[2.4.0 stack 18/18] Review rounds 3 to 5: holidays, date-fns business days, capitalize defaults, currency, words, CEP typed errors, subpath types, citations

.all-contributorsrc

@@ -30,7 +30,7 @@
 			"login": "matAlmeida",
 			"name": "Matheus Almeida",
 			"avatar_url": "https://avatars3.githubusercontent.com/u/12724212?v=4",
-			"profile": "http://matalmeida.me",
+			"profile": "https://github.com/matAlmeida",
 			"contributions": ["code", "doc", "test"]
 		},
 		{
@@ -100,7 +100,7 @@
 			"login": "rfoel",
 			"name": "Rafael Franco",
 			"avatar_url": "https://avatars3.githubusercontent.com/u/19496473?v=4",
-			"profile": "https://rfoel.com",
+			"profile": "https://github.com/rfoel",
 			"contributions": ["code", "doc"]
 		},
 		{
@@ -163,7 +163,7 @@
 			"login": "marceloabk",
 			"name": "Marcelo Cristiano",
 			"avatar_url": "https://avatars3.githubusercontent.com/u/11621153?v=4",
-			"profile": "http://www.engenhandosoftware.com.br/",
+			"profile": "https://github.com/marceloabk",
 			"contributions": ["code", "doc", "test"]
 		},
 		{

.github/CODEOWNERS

@@ -0,0 +1,8 @@
+# Code owners for this repository.
+#
+# @hyanmandian is the sole maintainer, so one catch-all rule covers everything.
+# GitHub requests a review from the owner on every pull request that touches a
+# matching path; combined with "Require review from Code Owners" in the branch
+# protection rules for `main`, it makes that review mandatory.
+
+* @hyanmandian

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -13,7 +13,7 @@ body:
     attributes:
       label: Package version
       description: Which version of `@brazilian-utils/brazilian-utils` are you using?
-      placeholder: "2.3.0"
+      placeholder: "2.4.0"
     validations:
       required: true
 
@@ -77,5 +77,5 @@ body:
       options:
         - label: I searched existing issues and this hasn't been reported yet.
           required: true
-        - label: I'm using a version listed in [SECURITY.md](../../SECURITY.md#supported-versions) as supported.
+        - label: I'm using a version listed in [SECURITY.md](https://github.com/brazilian-utils/javascript/blob/main/SECURITY.md#supported-versions) as supported.
           required: false

.github/PULL_REQUEST_TEMPLATE.md

@@ -9,7 +9,8 @@
 - [ ] I updated the documentation if this adds/changes a utility, in **both**:
   - [ ] `docs/utilities.md` (English)
   - [ ] `docs/pt-br/utilities.md` (Portuguese)
-- [ ] `npm check` passes locally (format, lint, types).
+- [ ] `npm run check` passes locally (format, lint, types).
+- [ ] I ran `npm run build:llms` if I touched `docs/utilities.md` (the Check workflow fails when `docs/llms.txt` is stale).
 - [ ] This change does not introduce a breaking change, **or** I flagged it clearly below and it was discussed with maintainers beforehand.
 - [ ] This change does not add any runtime dependency (this library is zero-runtime-dependency by design).
 

.github/actionlint.yaml

@@ -0,0 +1,7 @@
+# actionlint 1.7.12 does not know GitHub's self-repository `uses: $/...` syntax yet
+# (https://github.com/rhysd/actionlint/issues/711); zizmor's self-repository audit and the GitHub
+# docs recommend it over the workspace-relative `./...` form. Drop this once actionlint supports it.
+paths:
+  .github/workflows/**/*.yml:
+    ignore:
+      - 'specifying action "\$/\.github/actions/setup" in invalid format because ref is missing'

.github/workflows/build.yml

@@ -26,7 +26,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup
-        uses: ./.github/actions/setup
+        uses: $/.github/actions/setup
 
       - name: Run build
         run: vp run build
@@ -52,7 +52,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup
-        uses: ./.github/actions/setup
+        uses: $/.github/actions/setup
 
       - name: Checkout base
         if: ${{ github.event_name == 'pull_request' }}
@@ -69,26 +69,27 @@ jobs:
         if: ${{ github.event_name == 'pull_request' }}
         id: base
         run: |
-          if [ -f base/scripts/tree-shaking.ts ]; then
-            node scripts/tree-shaking.ts --json head.json
-            (cd base && npm ci && npm run build && node scripts/tree-shaking.ts --json ../base.json --surviving ../head.json) || true
-          fi
-          if [ -f base.json ]; then
-            echo "measured=true" >> "$GITHUB_OUTPUT"
-          else
+          if [ ! -f base/scripts/tree-shaking.ts ]; then
             echo "measured=false" >> "$GITHUB_OUTPUT"
+            exit 0
           fi
+          node scripts/tree-shaking.ts --json head.json
+          (cd base && npm ci && npm run build && node scripts/tree-shaking.ts --json ../base.json --surviving ../head.json)
+          echo "measured=true" >> "$GITHUB_OUTPUT"
 
