fix(api): disable path-param queries explicitly, then bump orval to 8.26.0

[paulvanbrenk]

orval changed the guard it generates for a required path param:

- enabled: !!(id)
+ enabled: id !== null && id !== undefined

That was a deliberate upstream fix, not a regression -- orval-labs/orval#3241
("0 as param causes query to be disabled") reported that a legitimate 0
disabled the query, and #3325 replaced the truthiness test with a null check.
It shipped in 8.10.0, so every version worth upgrading to has it.

The consequence for us is that an empty string now passes the guard. Left
alone, usePackage('') would issue GET /api/packages/. Two existing tests
in hooks.test.tsx caught this, which is the only reason it was noticed.

So the hooks now say what they mean instead of leaning on generated
truthiness. This matches what the file already did elsewhere -- useGithubSearch
has enabled: query.length >= 2 and the watchlist hook has enabled: !!user:

usePackage(id) enabled: !!id
useRelease(id) enabled: !!id
usePackageReleases(packageId) enabled: !!packageId
usePackagesByOwner(owner) enabled: !!owner
usePackageByOwnerRepo(owner, repo) enabled: !!(owner && repo)

The generated code spreads ...queryOptions after enabled, so the caller's
value wins. Three of those five had no empty-param test, and the guards are now
the only thing standing between an empty value and a malformed request, so they
are covered directly -- each new test was confirmed to fail with its guard
removed.

On the version choice: 8.26.0 rather than 8.27.0 or 8.28.0. The current
latest, 8.28.0, is uninstallable -- it depends on @orval/angular@8.28.0,
which was never published (8.28.1 is queued upstream but not out). Between
8.26.0 and 8.27.0 the generated output differs only by extracting mutation
keys into exported get*MutationKey() helpers, which nothing here uses, so
8.26.0 costs nothing and has eleven days of soak rather than five. Pinned
exact, no caret, given they just shipped a broken latest.

This does not unblock TypeScript 7. That is a separate problem -- orval
rejects the aliased typescript spec as invalid semver -- and it is removed
by the oxlint migration, not by any orval version.

Co-Authored-By: Claude Opus 5 (1M context) noreply@anthropic.com

---

_{Stack created with GitHub Stacks CLI • Give Feedback 💬}

[paulvanbrenk]

orval changed the guard it generates for a required path param:

- enabled: !!(id)
+ enabled: id !== null && id !== undefined

That was a deliberate upstream fix, not a regression -- orval-labs/orval#3241
("0 as param causes query to be disabled") reported that a legitimate 0
disabled the query, and #3325 replaced the truthiness test with a null check.
It shipped in 8.10.0, so every version worth upgrading to has it.

The consequence for us is that an empty string now passes the guard. Left
alone, usePackage('') would issue GET /api/packages/. Two existing tests
in hooks.test.tsx caught this, which is the only reason it was noticed.

So the hooks now say what they mean instead of leaning on generated
truthiness. This matches what the file already did elsewhere -- useGithubSearch
has enabled: query.length >= 2 and the watchlist hook has enabled: !!user:

usePackage(id) enabled: !!id
useRelease(id) enabled: !!id
usePackageReleases(packageId) enabled: !!packageId
usePackagesByOwner(owner) enabled: !!owner
usePackageByOwnerRepo(owner, repo) enabled: !!(owner && repo)

The generated code spreads ...queryOptions after enabled, so the caller's
value wins. Three of those five had no empty-param test, and the guards are now
the only thing standing between an empty value and a malformed request, so they
are covered directly -- each new test was confirmed to fail with its guard
removed.

On the version choice: 8.26.0 rather than 8.27.0 or 8.28.0. The current
latest, 8.28.0, is uninstallable -- it depends on @orval/angular@8.28.0,
which was never published (8.28.1 is queued upstream but not out). Between
8.26.0 and 8.27.0 the generated output differs only by extracting mutation
keys into exported get*MutationKey() helpers, which nothing here uses, so
8.26.0 costs nothing and has eleven days of soak rather than five. Pinned
exact, no caret, given they just shipped a broken latest.

This does not unblock TypeScript 7. That is a separate problem -- orval
rejects the aliased typescript spec as invalid semver -- and it is removed
by the oxlint migration, not by any orval version.

