build(deps-dev): Bump @hey-api/openapi-ts from 0.76.0 to 0.99.0

[dependabot]

Bumps @hey-api/openapi-ts from 0.76.0 to 0.99.0.

Release notes

Sourced from @​hey-api/openapi-ts's releases.

@​hey-api/openapi-ts@​0.95.0

Minor Changes

• plugin(valibot): remove request data schema (#3671) (96f60ad) by @​mrlubos

Validator request schemas

Valibot plugin no longer exports composite request Data schemas. Instead, each layer is exported as a separate schema. If you're using validators with SDKs, you can preserve the composite schema with shouldExtract:

export default {
  input: "hey-api/backend", // sign up at app.heyapi.dev
  output: "src/client",
  plugins: [
    // ...other plugins
    {
      name: "sdk",
      validator: "valibot",
    },
    {
      name: "valibot",
      requests: {
        shouldExtract: true,
      },
    },
  ],
};

• internal: remove plugin.getSymbol() function (#3671) (96f60ad) by @​mrlubos

Removed plugin.getSymbol() function

This function has been removed. You can use plugin.querySymbol() instead. It accepts the same arguments and returns the same result.

• plugin(zod): remove request data schema (#3671) (96f60ad) by @​mrlubos

Validator request schemas

Zod plugin no longer exports composite request Data schemas. Instead, each layer is exported as a separate schema. If you're using validators with SDKs, you can preserve the composite schema with shouldExtract:

export default {
  input: "hey-api/backend", // sign up at app.heyapi.dev
  output: "src/client",
  plugins: [
    // ...other plugins
    {
      name: "sdk",
      validator: "zod",
</tr></table> 

... (truncated)

Changelog

Sourced from @​hey-api/openapi-ts's changelog.

0.99.0

Minor Changes

• BREAKING plugin: rename .symbols to .imports (#4052) (57fac5e) by @​mrlubos

To better represent its functionality, the plugin.symbols property has been renamed to plugin.imports.

• BREAKING config: merge duplicate plugin configurations (089ed2e) by @​mrlubos

Plugin duplicates behavior

If you specified the same plugin multiple times, only the last instance would be used. We eventually added a warning for this behavior, but that didn't treat the root issue. This release changes that by merging duplicate plugin configurations.

• BREAKING plugin(@​hey-api/schemas): widen schema type in nameBuilder to unknown (#4076) (98ce35e) by @​mrlubos

• BREAKING plugin: remove .external() method (#4052) (57fac5e) by @​mrlubos

Removed plugin.external() function

This function was used to reference external symbols. All plugins now use the Imports API, which allows you to reference external symbols in a type-safe way through plugin.imports.

Patch Changes

• api: replace ~ fields with $ (#4086) (d5ca286) by @​mrlubos

• config: add Presets API (3b4ee7a) by @​mrlubos

• plugin(@​hey-api/client-angular): fix: send an empty object request body when explicitly provided in flat parameters mode (#4070) (ab522ef) by @​matthewjamesadam

• client: use getBaseUrl() function to determine default value (#3772) (4026955) by @​mrlubos

• plugin(zod): improve discriminator handling (680b947) by @​mrlubos

• plugin(@​tanstack/preact-query): fix: strip initialData from the inferred result types for infinite query options (7a4b0cf) by @​mrlubos

• plugin(@​tanstack/solid-query): fix: strip initialData from the inferred result types for infinite query options (7a4b0cf) by @​mrlubos

• plugin(valibot): support custom regular expression error messages with x-pattern-message (#4117) (3ed3afb) by @​pullfrog

• plugin(@​hey-api/client-next): fix: send an empty object request body when explicitly provided in flat parameters mode (#4070) (f6d4512) by @​matthewjamesadam

• plugin(@​hey-api/client-axios): fix: send an empty object request body when explicitly provided in flat parameters mode (#4070) (f6d4512) by @​matthewjamesadam

• plugin(zod): support creating optional request schemas (11315c7) by @​mrlubos

• plugin(@​tanstack/react-query): fix: strip initialData from the inferred result types for infinite query options (7a4b0cf) by @​mrlubos

• plugin(@​hey-api/client-ky): fix: send an empty object request body when explicitly provided in flat parameters mode (#4070) (f6d4512) by @​matthewjamesadam

... (truncated)

Commits

• 8f3eb72 ci: release
• 3ed3afb docs: add changesets
• 66bc2b7 feat: support x-pattern-message extension in Zod and Valibot validator plugins
• 7b83c97 test: update snapshots
• 020df93 feat(faker): first implementation
• a3338ac test: update snapshots
• 307e020 test: update snapshots
• 835c230 chore: more cleanup
• 1490b05 test: update snapshots
• 9e6bdde chore: clean up
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​hey-api/openapi-ts since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

PR-Codex overview

This PR focuses on updating various dependencies across multiple packages, primarily upgrading @hey-api/openapi-ts from version 0.76.0 to 0.99.0, and making several version adjustments in the pnpm-lock.yaml file.

Detailed summary

• Updated @hey-api/openapi-ts from 0.76.0 to 0.99.0 in:
  • packages/api/package.json
  • packages/engine/package.json
  • packages/nebula/package.json
  • packages/insight/package.json
• Adjusted versions of several packages in pnpm-lock.yaml, including:
  • Updated next and related dependencies.
  • Updated @babel/core and other Babel-related packages to version 7.29.7.
  • Updated utf-8-validate and bufferutil versions.
• Minor adjustments to package resolutions and versions across various dependencies.

The following files were skipped due to too many changes: pnpm-lock.yaml

✨ Ask PR-Codex anything about this PR by commenting with /codex {your question}

[changeset-bot]

⚠️ No Changeset found

Latest commit: b3fdd79

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs-v2	Ready	Preview	Aug 17, 2026 8:53pm
nebula	Ready	Preview	Aug 17, 2026 8:53pm
thirdweb_playground	Error		Aug 17, 2026 8:53pm
thirdweb-www	Ready	Preview	Aug 17, 2026 8:53pm
wallet-ui	Ready	Preview	Aug 17, 2026 8:53pm

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​wagmi/​cli@​2.10.0
	@​hey-api/​openapi-ts@​0.99.0

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm @walletconnect/sign-client is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → npm/@abstract-foundation/agw-react@1.10.0 → npm/@walletconnect/sign-client@2.23.7 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@walletconnect/sign-client@2.23.7. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm js-yaml is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → npm/@hey-api/openapi-ts@0.99.0 → npm/js-yaml@4.2.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/js-yaml@4.2.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm yargs is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → npm/@coinbase/wallet-mobile-sdk@1.1.2 → npm/expo-application@6.0.1 → npm/@mobile-wallet-protocol/client@1.0.0 → npm/vitest@3.2.4 → npm/expo-linking@8.0.8 → npm/@abstract-foundation/agw-react@1.10.0 → npm/expo-web-browser@15.0.9 → npm/wagmi@2.19.4 → npm/yargs@17.7.3 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/yargs@17.7.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report