       - name: Compare against base
         if: ${{ github.event_name == 'pull_request' }}
         id: compare
         continue-on-error: true
         run: |
           if [ "${{ steps.base.outputs.measured }}" = "true" ]; then
+            code=2
+            echo "code=$code" >> "$GITHUB_OUTPUT"
             set +e
             node scripts/tree-shaking.ts --compare base.json --markdown tree-shaking.md
             code=$?
             set -e
+            case "$code" in 0 | 1) ;; *) code=2 ;; esac
             echo "code=$code" >> "$GITHUB_OUTPUT"
             exit "$code"
           else

.github/workflows/check.yml

@@ -27,7 +27,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup
-        uses: ./.github/actions/setup
+        uses: $/.github/actions/setup
 
       - name: Run checks
         run: vp check

.github/workflows/datasets.yml

@@ -23,7 +23,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup
-        uses: ./.github/actions/setup
+        uses: $/.github/actions/setup
 
       - name: Rebuild datasets
         run: npm run build:data

.github/workflows/live-tests.yml

@@ -22,8 +22,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup
-        uses: ./.github/actions/setup
+        uses: $/.github/actions/setup
 
       - name: Run live CEP tests
         run: vp run test:live
-        continue-on-error: false

.github/workflows/mutation.yml

@@ -26,11 +26,20 @@ jobs:
           persist-credentials: false
 
       - name: Setup
-        uses: ./.github/actions/setup
+        uses: $/.github/actions/setup
 
       - name: Mutation test every file
+        if: ${{ github.event_name != 'push' }}
         run: npm run test:mutation
 
+      # On `main` the dashboard reporter also publishes the score to dashboard.stryker-mutator.io;
+      # pull requests keep the local reporters only, so a fork never needs the key.
+      - name: Mutation test every file and publish the score
+        if: ${{ github.event_name == 'push' }}
+        env:
+          STRYKER_DASHBOARD_API_KEY: ${{ secrets.STRYKER_DASHBOARD_API_KEY }}
+        run: npm run test:mutation -- --reporters clear-text,progress,html,json,dashboard
+
       - name: Upload the mutation report
         if: ${{ always() }}
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1

.github/workflows/release.yml

@@ -83,7 +83,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup
-        uses: ./.github/actions/setup
+        uses: $/.github/actions/setup
         with:
           node-version: 24
 
@@ -104,6 +104,7 @@ jobs:
           cat tree-shaking.md >> "$GITHUB_STEP_SUMMARY"
 
       - name: Ensure npm supports staged publishing and OIDC (npm >= 11.15)
+        # zizmor: ignore[adhoc-packages] npm is pinned to an exact version and is not a package.json dependency
         run: npm install -g npm@12.0.2
 
       - name: Stage on npm
@@ -126,7 +127,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup
-        uses: ./.github/actions/setup
+        uses: $/.github/actions/setup
 
       - name: Generate the CycloneDX SBOM of the published package
         # The package has no runtime dependencies, so the SBOM describes the package itself;

.github/workflows/tests.yml

@@ -29,7 +29,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup
-        uses: ./.github/actions/setup
+        uses: $/.github/actions/setup
         with:
           node-version: ${{ matrix.node-version }}
 
@@ -65,7 +65,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup
-        uses: ./.github/actions/setup
+        uses: $/.github/actions/setup
 
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
@@ -85,7 +85,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup
-        uses: ./.github/actions/setup
+        uses: $/.github/actions/setup
 
       - name: Setup Deno
         uses: denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed # v2.0.5
@@ -110,7 +110,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup
-        uses: ./.github/actions/setup
+        uses: $/.github/actions/setup
 
       - name: Run tests in ${{ matrix.browser }}
         run: vp test --browser.enabled --browser.name=${{ matrix.browser }}
@@ -127,7 +127,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup
-        uses: ./.github/actions/setup
+        uses: $/.github/actions/setup
 
       - name: Run tests in Safari
         run: vp test --browser.enabled --browser.name=safari --browser.headless=false

.gitignore

@@ -7,4 +7,10 @@ node_modules
 dist
 coverage
 .stryker-tmp
-reports
+# Every report is generated (stryker, coverage, jscpd) except the API Extractor baseline, which is
+# committed so that `npm run check:api` compares the public API against the reviewed one instead of
+# writing a new file on every run.
+reports/*
+!reports/api/
+reports/api/*
+!reports/api/brazilian-utils.api.md

CHANGELOG.md

@@ -2,10 +2,11 @@
 
 All notable changes to this project will be documented in this file.
 
-The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
-and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+The entries are generated by [release-please](https://github.com/googleapis/release-please) from the
+[Conventional Commits](https://www.conventionalcommits.org/en/v1.0.0/) history, and this project adheres
+to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [2.3.0](https://github.com/brazilian-utils/javascript/compare/2.2.0...2.3.0) (2026-04-09)
+## [2.3.0](https://github.com/brazilian-utils/javascript/compare/2.2.0...2.3.0) (2026-04-08)
 
 ### Features
 
@@ -193,5 +194,3 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - 🎡 adjust travis config ([0ec107f](https://github.com/brazilian-utils/javascript/commit/0ec107f1ebee536e15a6bb991750342457bf1a44))
 - 🎡 rename travis file ([25da01e](https://github.com/brazilian-utils/javascript/commit/25da01e5c700c17c3e88217c4bf272f5eef5639a))
-
-[Unreleased]: https://github.com/brazilian-utils/javascript/compare/2.3.0...HEAD