Co-Authored-By: Claude Opus 5 (1M context) noreply@anthropic.com

---

_{Stack created with GitHub Stacks CLI • Give Feedback 💬}

[paulvanbrenk]

orval changed the guard it generates for a required path param:

- enabled: !!(id)
+ enabled: id !== null && id !== undefined

That was a deliberate upstream fix, not a regression -- orval-labs/orval#3241
("0 as param causes query to be disabled") reported that a legitimate 0
disabled the query, and #3325 replaced the truthiness test with a null check.
It shipped in 8.10.0, so every version worth upgrading to has it.

The consequence for us is that an empty string now passes the guard. Left
alone, usePackage('') would issue GET /api/packages/. Two existing tests
in hooks.test.tsx caught this, which is the only reason it was noticed.

So the hooks now say what they mean instead of leaning on generated
truthiness. This matches what the file already did elsewhere -- useGithubSearch
has enabled: query.length >= 2 and the watchlist hook has enabled: !!user:

usePackage(id) enabled: !!id
useRelease(id) enabled: !!id
usePackageReleases(packageId) enabled: !!packageId
usePackagesByOwner(owner) enabled: !!owner
usePackageByOwnerRepo(owner, repo) enabled: !!(owner && repo)

The generated code spreads ...queryOptions after enabled, so the caller's
value wins. Three of those five had no empty-param test, and the guards are now
the only thing standing between an empty value and a malformed request, so they
are covered directly -- each new test was confirmed to fail with its guard
removed.

On the version choice: 8.26.0 rather than 8.27.0 or 8.28.0. The current
latest, 8.28.0, is uninstallable -- it depends on @orval/angular@8.28.0,
which was never published (8.28.1 is queued upstream but not out). Between
8.26.0 and 8.27.0 the generated output differs only by extracting mutation
keys into exported get*MutationKey() helpers, which nothing here uses, so
8.26.0 costs nothing and has eleven days of soak rather than five. Pinned
exact, no caret, given they just shipped a broken latest.

This does not unblock TypeScript 7. That is a separate problem -- orval
rejects the aliased typescript spec as invalid semver -- and it is removed
by the oxlint migration, not by any orval version.

Co-Authored-By: Claude Opus 5 (1M context) noreply@anthropic.com

---

_{Stack created with GitHub Stacks CLI • Give Feedback 💬}

[paulvanbrenk]

orval changed the guard it generates for a required path param:

- enabled: !!(id)
+ enabled: id !== null && id !== undefined

That was a deliberate upstream fix, not a regression -- orval-labs/orval#3241
("0 as param causes query to be disabled") reported that a legitimate 0
disabled the query, and #3325 replaced the truthiness test with a null check.
It shipped in 8.10.0, so every version worth upgrading to has it.

The consequence for us is that an empty string now passes the guard. Left
alone, usePackage('') would issue GET /api/packages/. Two existing tests
in hooks.test.tsx caught this, which is the only reason it was noticed.

So the hooks now say what they mean instead of leaning on generated
truthiness. This matches what the file already did elsewhere -- useGithubSearch
has enabled: query.length >= 2 and the watchlist hook has enabled: !!user:

usePackage(id) enabled: !!id
useRelease(id) enabled: !!id
usePackageReleases(packageId) enabled: !!packageId
usePackagesByOwner(owner) enabled: !!owner
usePackageByOwnerRepo(owner, repo) enabled: !!(owner && repo)

The generated code spreads ...queryOptions after enabled, so the caller's
value wins. Three of those five had no empty-param test, and the guards are now
the only thing standing between an empty value and a malformed request, so they
are covered directly -- each new test was confirmed to fail with its guard
removed.

On the version choice: 8.26.0 rather than 8.27.0 or 8.28.0. The current
latest, 8.28.0, is uninstallable -- it depends on @orval/angular@8.28.0,
which was never published (8.28.1 is queued upstream but not out). Between
8.26.0 and 8.27.0 the generated output differs only by extracting mutation
keys into exported get*MutationKey() helpers, which nothing here uses, so
8.26.0 costs nothing and has eleven days of soak rather than five. Pinned
exact, no caret, given they just shipped a broken latest.

This does not unblock TypeScript 7. That is a separate problem -- orval
rejects the aliased typescript spec as invalid semver -- and it is removed
by the oxlint migration, not by any orval version.

