feat(deps): bump dependencies across majors

[mfal]

Major-version bumps of runtime dependencies. No devDependencies, no peerDependencies. Nine commits, one per package or coupled group, so anything contentious can be dropped individually.

Generated client output is byte-identical — verified by regenerating after every generator-affecting bump. See "One bug that only regeneration caught" below for why that check earned its keep.

Landed

package	workspace	from → to	commit
camelcase	generator	^8.0.0 → ^9.0.0	934dda65
dot-prop	generator	^8.0.2 → ^10.2.0	0229cf91
get-stdin	generator	^9.0.0 → ^10.0.0	ef922487
js-yaml	generator	^4.1.0 → ^5.4.1	ae50075f
object-code	models	^1.3.4 → ^2.0.0	48769d9c
context	models	^3.0.33 → ^4.0.17	1b11ee36
zod / zod-validation-error	generator	^3.25.76 → ^4.4.3 / ^3.5.3 → ^5.0.0	3e9e7e2c
@sindresorhus/is	generator	^6.3.1 → ^8.1.0	7a918a19
@oclif/core, plugin-plugins, plugin-help	generator	^3.27.0 → ^4.14.0, ^4.3.10 → ^5.5.2, ^6.2.33 → ^6.3.0	8b2c7280

Held back by npmMinimalAgeGate (all published 2026-08-31, so inside the 7-day window): @oclif/core@5, @oclif/plugin-help@7, @oclif/plugin-plugins@6, type-fest@5.9.0, zod@4.5.x. I took the newest installable tier instead — oclif core v4 + plugin-plugins v5, with plugin-help staying on 6.3.0 since both plugins peer on core ^4. The 5/7/6 tier is a coherent follow-up once the gate lapses (~2026-09-07).

One bug that only regeneration caught

@sindresorhus/is v8 no longer returns true from is.nonEmptyObject() for arrays. That made the is.array() branch in componentRefsToCustomTypes.ts dead code, so $refs nested inside arrays were never rewritten and generation aborted:

MissingPointerError: Missing $ref pointer "#/components/schemas/extension.SubscriptionBasedContract"

Build, typecheck, lint and the full unit-test suite all passed with this bug present. Only regenerating the client surfaced it. Fixed by checking arrays first, plus a new unit test covering a $ref inside an array — confirmed failing without the fix.

Worth noting for the repo generally: test:client-generation-clean is a bare git diff --exit-code and nothing in CI runs build:client-prod, so this class of defect is invisible to the PR pipeline.

Other code changes

• packages/generator/src/lib/makeError.ts — dot-prop v10 narrowed getProperty's return for unknown objects, so ?? "Error" widened to {}. Switched to dot-prop's own defaultValue argument.
• Removed @types/js-yaml from generator dependencies — js-yaml v5 ships its own types, and --traceResolution confirmed the stale v4 package was still being injected as a global type reference.

Behaviour change worth a decision: js-yaml v5

v5 narrows the default load schema to CORE_SCHEMA. Timestamp-looking scalars now load as strings rather than Date, and !!binary throws.

This repo's own specs are JSON, so nothing here changes and the generated output is unaffected. But @mittwald/api-code-generator is published, and third-party consumers who feed the CLI a YAML spec containing an unquoted date-like scalar (e.g. example: 2024-01-01) will see different parse results.

I did not mark this feat!:. The reasoning, so you can overrule it: the generated output is unchanged, the affected surface is narrow, and a ! here would cut 5.0.0 across every package for a YAML-parsing nuance in the generator CLI. But note that #300 (file uploads) already proposes a major — if you take that one, this rides along at no extra cost, and the two are best decided together.

Excluded, with evidence

type-fest 4 → 5 — breaks the client's central public request type. NullableOnNoRequiredKeysDeep<{foo: string}> resolves to {foo?: string} | null instead of {foo: string}; the pieces evaluate correctly in isolation, so it is a deferred-evaluation interaction inside the recursive conditional. The alarming part is the fourth error: required path parameters silently stop being type-enforced.

src/core/Request.ts(60,39): error TS2638: Type 'NonNullable<RequestObject<TOp>>' may represent a primitive value, which is not permitted as the right operand of the 'in' operator.
src/core/Request.ts(65,42): error TS2638: ...
src/core/Request.ts(74,50): error TS2638: ...
src/types/RequestFunction.test-types.ts(38,3): error TS2578: Unused '@ts-expect-error' directive.

(The minor line, #301, independently drops type-fest at ^4.39.1 for the same loss of enforcement — boundary bisected there as 4.38.0 clean / 4.39.1 broken.)

json-schema-to-typescript 15 → 16 — this one changes generated client output, so it must not ride along in a dependency batch. Builds, typechecks and lints clean, but regeneration produces 164 insertions / 132 deletions across v2/types.ts and v3-next/types.ts in two categories: ~120 redundant (T | null) | null nestings (inert but noisy in published .d.ts), and 2 index-signature widenings ([k: string]: string → string | …Reason) which are a genuine public type change. Needs its own PR with a deliberate regeneration commit and a breaking-change call.

dinero.js 1 → 2 — a full functional rewrite: no default export, and defaultCurrency / defaultPrecision / globalLocale plus all chainable methods are gone.

src/base/Money.ts(1,8): error TS2613: Module '".../dinero.js/dist/esm/index"' has no default export.

Money is re-exported as a public type on Article.price and ContributorIncomingInvoice.totalNet/totalGross, so this means redesigning a public abstraction. Also note for whoever takes it: dinero v2 ships its own types, so @types/dinero.js@^1.9.4 in models' devDependencies must be removed as part of that migration, not bumped (the v2 stub is deprecated and would strip the types).

Verification

yarn install --immutable · yarn lint (4 projects) · nx run-many -t build --skip-nx-cache (4) · test:compile --skip-nx-cache · test --skip-nx-cache (4 projects / 9 tasks, incl. test:client-generation-clean) — all pass on the committed state.

Beyond the standard suite: the client was regenerated after every generator-affecting bump (final output byte-identical, git status clean); the CLI was exercised end-to-end for oclif (acg --help, validate happy and error paths); and for js-yaml a spec was generated from equivalent YAML and confirmed byte-identical to the JSON-generated output.

🤖 Generated with Claude Code