chore(deps): bump jira.js from 5.4.0 to 6.1.0

[dependabot]

Bumps jira.js from 5.4.0 to 6.1.0.

Release notes

Sourced from jira.js's releases.

v6.1.0

Atlassian's specification lists the values it knows a field can hold, and that list falls behind the API it describes. Reading a project of a type the list has not caught up with was never an error — the response came back whole — but it printed a warning, once per project, that named neither the values it wanted nor the one it got. All three of those are fixed here.

Types

Nothing here changes what the library does at runtime. Every call that worked before works now, unchanged, and returns the same thing — the runtime only became more accepting. What may need a moment is TypeScript.

• Enums in response schemas accept values the specification has not caught up with. A field documented as 'software' | 'service_desk' | 'business' is now typed 'software' | 'service_desk' | 'business' | (string & {}). An editor still suggests the three; the compiler no longer insists on them.

  Most code needs no change. What stops compiling is code that relied on the narrowness: a switch with a never exhaustiveness check now needs a default, and an assignment into a narrower variable — or a call into a function with a narrow signature — needs the check you would write anyway. Narrowing still works exactly as before: if (project.projectTypeKey === 'software') gives you the literal.

  Properties that tell the branches of a union apart are unaffected: they stay closed, because that is what makes the union resolvable.

• Object types are declared as interfaces. The handful of models emitted as export type X = { … } — CompoundClause, the ConditionGroup* family, WorkflowCompoundCondition, LinkGroup, NotificationEvent, AttachmentInput and the rest — are export interface X { … }. The type they describe is identical; they now report themselves by name in an editor instead of unfolding into their own body, and you can extend them.

Bug Fixes

• projectTypeKey was missing two project types. product_discovery (Jira Product Discovery) and customer_service (Jira Customer Service) are now listed everywhere the field appears, in all three APIs. Atlassian's specification contradicts itself here — the same document lists four values on ProjectPayload and on the project-type operations, five on WorkflowCapabilities, and three on Project. Fixes #431.

• A mismatch on a listed value reported nothing usable. The message read expected invalid_value, got string, which is the name of zod's error code rather than a description of the problem. It now names the values the schema allows and the value that actually arrived — expected one of 'software' | 'service_desk' | 'business', got "product_discovery". Limits, formats and the other checks are spelled out the same way instead of surfacing as codes.

  The value is quoted only for a field the schema describes with a fixed list of values, which by construction cannot be holding free text. Everything else is still reported by type alone, so a response body never reaches a log.

• One bad field in a paginated response was reported once per element. The deduplication key included the array index, so a stale enum across four projects printed four identical warnings — and across five hundred, five hundred. Indices no longer distinguish one problem from another; the line that gets printed still points at a concrete element.

General

• The schema audit reports a grown enum as drift. It only ever understood one kind of gap — a key the API sends and the schema does not describe — so a value outside a documented set failed the run under the heading real breakage, not drift, which is the opposite of what it is. pnpm run audit:schemas now lists such fields in their own table, with the values seen and the values documented. This matters more than it did: an unlisted value no longer reaches a caller's log, so the audit is the only place left that can see one.

v6.0.0

6.0 replaces the transport, the client shape and the API surface. Read MIGRATION.md before upgrading — a codemod handles the mechanical parts, and the guide is explicit about who should not upgrade at all.

5.x is closed to features and receives security fixes and fixes for critical regressions until the end of 2026, when Atlassian Connect reaches end of support and the JWT users who cannot move have nothing left to stay for.

