Skip to content

build(deps-dev): bump the development-minor-and-patch group with 4 updates - #257

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/development-minor-and-patch-a40944b021
Open

build(deps-dev): bump the development-minor-and-patch group with 4 updates#257
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/development-minor-and-patch-a40944b021

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 9, 2026

Copy link
Copy Markdown
Contributor

Bumps the development-minor-and-patch group with 4 updates: @vitest/coverage-v8, oxfmt, oxlint and vitest.

Updates @vitest/coverage-v8 from 5.0.5 to 5.1.0

Release notes

Sourced from @​vitest/coverage-v8's releases.

v5.1.0

   🚀 Features

   🐞 Bug Fixes

... (truncated)

Commits

Updates oxfmt from 0.75.0 to 0.77.0

Release notes

Sourced from oxfmt's releases.

oxfmt v0.77.0

💥 BREAKING CHANGES

  • 00d1a67 oxfmt: [BREAKING] Format parser:vue files by oxc_formatter_htmlish (#28848) (leaysgur)

🚀 Features

  • 9a81e58 formatter_htmlish: Format Vue templates (#28847) (leaysgur)
  • 119d82f formatter: Format a template's expressions and handlers as JsRoot (#28846) (leaysgur)

🐛 Bug Fixes

  • fa66fde oxlint,oxfmt: Resolve Vite+ config root from the config file directory (#28801) (MK (fengmk2))
  • 4d4104d formatter_htmlish: Preserve doctype case in embedded (#28797) (leaysgur)
  • ebfd40a formatter: Sort Tailwind calls printed as member chains (#28800) (Yuji Sugiura)
  • e62e5cb formatter: Decide quotes of a Tailwind key printed as one class (#28798) (Yuji Sugiura)
  • 959edc1 formatter: Don't sort templates in nested non-Tailwind calls (#28794) (Yuji Sugiura)
  • 6ffbe32 formatter/jsdoc: Prevent @tag from being moved to the line start (#28835) (leaysgur)
  • 94fbef5 formatter_css: Treat comments in style attr as fill items (#28832) (leaysgur)
  • e4a80f7 formatter_css: Normalize selectors inside :deep, :slotted and :local (#28805) (leaysgur)
  • 255c5cc formatter: Measure Tailwind class argument after collapsing whitespace (#28745) (Lee Jaeha / Adam)
  • e6c4fef formatter: Decide template and object key layouts from collapsed Tailwind classes (#28791) (Yuji Sugiura)
  • 0b44164 formatter: Decide JSX opening element layout from collapsed Tailwind class string (#28744) (Lee Jaeha / Adam)
  • b8ba9ae formatter: Print decorators on rest parameters (#28731) (YT)

⚡ Performance

  • 2766d07 oxfmt: Spawn Prettier workers on demand (#28789) (YT)
  • 07627f7 oxfmt: Use worker_threads for tinypool again (#28787) (Yuji Sugiura)

oxfmt v0.76.0

💥 BREAKING CHANGES

  • 296623d oxfmt: [BREAKING] Format parser:html files by oxc_formatter_htmlish (#28273) (Yuji Sugiura)

🚀 Features

  • 336b2c1 oxfmt: Support html-in-js templates closing a dynamic tag name (#28389) (Yuji Sugiura)
  • 0a42af6 formatter_htmlish: Format end tags of omitted html, head and body (#28388) (Yuji Sugiura)
  • 44d8c2b formatter_htmlish: Implement HTML-ish formatter Html variant (#28272) (Yuji Sugiura)
  • 36e5ddb oxfmt: Add debug span for reading files (#28204) (leaysgur)

🐛 Bug Fixes

  • dbcc358 formatter: Keep arrow conditional body parens before a leading function/class (#28710) (Yuji Sugiura)
  • fef809a formatter_htmlish: Handle XHTML (#28703) (leaysgur)
  • f3dd201 formatter_htmlish: Keep SVG text under xml:space="preserve" as written (#28382) (Yuji Sugiura)
  • fb3aefa formatter: Keep source parens around html-in-js placeholders past comments (#28381) (Yuji Sugiura)
  • e738dae formatter: Quote keys added in an HTML event handler with single quotes (#28380) (Yuji Sugiura)
  • 2e7a629 oxfmt: Format HTML in a <script> body as an embedded part (#28379) (Yuji Sugiura)

