sdk",
      validator: "zod",
</tr></table> 

... (truncated)

Changelog

Sourced from @​hey-api/openapi-ts's changelog.

0.97.3

Patch Changes

• plugin(@​hey-api/client-axios): fix: correct return type in SSE (#3919) (a19b3a4) by @​kitlangton

• plugin(@​tanstack/preact-query): add getQueryData option (#3827) (1aa4785) by @​inas-sirhan

• plugin(@​hey-api/client-ofetch): fix: correct return type in SSE (#3919) (a19b3a4) by @​kitlangton

• plugin(@​tanstack/svelte-query): add getQueryData option (#3827) (1aa4785) by @​inas-sirhan

• plugin(@​tanstack/angular-query-experimental): add getQueryData option (#3827) (1aa4785) by @​inas-sirhan

• plugin(@​tanstack/react-query): add getQueryData option (#3827) (1aa4785) by @​inas-sirhan

• plugin(@​hey-api/client-fetch): fix: correct return type in SSE (#3919) (a19b3a4) by @​kitlangton

• plugin(@​tanstack/react-query): add useGetQueryData option (#3827) (1aa4785) by @​inas-sirhan

• plugin(@​hey-api/client-ky): fix: correct return type in SSE (#3919) (a19b3a4) by @​kitlangton

• plugin(@​tanstack/solid-query): add getQueryData option (#3827) (1aa4785) by @​inas-sirhan

• plugin(@​hey-api/client-next): fix: correct return type in SSE (#3919) (a19b3a4) by @​kitlangton

• plugin(@​tanstack/preact-query): add useGetQueryData option (#3827) (1aa4785) by @​inas-sirhan

• plugin(@​hey-api/client-angular): fix: correct return type in SSE (#3919) (58962a0) by @​kitlangton

• plugin(@​hey-api/transformers): add support for Temporal API via temporal-polyfill in dates (#3916) (bfa457a) by @​OptoCloud

• plugin(@​tanstack/vue-query): add getQueryData option (#3827) (1aa4785) by @​inas-sirhan

• plugin(zod): fix: avoid invalid .extend() on z.record() when a discriminated union member is an empty object (#3915) (8fa9f3a) by @​pullfrog

Updated Dependencies:

• @​hey-api/shared@​0.4.5
• @​hey-api/codegen-core@​0.8.2

0.97.2

Patch Changes

• plugin(zod): use enums from TypeScript if available (#3884) (abc8ceb) by @​mrlubos

• plugin(@​hey-api/client-next): fix: preserve query auth when when there are no other query parameters (#3853) (a6ee7eb) by @​copilot-swe-agent

• plugin(@​hey-api/sdk): support valibot as response transformer (#3847) (6770f78) by @​SukkaW

... (truncated)

Commits

• d833f73 ci: release
• 4987bc3 docs: add changesets
• 30498ce Merge branch 'main' of https://github.com/hey-api/openapi-ts into feat/tansta...
• 9be7e7f chore: one more try
• 4c5916d chore: one more try
• 83b4464 chore: one more try
• 597e151 Merge branch 'main' into pullfrog/3914-zod-discriminated-union-empty-object
• 462c2e9 Merge branch 'main' into feat/transformers-temporal
• 3367e64 Merge branch 'main' into fix/sse-iterator-treturn-miswiring
• e6d4416 refactor: valibot plugin
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​hey-api/openapi-ts since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​hey-api/​openapi-ts@​0.85.2 ⏵ 0.97.3	+3	+2	+1

View full report

[semgrep2-openvanta]

High severity vulnerability may affect your project—review required:
Line 983 lists a dependency (js-yaml) with a known High severity vulnerability.

ℹ️ Why this matters

Affected versions of js-yaml are vulnerable to Inefficient Algorithmic Complexity. An attacker can supply a YAML document containing a large !!omap sequence, which js-yaml resolves with a linear duplicate-key scan inside its per-element loop. Resolution is therefore quadratic in the number of entries, so a modestly sized document consumes disproportionate CPU inside the load call and blocks the event loop, resulting in a denial of service.

References: GHSA

To resolve this comment:
Check if you are using js-yaml on the CLI.

• If you're affected, upgrade this dependency to at least version 4.3.1 at yarn.lock.
• If you're not affected, comment /fp we don't use this [condition]

💬 Ignore this finding

To ignore this, reply with:

• /fp <comment> for false positive
• /ar <comment> for acceptable risk
• /other <comment> for all other reasons

If this violation is related to a license issue (MPL, GPL, LGPL, etc.), please reach out in #ask-legal to have the legal team review the offending package and ensure we fulfill our legal obligations around licensing software.

_{You can view more details on this finding in the Semgrep AppSec Platform here.}

[semgrep2-openvanta]

High severity vulnerability may affect your project—review required:
Line 983 lists a dependency (js-yaml) with a known High severity vulnerability.

ℹ️ Why this matters

Affected versions of js-yaml are vulnerable to Inefficient Algorithmic Complexity / Uncontrolled Resource Consumption. An attacker can supply a YAML document containing a chain of mappings that each merge the previous one via the merge key (<<), causing js-yaml to spend quadratic CPU time while parsing input whose size grows only linearly, resulting in a denial of service.

References: GHSA, CVE

To resolve this comment:
Check if you are using js-yaml on the CLI.

• If you're affected, upgrade this dependency to at least version 4.3.0 at yarn.lock.
• If you're not affected, comment /fp we don't use this [condition]

💬 Ignore this finding

To ignore this, reply with:

• /fp <comment> for false positive
• /ar <comment> for acceptable risk
• /other <comment> for all other reasons

If this violation is related to a license issue (MPL, GPL, LGPL, etc.), please reach out in #ask-legal to have the legal team review the offending package and ensure we fulfill our legal obligations around licensing software.

_{You can view more details on this finding in the Semgrep AppSec Platform here.}