Breaking changes

• One platform surface. Version2Client and Version3Client are replaced by createCloudClient, generated from Jira's v3 specification. Rich text can still be written as a wiki-markup string; it is always read back as an Atlassian Document Format document.
• Factories instead of constructors. new XClient(config) → createCloudClient / createAgileClient / createServiceDeskClient, all of which accept one shared client so a single OAuth token state is reused.
• fetch instead of axios. middlewares, baseRequestConfig and newErrorHandling are gone, and AxiosError with them. Failures now arrive as typed errors with predicates — isNotFoundError, isRateLimitError and the rest.
• JWT (Atlassian Connect) is not supported. Stay on 5.x; see the support window below.
• ESM only, Node.js ≥ 22. The CommonJS build and the callback-style overloads are removed.
• One runtime dependency. zod, down from three — mime-types is replaced by a built-in table.
• Models built from a list of alternatives are unions rather than empty objects. CustomFieldContextDefaultValue — twenty-seven branches, discriminated on type — along with JqlQueryClause and the operand types beneath it, WorkflowCondition, were generated as {} and therefore accepted anything, and CustomContextVariable carried nothing but its discriminator. They now carry the alternatives the specification declares, so narrowing on type gives you the branch and building one by hand means naming it.

Features

• Runtime validation of responses, non-fatal by default. Every response is checked against its schema. A mismatch does not end the request: the body is returned unvalidated and the problem is reported once per distinct field, to stderr. Configure with onSchemaMismatch: 'warn' | 'silent' | 'throw' | (report) => void.

  The default is 'warn' because the shapes Jira sends vary with things a library cannot see — tenant locale, whether a feature is enabled, team-managed versus company-managed projects, an enum Atlassian grew without notice. None of those are your bug, and none should stop your program. Use 'throw' in a test suite, where a mismatch is the thing under test.

• SchemaMismatchError reports structurally. It carries report — endpoint, field paths, expected and received types — and no longer carries the response body. The body used to end up in every log line and error tracker that saw the error, carrying issue summaries, display names and custom field contents with it.

• A v5 → v6 codemod ships in the package. It rewrites client construction, authentication and imports, and leaves a TODO(jira.js@6) wherever a human has to decide — read every one of them.

... (truncated)

Changelog

Sourced from jira.js's changelog.

6.1.0

Atlassian's specification lists the values it knows a field can hold, and that list falls behind the API it describes. Reading a project of a type the list has not caught up with was never an error — the response came back whole — but it printed a warning, once per project, that named neither the values it wanted nor the one it got. All three of those are fixed here.

Types

Nothing here changes what the library does at runtime. Every call that worked before works now, unchanged, and returns the same thing — the runtime only became more accepting. What may need a moment is TypeScript.

• Enums in response schemas accept values the specification has not caught up with. A field documented as 'software' | 'service_desk' | 'business' is now typed 'software' | 'service_desk' | 'business' | (string & {}). An editor still suggests the three; the compiler no longer insists on them.

  Most code needs no change. What stops compiling is code that relied on the narrowness: a switch with a never exhaustiveness check now needs a default, and an assignment into a narrower variable — or a call into a function with a narrow signature — needs the check you would write anyway. Narrowing still works exactly as before: if (project.projectTypeKey === 'software') gives you the literal.

  Properties that tell the branches of a union apart are unaffected: they stay closed, because that is what makes the union resolvable.

• Object types are declared as interfaces. The handful of models emitted as export type X = { … } — CompoundClause, the ConditionGroup* family, WorkflowCompoundCondition, LinkGroup, NotificationEvent, AttachmentInput and the rest — are export interface X { … }. The type they describe is identical; they now report themselves by name in an editor instead of unfolding into their own body, and you can extend them.

Bug Fixes

• projectTypeKey was missing two project types. product_discovery (Jira Product Discovery) and customer_service (Jira Customer Service) are now listed everywhere the field appears, in all three APIs. Atlassian's specification contradicts itself here — the same document lists four values on ProjectPayload and on the project-type operations, five on WorkflowCapabilities, and three on Project. Fixes #431.

• A mismatch on a listed value reported nothing usable. The message read expected invalid_value, got string, which is the name of zod's error code rather than a description of the problem. It now names the values the schema allows and the value that actually arrived — expected one of 'software' | 'service_desk' | 'business', got "product_discovery". Limits, formats and the other checks are spelled out the same way instead of surfacing as codes.

  The value is quoted only for a field the schema describes with a fixed list of values, which by construction cannot be holding free text. Everything else is still reported by type alone, so a response body never reaches a log.

• One bad field in a paginated response was reported once per element. The deduplication key included the array index, so a stale enum across four projects printed four identical warnings — and across five hundred, five hundred. Indices no longer distinguish one problem from another; the line that gets printed still points at a concrete element.