... (truncated)

Commits

Updates oxlint from 1.90.0 to 1.92.0

Release notes

Sourced from oxlint's releases.

oxlint v1.92.0

🚀 Features

  • 4a52ba2 oxlint: Discover tsrs for type-aware linting (#28751) (camc314)
  • b7d2c75 linter/eslint/no-redeclare: Add ignoreDeclarationMerge option (#28816) (Cam McHenry)

🐛 Bug Fixes

  • fa66fde oxlint,oxfmt: Resolve Vite+ config root from the config file directory (#28801) (MK (fengmk2))
  • 2091564 linter/jsdoc/require-param: Ignore enclosing function JSDoc (#28866) (camc314)
  • c6ec50b linter/react/only-export-components: Classify JSX values as non-components (#28761) (camc314)
  • 3c051ab linter/vitest/prefer-called-exactly-once-with: Preserve neighboring code in autofix (#28864) (camc314)
  • 674b962 linter/eslint/no-misleading-character-class: Use lazy regex for combining marks (#28822) (Sysix)
  • 838d339 linter/vitest/prefer-called-exactly-once-with: Avoid panic on non-ASCII text (#28850) (YT)
  • 8d24c26 linter/jsx-a11y/aria-role: Allow role={undefined} (#28804) (Abhay Godavarthy)
  • a7143bf linter/eslint/no-restricted-imports: Respect allowTypeImports correctly for empty patterns (#28842) (Cam McHenry)
  • 3d3a6f4 react-compiler: Ignore callback-local reassignments (#28820) (camc314)
  • 0cc6515 linter/unicorn/prefer-type-error: Report throws in unbraced if branches (#28819) (camc314)
  • ae43c80 linter/unicorn/prefer-single-call: Remove duplicate fix status (#28763) (Mikhail Baev)
  • a8a621a linter/eslint/no-fallthrough: Ignore unreachable exits from infinite loops (#28755) (camc314)
  • 7a17a80 linter/eslint/prefer-spread: Report calls on non-member expressions (#28753) (camc314)
  • 28442f7 oxlint: Prevent --init from overwriting existing configs (#28754) (camc314)
  • 0ae350d linter/unicorn/no-zero-fractions: Preserve exponent case (#28752) (camc314)
  • b5b3f3f linter/eslint/no-misleading-character-class: Detect more combining characters (#28733) (Sysix)

⚡ Performance

  • 74d50c1 linter: Overlap import graph batches instead of polling on a pool worker (#28323) (Dunqing)

oxlint v1.91.0

🚀 Features

  • 004647a track_memory_allocs: Add allocation tracking for linter rules (#28470) (Cam McHenry)
  • 419c1b0 linter: Add allow and allowPattern options to react/capitalized-calls (Christian Vuerings)

🐛 Bug Fixes

  • a205cd3 linter/eslint/no-control-regex: Detect raw control characters (#28548) (camc314)
  • 7c65777 linter/unicorn/prefer-global-this: Align typeof and worker API handling (#28549) (camc314)
  • 987d5f1 linter/unicorn/no-invalid-fetch-options: Avoid treating unknown methods as GET (#28547) (camc314)
  • e234dc8 linter/unicorn/no-useless-error-capture-stack-trace: Move to suspicious category (#28545) (camc314)
  • b3dc411 linter/typescript/no-non-null-asserted-nullish-coalescing: Move to suspicious category (#28546) (camc314)
  • cb64638 regular_expression: Reject incomplete Unicode atom escapes (#28448) (Boshen)
  • c67167e linter: Only run React Compiler rules on files with top-level components or hooks (Boshen)
  • 4c9d5aa linter: Treat Reanimated shared values as ref-like in React Compiler rules (Boshen)
  • 61fe2af linter/react: Ignore impure calls in async components in react/purity (Rahul Kashyap)
  • ed7df7d ast/estree: Include comments in TS Program span (#28326) (camc314)
  • 31cbe37 linter: Make gitlab fingerprints unique per diagnostic (#28307) (camc314)

⚡ Performance

... (truncated)

Changelog

Sourced from oxlint's changelog.