Co-Authored-By: Claude Opus 5 (1M context) noreply@anthropic.com

---

_{Stack created with GitHub Stacks CLI • Give Feedback 💬}

[paulvanbrenk]

orval changed the guard it generates for a required path param:

- enabled: !!(id)
+ enabled: id !== null && id !== undefined

That was a deliberate upstream fix, not a regression -- orval-labs/orval#3241
("0 as param causes query to be disabled") reported that a legitimate 0
disabled the query, and #3325 replaced the truthiness test with a null check.
It shipped in 8.10.0, so every version worth upgrading to has it.

The consequence for us is that an empty string now passes the guard. Left
alone, usePackage('') would issue GET /api/packages/. Two existing tests
in hooks.test.tsx caught this, which is the only reason it was noticed.

So the hooks now say what they mean instead of leaning on generated
truthiness. This matches what the file already did elsewhere -- useGithubSearch
has enabled: query.length >= 2 and the watchlist hook has enabled: !!user:

usePackage(id) enabled: !!id
useRelease(id) enabled: !!id
usePackageReleases(packageId) enabled: !!packageId
usePackagesByOwner(owner) enabled: !!owner
usePackageByOwnerRepo(owner, repo) enabled: !!(owner && repo)

The generated code spreads ...queryOptions after enabled, so the caller's
value wins. Three of those five had no empty-param test, and the guards are now
the only thing standing between an empty value and a malformed request, so they
are covered directly -- each new test was confirmed to fail with its guard
removed.

On the version choice: 8.26.0 rather than 8.27.0 or 8.28.0. The current
latest, 8.28.0, is uninstallable -- it depends on @orval/angular@8.28.0,
which was never published (8.28.1 is queued upstream but not out). Between
8.26.0 and 8.27.0 the generated output differs only by extracting mutation
keys into exported get*MutationKey() helpers, which nothing here uses, so
8.26.0 costs nothing and has eleven days of soak rather than five. Pinned
exact, no caret, given they just shipped a broken latest.

This does not unblock TypeScript 7. That is a separate problem -- orval
rejects the aliased typescript spec as invalid semver -- and it is removed
by the oxlint migration, not by any orval version.

Co-Authored-By: Claude Opus 5 (1M context) noreply@anthropic.com

---

_{Stack created with GitHub Stacks CLI • Give Feedback 💬}

[paulvanbrenk]

orval changed the guard it generates for a required path param:

- enabled: !!(id)
+ enabled: id !== null && id !== undefined

That was a deliberate upstream fix, not a regression -- orval-labs/orval#3241
("0 as param causes query to be disabled") reported that a legitimate 0
disabled the query, and #3325 replaced the truthiness test with a null check.
It shipped in 8.10.0, so every version worth upgrading to has it.

The consequence for us is that an empty string now passes the guard. Left
alone, usePackage('') would issue GET /api/packages/. Two existing tests
in hooks.test.tsx caught this, which is the only reason it was noticed.

So the hooks now say what they mean instead of leaning on generated
truthiness. This matches what the file already did elsewhere -- useGithubSearch
has enabled: query.length >= 2 and the watchlist hook has enabled: !!user:

usePackage(id) enabled: !!id
useRelease(id) enabled: !!id
usePackageReleases(packageId) enabled: !!packageId
usePackagesByOwner(owner) enabled: !!owner
usePackageByOwnerRepo(owner, repo) enabled: !!(owner && repo)

The generated code spreads ...queryOptions after enabled, so the caller's
value wins. Three of those five had no empty-param test, and the guards are now
the only thing standing between an empty value and a malformed request, so they
are covered directly -- each new test was confirmed to fail with its guard
removed.

On the version choice: 8.26.0 rather than 8.27.0 or 8.28.0. The current
latest, 8.28.0, is uninstallable -- it depends on @orval/angular@8.28.0,
which was never published (8.28.1 is queued upstream but not out). Between
8.26.0 and 8.27.0 the generated output differs only by extracting mutation
keys into exported get*MutationKey() helpers, which nothing here uses, so
8.26.0 costs nothing and has eleven days of soak rather than five. Pinned
exact, no caret, given they just shipped a broken latest.

This does not unblock TypeScript 7. That is a separate problem -- orval
rejects the aliased typescript spec as invalid semver -- and it is removed
by the oxlint migration, not by any orval version.

