Repository navigation
chore(deps-dev): update @hey-api/openapi-ts and regenerate client (TS7-compatible) - #1367
Merged
Merged
Conversation
…client Bumps @hey-api/openapi-ts 0.95.0 -> 0.99.0 (picks up the buildClientParams prototype-pollution fix, GHSA-hhx9-57xq-r5rw / CVE-2026-48819) and regenerates src/client against the production gateway schema. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Contributor
📦 Bundle Size Report
Size Limits
Largest Files (Top 5)
View All Files (74 total)
✅ Bundle size check passed |
Contributor
|
Deploy preview for adp-cost-calculator ready!
Deployed with vercel-action |
Contributor
|
Deploy preview for remote-flows ready!
Deployed with vercel-action |
Contributor
📊 Coverage Report⚪ Coverage unchanged
Detailed BreakdownLines Coverage
Statements Coverage
Functions Coverage
Branches Coverage
✅ Coverage check passed |
…7 compat The stable 0.99.0 (and every prior release) crashes when generating under this repo's pinned typescript@7.0.2, since its peerDependencies cap at TypeScript 6.x (upstream: hey-api/hey-api#4235). The next prerelease drops the typescript dependency entirely, so `npm run openapi-ts` works out of the box again with no local workaround needed. Regenerated src/client with this version; diff vs the previous commit is comment-indentation only in sdk.gen.ts/types.gen.ts (a known cosmetic quirk in this prerelease's doc-comment dedent logic), no type/behavior changes. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
gabrielseco
changed the title
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit edad2ac. Configure here.
This was referenced Sep 23, 2026
jordividaller
approved these changes
Sep 24, 2026
gabrielseco
added a commit
that referenced
this pull request
Sep 24, 2026
#1368) * ci: smoke-test that npm run openapi-ts still works on dependency bumps Nothing in CI actually exercises the openapi-ts codegen path today, so a dependency bump that breaks it (e.g. the typescript 6->7 migration in #1325, which broke @hey-api/openapi-ts's peer-dependency compatibility — see #1367) only surfaces when someone manually regenerates the client. Runs on any PR touching package.json/package-lock.json rather than just @hey-api/openapi-ts's own line, since the actual trigger can be any dependency in that graph. Only fails on a nonzero exit (the generator crashing) — deliberately does not diff the regenerated output against what's committed, since the production schema drifts independently of any given PR and a diff there isn't itself a failure. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * ci: drop comment from openapi codegen smoke-test workflow Rationale belongs in the PR description, not a multi-line comment block. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Updates the
@hey-api/openapi-tscode generator and regenerates the API client from the production gateway schema. No behavior change for consumers of this package.Why
Follows up on renovate PR #1137, which proposed bumping
@hey-api/openapi-ts(0.95.0 → 0.97.3) to pick up a fix for a prototype-pollution issue in the generatedbuildClientParamshelper (CVE-2026-48819 / GHSA-hhx9-57xq-r5rw).While doing this, I found
npm run openapi-tswas broken onmain:@hey-api/openapi-ts(every stable release up to and including 0.99.0) crashes under this repo's pinnedtypescript@7.0.2(Cannot read properties of undefined (reading 'AnyKeyword')), because itspeerDependenciescap at TypeScript 6.x — see hey-api/hey-api#4235. This PR fixes that rather than just bumping past it: it pins@hey-api/openapi-tsto thenextprerelease tag, which drops thetypescriptdependency entirely (confirmed: nopeerDependenciesfield in itspackage.jsonat all), so codegen works cleanly again with no local workaround.I also tried the officially-documented TS6/TS7 side-by-side npm alias approach first, scoped via
package.jsonoverridesto just@hey-api/openapi-ts's owntypescriptresolution — but npm's peer-dependency resolver won't isolate a conflicting peer dep that way (even with--force, it just leaves the tree in an invalid state), so thenextprerelease is the actual fix that landed here.engines.nodeinpackage.jsonis left untouched — CI already runs Node 24.15.0, that field is unrelated to this generator bump.What changed
Toggle details
@hey-api/openapi-tsdevDependency:0.95.0→0.0.0-next-20260824173136(exact-pinned; this is a prerelease tag, not a normal semver bump — worth revisiting once a stable release ships with the TS7 fix, tracked via the linked upstream issue).src/client/**/*.gen.tsregenerated vianpm run openapi-tsagainst the production gateway.ClientMeta,Auth.key), and thebuildClientParams/stripEmptySlotshardening from the CVE fix (slots built withObject.create(null)instead of{}, guarding against__proto__-keyed input).nextprerelease has a minor cosmetic regression: multi-line JSDoc descriptions from the OpenAPI spec are left with inconsistent leading whitespace (dedent logic quirk) in a handful ofsdk.gen.ts/types.gen.tscomments. No type or behavior changes — diffed the 0.99.0-generated output against thenext-generated output and confirmed the only differences are comment whitespace.src/index.tsx.Screenshots
N/A
Related Resources
Testing