chore(deps): bump @apidevtools/json-schema-ref-parser from 14.2.1 to 15.5.0

[dependabot]

Bumps @apidevtools/json-schema-ref-parser from 14.2.1 to 15.5.0.

Release notes

Sourced from @​apidevtools/json-schema-ref-parser's releases.

v15.5.0

15.5.0 (2026-07-09)

Bug Fixes

• stabilize cross-platform CI (8bfeec2)

Features

• handle cyclic reference chains safely (09959ba)

v15.4.0

15.4.0 (2026-06-19)

Features

• preserve compound schema refs when bundling (fa3cccb)

v15.3.6

15.3.6 (2026-06-11)

Bug Fixes

• block unsafe pointer set tokens (a786bc6)
• harden safe URL resolver (dea50b0)

v15.3.5

15.3.5 (2026-03-30)

Bug Fixes

• edge: fix some edge cases and add more tests (df7967e)

v15.3.4

15.3.4 (2026-03-27)

Reverts

• Revert "fix: support 2020-12 anchors and ref siblings" (f26d8c7)

v15.3.3

15.3.3 (2026-03-26)

... (truncated)

Commits

• a8e6b4d test: allow time for deep reference chain
• 8bfeec2 fix: stabilize cross-platform CI
• 09959ba feat: handle cyclic reference chains safely
• fa3cccb feat: preserve compound schema refs when bundling
• 53d0c1e Remove Claude config
• 5b1aee5 chore: migrate to pnpm
• dea50b0 fix: harden safe URL resolver
• a786bc6 fix: block unsafe pointer set tokens
• fddef8a versions and tests
• ecea9d5 test
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​apidevtools/json-schema-ref-parser since your current version.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
the-codegen-project	Error		Aug 1, 2026 7:08pm
the-codegen-project-mcp	Ready	Preview	Aug 1, 2026 7:08pm

[jonaslagoni]

Closing this in favour of #452, which consolidates the other open Dependabot PRs. This particular bump is being deliberately deferred rather than dropped — it needs a dedicated PR.

The CI here is red on every job, and the cause is structural:

1. v15 is ESM-only. It sets "type": "module" and ships no exports map and no CJS build. This package compiles to CommonJS (module: Node16, no "type": "module" in package.json), so the static import at src/codegen/inputs/openapi/parser.ts:2 fails with error TS1479: The current file is a CommonJS module whose imports will produce 'require' calls; however, the referenced file is an ECMAScript module and cannot be imported with 'require'. Fixable by converting to a dynamic await import() — the same file already uses that pattern at line 76.

2. A dynamic import alone is not sufficient. @readme/openapi-parser@5.0.1 pins @apidevtools/json-schema-ref-parser: ^14.1.1. Moving the root dependency to 15.x forks the tree, leaving the two dereference paths inside the same function running different majors. Deduping requires @readme/openapi-parser 6.3.1, which is a second user-visible major.

3. v15 changes dereferenced output. Two behaviour changes reach generated code: strict RFC 6901 pointer encoding (v14 over-escaped pointer segments with encodeURIComponent), and the new mergeKeys dereference option defaulting to true, which deep-merges sibling keys next to a $ref — a common OpenAPI pattern. Both feed the schemas handed to Modelina, and nothing in the current test suite covers that delta.

Also worth flagging for whoever picks this up: the v15.3.6 and v15.5.1 "safe URL resolver hardening" changes touch exactly the code path where this repo deliberately sets safeUrlResolver: false (src/utils/refResolvers.ts:35,87), and the hand-written browser shim at src/browser/shims/json-schema-ref-parser.ts mirrors the v14 surface.

Verified not breaking, to narrow the scope of that future PR: the $RefParser default export, .parse() / .resolve() / .bundle() / .dereference(), the {order, canRead, read} custom-resolver contract, all error classes, and engines.node (>=20 in both 14.2.1 and 15.5.1). @asyncapi/parser does not depend on this package, so the AsyncAPI input path is unaffected.

Note also that 15.5.1 is now out, so the 15.5.0 target here is already stale.

Dependabot will reopen this if it still applies after #452 lands.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.