Co-Authored-By: Claude Opus 5 (1M context) noreply@anthropic.com

---

_{Stack created with GitHub Stacks CLI • Give Feedback 💬}

[paulvanbrenk]

orval changed the guard it generates for a required path param:

- enabled: !!(id)
+ enabled: id !== null && id !== undefined

That was a deliberate upstream fix, not a regression -- orval-labs/orval#3241
("0 as param causes query to be disabled") reported that a legitimate 0
disabled the query, and #3325 replaced the truthiness test with a null check.
It shipped in 8.10.0, so every version worth upgrading to has it.

The consequence for us is that an empty string now passes the guard. Left
alone, usePackage('') would issue GET /api/packages/. Two existing tests
in hooks.test.tsx caught this, which is the only reason it was noticed.

So the hooks now say what they mean instead of leaning on generated
truthiness. This matches what the file already did elsewhere -- useGithubSearch
has enabled: query.length >= 2 and the watchlist hook has enabled: !!user:

usePackage(id) enabled: !!id
useRelease(id) enabled: !!id
usePackageReleases(packageId) enabled: !!packageId
usePackagesByOwner(owner) enabled: !!owner
usePackageByOwnerRepo(owner, repo) enabled: !!(owner && repo)

The generated code spreads ...queryOptions after enabled, so the caller's
value wins. Three of those five had no empty-param test, and the guards are now
the only thing standing between an empty value and a malformed request, so they
are covered directly -- each new test was confirmed to fail with its guard
removed.

On the version choice: 8.26.0 rather than 8.27.0 or 8.28.0. The current
latest, 8.28.0, is uninstallable -- it depends on @orval/angular@8.28.0,
which was never published (8.28.1 is queued upstream but not out). Between
8.26.0 and 8.27.0 the generated output differs only by extracting mutation
keys into exported get*MutationKey() helpers, which nothing here uses, so
8.26.0 costs nothing and has eleven days of soak rather than five. Pinned
exact, no caret, given they just shipped a broken latest.

This does not unblock TypeScript 7. That is a separate problem -- orval
rejects the aliased typescript spec as invalid semver -- and it is removed
by the oxlint migration, not by any orval version.

Co-Authored-By: Claude Opus 5 (1M context) noreply@anthropic.com

---

_{Stack created with GitHub Stacks CLI • Give Feedback 💬}

[paulvanbrenk]

orval changed the guard it generates for a required path param:

- enabled: !!(id)
+ enabled: id !== null && id !== undefined

That was a deliberate upstream fix, not a regression -- orval-labs/orval#3241
("0 as param causes query to be disabled") reported that a legitimate 0
disabled the query, and #3325 replaced the truthiness test with a null check.
It shipped in 8.10.0, so every version worth upgrading to has it.

The consequence for us is that an empty string now passes the guard. Left
alone, usePackage('') would issue GET /api/packages/. Two existing tests
in hooks.test.tsx caught this, which is the only reason it was noticed.

So the hooks now say what they mean instead of leaning on generated
truthiness. This matches what the file already did elsewhere -- useGithubSearch
has enabled: query.length >= 2 and the watchlist hook has enabled: !!user:

usePackage(id) enabled: !!id
useRelease(id) enabled: !!id
usePackageReleases(packageId) enabled: !!packageId
usePackagesByOwner(owner) enabled: !!owner
usePackageByOwnerRepo(owner, repo) enabled: !!(owner && repo)

The generated code spreads ...queryOptions after enabled, so the caller's
value wins. Three of those five had no empty-param test, and the guards are now
the only thing standing between an empty value and a malformed request, so they
are covered directly -- each new test was confirmed to fail with its guard
removed.

On the version choice: 8.26.0 rather than 8.27.0 or 8.28.0. The current
latest, 8.28.0, is uninstallable -- it depends on @orval/angular@8.28.0,
which was never published (8.28.1 is queued upstream but not out). Between
8.26.0 and 8.27.0 the generated output differs only by extracting mutation
keys into exported get*MutationKey() helpers, which nothing here uses, so
8.26.0 costs nothing and has eleven days of soak rather than five. Pinned
exact, no caret, given they just shipped a broken latest.

This does not unblock TypeScript 7. That is a separate problem -- orval
rejects the aliased typescript spec as invalid semver -- and it is removed
by the oxlint migration, not by any orval version.

Co-Authored-By: Claude Opus 5 (1M context) noreply@anthropic.com

---

_{Stack created with GitHub Stacks CLI • Give Feedback 💬}