5.0.0 (2026-09-30)

feat!: delete the three deprecated delegating aliases (#316) (0a90c24), closes #307
feat!: make zod, pino, uuid and short-uuid optional peer dependencies (#319) (a8ce0b6), closes #308
feat(crypto)!: move ./crypto to async Web Crypto so it runs in every runtime (#318) (6347c70), closes #309
feat(exports)!: drop the root entry point (#275) (149e5d7), closes package.json#exports #259

abort: honour already-aborted signals and signal.reason (#312) (285a8ef), closes #286
ci: stop cancelling release runs on main (#235) (23fff99)
date: clamp addMonths to the last day of the target month (#322) (482e8cd), closes #290
date: count daysBetween in local wall-clock time across DST (#291) (3260ccc), closes #289
fetch: honour caller signal and time out the body read in fetchWithTimeout (#313) (28fbc6a), closes #285
regex: escape - and / in escapeRegExp (#300) (364ff01), closes #287
skill: re-audit module exports table and guard it in CI (#276) (0caa67f), closes #275 #260
strings: make reverse and truncate grapheme-safe (#292) (6b2d4e9), closes #288
system: detect iOS and Android before macOS and Linux (#298) (4638625), closes #294 #297 #297

arrays: add partition, sortBy and zip (#269) (5fe78e1), closes #262
date: add isWeekday predicate (#267) (d12495c), closes #263
numbers: add signed option to formatPercent (#270) (0cc2cfd), closes #265
numbers: add variance, stdDev, median and percentile (#268) (012e402), closes #261
promises: add mapLimit for concurrency-capped mapping (#315) (639c0f3), closes #305
promises: add retry with exponential backoff, jitter and AbortSignal (#317) (06db2ff), closes #304
scripts: catch near-duplicate exports in the boundary check (#240) (7f03e45), closes #239 #239
try: add tryCatchSync, a synchronous counterpart to tryCatch (#266) (81da16a), closes #264

url: validate with URL.canParse instead of try/catch (#250) (c560ce7), closes #244

consumers of ./env must add zod, ./logger must add pino, and
./uuid must add uuid and short-uuid. See the migration guide.
hashString and hmacHash are async and return
Promise; md5 and non-SHA algorithms are no longer accepted;
security.generateSecureToken is removed (use crypto.randomHex(32) to keep
the 64-char token); base64Decode throws on non-standard base64 input.
validation.isEmail, validation.isUrl and os.getOsPlatform
are removed. Use isValidEmail from ./emails, isValidUrl from ./url and
getProcessPlatform from ./process.

Co-authored-by: Richard Torcato rtorcato@me.com

import { x } from '@rtorcato/js-common' (the root entry
point) no longer resolves. Import from the subpath instead:
import { x } from '@rtorcato/js-common/<module>'. See the "4.x → 5.x"
section of the migration guide.

Navigation Menu