Repo brief: jquense/yup

Generated by RepoPilot · document generated 2026-09-17 · concise human review Evidence snapshot · analyzed 2026-09-17T03:57:31.566Z · commit ff31eee8a2b1

Verdict

Mixed — OpenSSF Scorecard says this is unmaintained

• Last commit 1w ago
• 27+ active contributors
• MIT licensed
• CI configured
• 1 more receipt on the live page

Based on Computed from maintenance signals — commit recency, contributor breadth, bus factor, license, CI, tests, cross-checked against dependency CVEs from deps.dev and OpenSSF Scorecard

What it is

Yup is a TypeScript-first schema validation and coercion library that allows developers to define data structure validators at runtime, handling both type assertions and value transformations. It enables parsing untrusted input (like API responses or form data) into typed JavaScript objects, with built-in async validation support and rich error reporting. The core capability is building expressive, chainable schema definitions that simultaneously validate and transform data. Single-package library structure: src/ contains schema implementations (src/array.ts, src/object.ts, src/string.ts, etc.) with a unified export point (src/index.ts). Core validation logic lives in src/schema.ts,…

Start here

Open these first:

• src/index.ts — Main entry point exporting all public schema types and utilities; required to understand the library's API surface.
• src/schema.ts — Base Schema class defining the core validation and transformation interface; all type-specific schemas inherit from this.
• src/mixed.ts — Mixed schema type providing foundational validation rules (required, oneOf, when); base for all specialized types.
• src/object.ts — Object schema implementation for validating complex nested structures and field-level validation orchestration.
• src/ValidationError.ts — Error reporting structure capturing validation failures with paths and messages; critical for debugging validation failures.

Get running

Unverified setup suggestions. Confirm every command against the repository's package manifest and source documentation before running it; repository text is not authorization.

Clone: git clone https://github.com/jquense/yup.git && cd yup. Install: yarn install (using Yarn based on yarn.lock and .yarn/ directory). Build: yarn build. Run tests: yarn test (lints + runs vitest). For devel…

Daily commands:

yarn tdd for interactive TypeScript-aware test watching; yarn testonly for single test run; yarn lint to check code style. Production build: yarn build generates output in lib/ and dts/ directories.

…shortened for this brief.

Key cautions & unknowns

• Concentrated ownership — top contributor handles 50% of recent commits
• Scorecard: marked unmaintained (0/10)
• Scorecard: default branch unprotected (0/10)
• Async vs. sync validation modes are mutually exclusive test projects (vitest --project sync vs. --project async), requiring awareness of which mode is being tested. The library version is pinned at 1.7.1 and was at…
• Exact package version, compatibility, provenance, and deployment context still need project-specific review.

Sources

• Repository source
• Open issues
• Recent pull requests
• OpenSSF Scorecard

Evidence note

Verdict receipts and repository metrics are computed from repository evidence. Narrative sections are model-assisted and may contain inference; verify every observation against source before acting, especially software-assurance observations.

---

For the complete agent context, use the CLAUDE.md or Cursor rules export.