[1.92.0] - 2026-11-06

🚀 Features

  • b7d2c75 linter/eslint/no-redeclare: Add ignoreDeclarationMerge option (#28816) (Cam McHenry)

[1.91.0] - 2026-11-02

🚀 Features

  • 419c1b0 linter: Add allow and allowPattern options to react/capitalized-calls (Christian Vuerings)
Commits
  • 29daf90 release(apps): oxlint v1.92.0 && oxfmt v0.77.0 (#28906)
  • b7d2c75 feat(linter/eslint/no-redeclare): add ignoreDeclarationMerge option (#28816)
  • f3fcdcc release(apps): oxlint v1.91.0 && oxfmt v0.76.0 (#28718)
  • 419c1b0 feat(linter): add allow and allowPattern options to react/capitalized-calls
  • See full diff in compare view

Updates vitest from 5.0.5 to 5.1.0

Release notes

Sourced from vitest's releases.

v5.1.0

   🚀 Features

   🐞 Bug Fixes

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
build(deps-dev): bump the development-minor-and-patch group with 4 up…
1e11a73 
…dates

Bumps the development-minor-and-patch group with 4 updates: [@vitest/coverage-v8](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8), [oxfmt](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt), [oxlint](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint) and [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest).


Updates `@vitest/coverage-v8` from 5.0.5 to 5.1.0
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v5.1.0/packages/coverage-v8)

Updates `oxfmt` from 0.75.0 to 0.77.0
- [Release notes](https://github.com/oxc-project/oxc/releases)
- [Changelog](https://github.com/oxc-project/oxc/blob/main/npm/oxfmt/CHANGELOG.md)
- [Commits](https://github.com/oxc-project/oxc/commits/oxfmt_v0.77.0/npm/oxfmt)

Updates `oxlint` from 1.90.0 to 1.92.0
- [Release notes](https://github.com/oxc-project/oxc/releases)
- [Changelog](https://github.com/oxc-project/oxc/blob/main/npm/oxlint/CHANGELOG.md)
- [Commits](https://github.com/oxc-project/oxc/commits/oxlint_v1.92.0/npm/oxlint)

Updates `vitest` from 5.0.5 to 5.1.0
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v5.1.0/packages/vitest)

---
updated-dependencies:
- dependency-name: "@vitest/coverage-v8"
  dependency-version: 5.1.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development-minor-and-patch
- dependency-name: oxfmt
  dependency-version: 0.77.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development-minor-and-patch
- dependency-name: oxlint
  dependency-version: 1.92.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development-minor-and-patch
- dependency-name: vitest
  dependency-version: 5.1.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development-minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 9, 2026
@dependabot
dependabot Bot requested a review from a team as a code owner November 9, 2026 17:07
@clawsweeper

clawsweeper Bot commented Nov 9, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

@clawsweeper clawsweeper Bot added P3 Low-risk cleanup, docs, polish, ergonomics, or speculative feature. rating: 🦐 gold shrimp Decent PR readiness signal, but merge confidence is limited. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. labels Nov 9, 2026
@clawsweeper

clawsweeper Bot commented Nov 9, 2026

Copy link
Copy Markdown
Contributor

Codex review: needs maintainer review before merge.

What this changes

This PR updates Vitest and V8 coverage to 5.1.0, Oxfmt to 0.77.0, and Oxlint to 1.92.0.

Example: A contributor installs dependencies with the frozen lockfile.

  • Before: The install selects Vitest 5.0.5, Oxfmt 0.75.0, and Oxlint 1.90.0.
  • After: The install selects Vitest 5.1.0, Oxfmt 0.77.0, and Oxlint 1.92.0.

Review scores

Measure Result What it means
Overall readiness 🦐 gold shrimp (3/6) A focused, source-consistent dependency update supported by passing CI; validation evidence is automated rather than a separate live demonstration.
Proof confidence 🦐 gold shrimp (3/6) This Dependabot maintenance PR is outside the contributor proof gate; reviewed-head CI supports compatibility, while no separate live demonstration was supplied.
Patch quality 🐚 platinum hermit (4/6) No actionable review findings were identified.