General

• The schema audit reports a grown enum as drift. It only ever understood one kind of gap — a key the API sends and the schema does not describe — so a value outside a documented set failed the run under the heading real breakage, not drift, which is the opposite of what it is. pnpm run audit:schemas now lists such fields in their own table, with the values seen and the values documented. This matters more than it did: an unlisted value no longer reaches a caller's log, so the audit is the only place left that can see one.

6.0.0

6.0 replaces the transport, the client shape and the API surface. Read MIGRATION.md before upgrading — a codemod handles the mechanical parts, and the guide is explicit about who should not upgrade at all.

5.x is closed to features and receives security fixes and fixes for critical regressions until the end of 2026, when Atlassian Connect reaches end of support and the JWT users who cannot move have nothing left to stay for.

Breaking changes

• One platform surface. Version2Client and Version3Client are replaced by createCloudClient, generated from Jira's v3 specification. Rich text can still be written as a wiki-markup string; it is always read back as an Atlassian Document Format document.
• Factories instead of constructors. new XClient(config) → createCloudClient / createAgileClient / createServiceDeskClient, all of which accept one shared client so a single OAuth token state is reused.
• fetch instead of axios. middlewares, baseRequestConfig and newErrorHandling are gone, and AxiosError with them. Failures now arrive as typed errors with predicates — isNotFoundError, isRateLimitError and the rest.
• JWT (Atlassian Connect) is not supported. Stay on 5.x; see the support window below.
• ESM only, Node.js ≥ 22. The CommonJS build and the callback-style overloads are removed.
• One runtime dependency. zod, down from three — mime-types is replaced by a built-in table.
• Models built from a list of alternatives are unions rather than empty objects. CustomFieldContextDefaultValue — twenty-seven branches, discriminated on type — along with JqlQueryClause and the operand types beneath it, WorkflowCondition, were generated as {} and therefore accepted anything, and CustomContextVariable carried nothing but its discriminator. They now carry the alternatives the specification declares, so narrowing on type gives you the branch and building one by hand means naming it.

Features

• Runtime validation of responses, non-fatal by default. Every response is checked against its schema. A mismatch does not end the request: the body is returned unvalidated and the problem is reported once per distinct field, to stderr. Configure with onSchemaMismatch: 'warn' | 'silent' | 'throw' | (report) => void.

  The default is 'warn' because the shapes Jira sends vary with things a library cannot see — tenant locale, whether a feature is enabled, team-managed versus company-managed projects, an enum Atlassian grew without notice. None of those are your bug, and none should stop your program. Use 'throw' in a test suite, where a mismatch is the thing under test.

• SchemaMismatchError reports structurally. It carries report — endpoint, field paths, expected and received types — and no longer carries the response body. The body used to end up in every log line and error tracker that saw the error, carrying issue summaries, display names and custom field contents with it.

• A v5 → v6 codemod ships in the package. It rewrites client construction, authentication and imports, and leaves a TODO(jira.js@6) wherever a human has to decide — read every one of them.

... (truncated)

Commits

• bae4aa7 fix: an enum Atlassian has not caught up with stops printing warnings (#432)
• ef673d0 fix: two models stop collapsing to an empty object (#429)
• 6890909 test: prove the packed tarball works from a consumer project (#428)
• 1c4e779 fix: drop the generator's own package.json files from src (#427)
• 6b5a3c3 fix: the escapes Atlassian ships stop reaching the published JSDoc (#426)
• 44b99fa chore: retire the develop branch (#425)
• 3ae2543 fix: the API reference builds without warnings (#424)
• df10404 fix: restore the scripts the docs workflow calls (#423)
• 7d1d49d feat!: jira.js 6.0.0
• 34f1b31 ci: make the schema audit dispatchable (#422)
• See full diff in compare view

[github-actions]

Automated review from approve-and-automerge-dependabot-prs workflow in exivity/actions

[github-actions]

Automated review from approve-and-automerge-dependabot-prs workflow in exivity/actions

[github-actions]

Automated review from approve-and-automerge-dependabot-prs workflow in exivity/actions