Product

Kind: Maintenance · Worth it: Yes · Fix scope: Complete
User problem: Contributors otherwise retain older formatter, linter, and test-tool releases.
Reason: The update follows established dependency maintenance, preserves runtime boundaries, and passes the existing validation matrix.

Merge readiness

✅ Ready for maintainer review

Keep this PR open: the dependency updates are absent from current main, follow the existing maintenance direction, and introduce no identified defect.

Priority: P3
Reviewed head: 1e11a7374db36d22fce6825d5961b2c27471f908

Before merge

None.

Findings

None.

Agent review details

How this fits together

The manifest and pnpm lockfile select development tools used by local commands and CI to format, lint, test, and measure coverage.

flowchart LR
  A[Package manifest] --> C[pnpm install]
  B[Dependency lockfile] --> C
  C --> D[Formatter and linter]
  C --> E[Vitest and coverage]
  D --> F[Validation results]
  E --> F
Loading

Technical review

Best possible solution:

Land the focused development-tool refresh through the existing validation workflow.

Do we have a high-confidence way to reproduce the issue?

This is a dependency refresh rather than a reported bug; the pinned diff directly establishes the version changes.

Is this the best way to solve the issue?

Updating the existing manifest and lockfile is the smallest complete change, with matched Vitest peers and no additional production machinery.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 575e05b3e4f0.

Provenance checked

  • Formatter and linter versions keeps the original intent (575e05b: The previous refresh updated formatting and lint tooling while preserving Node support and the dependency cooldown.)
  • Matched Vitest and V8 coverage tooling keeps the original intent (0885c93: The coverage integration paired the provider with Vitest and exercised coverage in CI without changing the published runtime contract.)

Testing

Proof path: in-process harness.

Security

None.

Evidence

What I checked:

  • Verified introduced change: The pinned diff changes only the Oxfmt manifest range and development-tool lockfile entries; runtime dependencies, scripts, and the published Node requirement remain unchanged. (package.json:47, 1e11a7374db3)
  • Current main still uses previous versions: Main resolves Vitest and coverage 5.0.5, Oxfmt 0.75.0, and Oxlint 1.90.0, so this update is not already implemented. (pnpm-lock.yaml:33, 575e05b3e4f0)
  • Existing tooling direction: The merged formatter refresh at build(deps): refresh formatter and linter #255 preserves Node 22 support and the dependency cooldown; test: complete Vitest 5 coverage tooling #215 establishes matched Vitest/V8 coverage tooling. (package.json:46, 575e05b3e4f0)
  • Reviewed-head validation: All ten checks passed for the reviewed head, including Linux coverage, Windows execution, Node 22/24 runtime jobs, and dependency review; the Linux job also records successful frozen install, typecheck, lint, formatting, and package smoke steps. (.github/workflows/ci.yml, 1e11a7374db3)
  • Full discussion inspected: The full PR body matches SHA256 240f578c17af368a0f55eac8a8e07a46b0107396636d42607b9f024ab81471b1; both comments are review-status notices, with no additional behavior proof or maintainer decision. (1e11a7374db3)
  • Release age and package integrity: Read-only npm registry metadata confirms the four direct versions were published November 2 or November 6, clearing the configured 48-hour cooldown before this PR; their integrity hashes match the lockfile, their Node engines remain compatible, and none adds an install lifecycle hook. (pnpm-workspace.yaml:1, 1e11a7374db3)

Preflight source

Source unknown. Source comparison at the observed PR snapshot only. Completion is self-reported; body, policy, tests, execution, and report bytes are not verified.

Labels

Label changes:

  • add P3: Routine development-tool maintenance with no identified production defect or urgent user impact.
  • add rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🐚 platinum hermit.
  • add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Label justifications:

  • P3: Routine development-tool maintenance with no identified production defect or urgent user impact.
  • rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🐚 platinum hermit.
  • status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed November 9, 2026, 12:20 PM ET / 17:20 UTC.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code P3 Low-risk cleanup, docs, polish, ergonomics, or speculative feature. rating: 🦐 gold shrimp Decent PR readiness signal, but merge confidence is limited. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants