[dependabot]

Bumps the development group with 3 updates: oxfmt, oxlint and tsdown.

Updates oxfmt from 0.75.0 to 0.76.0

Release notes

Sourced from oxfmt's releases.

oxfmt v0.76.0

💥 BREAKING CHANGES

• 296623d oxfmt: [BREAKING] Format parser:html files by oxc_formatter_htmlish (#28273) (Yuji Sugiura)

🚀 Features

• 336b2c1 oxfmt: Support html-in-js templates closing a dynamic tag name (#28389) (Yuji Sugiura)
• 0a42af6 formatter_htmlish: Format end tags of omitted html, head and body (#28388) (Yuji Sugiura)
• 44d8c2b formatter_htmlish: Implement HTML-ish formatter Html variant (#28272) (Yuji Sugiura)
• 36e5ddb oxfmt: Add debug span for reading files (#28204) (leaysgur)

🐛 Bug Fixes

• dbcc358 formatter: Keep arrow conditional body parens before a leading function/class (#28710) (Yuji Sugiura)
• fef809a formatter_htmlish: Handle XHTML (#28703) (leaysgur)
• f3dd201 formatter_htmlish: Keep SVG text under xml:space="preserve" as written (#28382) (Yuji Sugiura)
• fb3aefa formatter: Keep source parens around html-in-js placeholders past comments (#28381) (Yuji Sugiura)
• e738dae formatter: Quote keys added in an HTML event handler with single quotes (#28380) (Yuji Sugiura)
• 2e7a629 oxfmt: Format HTML in a <script> body as an embedded part (#28379) (Yuji Sugiura)
• f00862b formatter: Keep parens around a generic function type in a type assertion (#28173) (vidigoat)
• 9ead5c4 formatter: Handle this.b and super.b like foo.b (#28200) (leaysgur)
• 72a54cf formatter: Break parens of (a + b)[c] like (a + b).c (#28199) (leaysgur)
• b8f4f34 formatter: Print x.b and x.#b samely (#28193) (leaysgur)
• 9ddccb7 formatter: Keep parens for private field (#28188) (leaysgur)

⚡ Performance

• b6f1ac9 formatter_markdown: Bump parser to 0.0.4 and skip unread work (#28713) (leaysgur)
• 633ee96 formatter_css: Use u32 spans (#28708) (leaysgur)
• f680ee1 formatter_yaml: Use multiline flag for flow scalars (#28707) (leaysgur)
• ff7c203 formatter_css: Avoid repeated scans and allocations in values (#28706) (leaysgur)
• 7cd46cb formatter_htmlish: Search script end tags by < in embedded (#28704) (leaysgur)
• 46f8efd formatter_graphql: Print block string lines borrowed from the source (#28701) (leaysgur)
• dce1485 formatter_htmlish: Skip escaping attr values without the chosen quote (#28700) (leaysgur)
• e9392c8 formatter_core: Search line terminators with memchr (#28699) (leaysgur)
• ceb26be formatter_htmlish: Use char to escape attr quotes (#28697) (leaysgur)
• 8239dac parser: Replace dragonbox_ecma with zmij_ecma (#28282) (Boshen)

📚 Documentation

• 303d9e8 formatter: Strengthen start-token-no-double-parens rationale (#28711) (Yuji Sugiura)
• a82ce83 oxfmt: Update unclassified divergence (#28685) (Yuji Sugiura)
• 7f18c20 formatter_htmlish: Note class and srcset are formatted with embeddedLanguageFormatting: off (#28465) (Yuji Sugiura)
• 01ed68a oxfmt,formatter_htmlish,formatter: Clean up behavior comments (#28384) (Yuji Sugiura)
• a363c27 formatter_css,formatter_yaml: Point parser citations at AGENTS.md (#28466) (Yuji Sugiura)
• 6586050 formatter_core: Document tab width in text width policy (#28393) (leaysgur)
• 49fbffb formatter_core: Tighten FORMATTER_POLICY (#28206) (leaysgur)

Commits

• f3fcdcc release(apps): oxlint v1.91.0 && oxfmt v0.76.0 (#28718)
• See full diff in compare view

Updates oxlint from 1.90.0 to 1.91.0

Release notes

Sourced from oxlint's releases.

oxlint v1.91.0

🚀 Features

• 004647a track_memory_allocs: Add allocation tracking for linter rules (#28470) (Cam McHenry)
• 419c1b0 linter: Add allow and allowPattern options to react/capitalized-calls (Christian Vuerings)

🐛 Bug Fixes

• a205cd3 linter/eslint/no-control-regex: Detect raw control characters (#28548) (camc314)
• 7c65777 linter/unicorn/prefer-global-this: Align typeof and worker API handling (#28549) (camc314)
• 987d5f1 linter/unicorn/no-invalid-fetch-options: Avoid treating unknown methods as GET (#28547) (camc314)
• e234dc8 linter/unicorn/no-useless-error-capture-stack-trace: Move to suspicious category (#28545) (camc314)
• b3dc411 linter/typescript/no-non-null-asserted-nullish-coalescing: Move to suspicious category (#28546) (camc314)
• cb64638 regular_expression: Reject incomplete Unicode atom escapes (#28448) (Boshen)
• c67167e linter: Only run React Compiler rules on files with top-level components or hooks (Boshen)
• 4c9d5aa linter: Treat Reanimated shared values as ref-like in React Compiler rules (Boshen)
• 61fe2af linter/react: Ignore impure calls in async components in react/purity (Rahul Kashyap)
• ed7df7d ast/estree: Include comments in TS Program span (#28326) (camc314)
• 31cbe37 linter: Make gitlab fingerprints unique per diagnostic (#28307) (camc314)

⚡ Performance

• 564559d linter/prefer-const: Avoid collecting resolved references (#28732) (Dunqing)
• bb947dc linter: Skip numeric separator formatting for short integers (#28485) (Cam McHenry)
• 1043dfa linter: Avoid collecting prefer-const binding identifiers (#28484) (Cam McHenry)
• 7c93eef linter: Reduce branches-sharing-code scratch allocations (#28483) (Cam McHenry)
• c0065fd linter: Allocate escape-case replacements only when needed (#28482) (Cam McHenry)
• d837414 linter: Lazily normalize capitalized-comments text (#28481) (Cam McHenry)
• 6baaad6 linter: Avoid no-var binding identifier allocations (#28480) (Cam McHenry)
• 882053b linter: Skip read-only parameters in no-param-reassign (#28479) (Cam McHenry)
• 92deebf linter: Reduce no-unmodified-loop-condition allocations (#28478) (Cam McHenry)
• f01d52d linter: Reduce no-duplicate-case allocations (#28477) (Cam McHenry)
• 6a72d84 linter: Reduce no-dupe-class-members allocations (#28476) (Cam McHenry)
• 77599ef linter: Reduce no-this-before-super allocations (#28475) (Cam McHenry)
• 2ea9f58 linter/no-dupe-else-if: Use smallvec to reduce allocs (#28474) (Cam McHenry)
• 69f0204 linter/react/rules-of-hooks: Reduce allocs (#28473) (Cam McHenry)
• b138c20 linter: Reduce allocs in no-dupe-keys (#28472) (Cam McHenry)
• 6f3e982 linter: Avoid operator allocations in no-useless-length-check (#28471) (Cam McHenry)
• fd68928 react-compiler: Skip passes lint does not need (Yagiz Nizipli)
• 224f4dd linter/eslint/sort-keys: Reserve initial capacity for string (#27624) (Cam McHenry)
• e4e01a3 linter/import/no-cycle: Compare visited modules by absolute resolved path (#27517) (Cam McHenry)
• 741b29b linter/import/no-cycle: Cache sorted module record snapshots (#27516) (Cam McHenry)
• 20022bb linter/import/no-cycle: Reuse traversal buffers between imports (#27481) (Cam McHenry)
• fd5edb7 linter/import/no-cycle: Reuse module records in diagnostic stack (#27480) (Cam McHenry)
• 73e877c linter/import/no-cycle: Don't allocate paths already seen (#27478) (Cam McHenry)
• 1515d53 linter/react/forward-ref-uses-ref: Narrow forward-ref-uses-ref dispatch (#28367) (Cam McHenry)
• ee51c01 linter/react/no-string-refs: Narrow AST dispatch (#28366) (Cam McHenry)
• bbfd692 linter/react/no-children-pop: Narrow AST dispatch (#28365) (Cam McHenry)
• a86158b linter/unicorn/prefer-set-size: Narrow AST dispatch (#28364) (Cam McHenry)
• a777fa6 linter/eslint/no-iterator: Narrow member dispatch (#28363) (Cam McHenry)

... (truncated)

Changelog

Sourced from oxlint's changelog.

[1.91.0] - 2026-11-02

🚀 Features

• 419c1b0 linter: Add allow and allowPattern options to react/capitalized-calls (Christian Vuerings)

Commits

• f3fcdcc release(apps): oxlint v1.91.0 && oxfmt v0.76.0 (#28718)
• 419c1b0 feat(linter): add allow and allowPattern options to react/capitalized-calls
• See full diff in compare view

Updates tsdown from 0.23.4 to 0.23.5

Release notes

Sourced from tsdown's releases.

v0.23.5

Notes

rolldown-plugin-dts is now v0.29. tsdown passes dts options through to it unchanged, so its deprecations show up in your config too. Full details are in the rolldown-plugin-dts v0.29.0 release notes.

Migration

tsc-only dts options move under dts.tsc. The top-level build, incremental, parallel, eager, newContext and vue options still work but log a deprecation warning. Setting the same option at both levels throws an error. emitJs stays at the top level.

 export default defineConfig({
   dts: {
-    vue: true,
+    tsc: { vue: true },
   },
 })

tsgo (experimental, not covered by semver):

• @typescript/native-preview is no longer supported. Install TypeScript 7.1+ (typescript@7.1.0-beta), or point tsgo.moduleUrl at another build.
• On TypeScript 7.1+, tsgo.path is the API server executable, not the tsgo CLI. You usually don't need to set it.
• Declaration maps come only from compilerOptions.declarationMap: true in tsconfig; the sourcemap option no longer enables them.
• TypeScript 7.0 still works with a deprecation warning, but that backend will be removed soon.

---

   🚀 Features

• css: Support css: false to disable built-in CSS handling  -  by @​sxzzbot in rolldown/tsdown#1113 (181af)
• dts: Upgrade rolldown-plugin-dts to v0.29, upgrade deps  -  by @​sxzzbot in rolldown/tsdown#1121 (e12ab)

   🐞 Bug Fixes

• css: Remove dangling requires and handle CSS extensions in chunk names  -  by @​sxzzbot in rolldown/tsdown#1114 (c8ca3)

   🏎 Performance

• deps: Read each package.json once when resolving dep subpaths  -  by @​Cherry and @​sxzzbot in rolldown/tsdown#1093 (4435a)

    View changes on GitHub

Commits

• 7a50502 chore: release v0.23.5
• e12ab7f feat(dts): upgrade rolldown-plugin-dts to v0.29, upgrade deps (#1121)
• 4435a48 perf(deps): read each package.json once when resolving dep subpaths (#1093)
• daf9083 docs(vue): link to CSS support from the Vue recipe (#1117)
• c8ca303 fix(css): remove dangling requires and handle CSS extensions in chunk names (...
• 99b3b03 test(migrate): fold duplicate tsup default-value tests (#1116)
• 181af08 feat(css): support css: false to disable built-in CSS handling (#1113)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs changes before merge.

What this changes

This PR updates oxfmt to 0.76.0, oxlint to 1.91.0, and tsdown to 0.23.5 with their transitive dependencies.

Example: A contributor installs dependencies using the committed lockfile.

• Before: Formatting uses oxfmt 0.75.0, linting uses oxlint 1.90.0, and builds use tsdown 0.23.4.
• After: Formatting uses oxfmt 0.76.0, linting uses oxlint 1.91.0, and builds use tsdown 0.23.5.

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused dependency refresh with passing cross-platform validation and one low-priority repository-policy omission.
Proof confidence	🌊 off-meta tidepool	Not applicable: This Dependabot maintenance PR is outside the ordinary contributor proof gate; reviewed-head CI exercises formatting, linting, builds, package consumption, and browser tests.
Patch quality	🐚 platinum hermit (4/6)	1 actionable review finding remain.

Product

Kind: Maintenance · Worth it: Yes · Fix scope: Complete
User problem: Contributors and release builds otherwise continue using the previous formatter, linter, and bundler versions.
Reason: The update follows the repository's established dependency-maintenance direction without adding configuration or changing the public API.

Merge readiness

⛔ Needs changes before merge - 1 item remains

Keep open: these tooling updates are absent from current main, and the reviewed head passes CI; one changelog correction remains.

Priority: P3
Reviewed head: 759b3b46269ca77f2496c2c886b427a0488cc437

Before merge

• Document the operational toolchain update under Unreleased (P3) - This update changes the formatter, linter, and build/declaration generator used by contributors and releases, but leaves CHANGELOG.md unchanged. AGENTS.md requires an Unreleased entry for operational changes, and the changelog records comparable tooling refreshes. Add a concise entry covering these three updates.

Findings

• [P3] Document the operational toolchain update under Unreleased — package.json:97

Agent review details

How this fits together

The development toolchain consumes repository source to check formatting, lint TypeScript, and generate the JavaScript and declarations published by the package.

flowchart LR
  A[Source and configuration] --> B[pnpm scripts]
  B --> C[oxfmt and oxlint]
  B --> D[tsdown]
  D --> E[JavaScript and declarations]
  E --> F[Package validation]

Loading

Technical review

Best possible solution:

Retain the focused dependency update and document the tooling refresh under Unreleased.

Do we have a high-confidence way to reproduce the issue?

This PR reports no runtime bug; source inspection confirms the version updates, and GitHub records successful checks on the reviewed head.

Is this the best way to solve the issue?

Updating the existing dependencies and generated lockfile is appropriately scoped and preserves the existing build, lint, runtime, and package boundaries.

Full review comments:

• [P3] Document the operational toolchain update under Unreleased — package.json:97
  This update changes the formatter, linter, and build/declaration generator used by contributors and releases, but leaves CHANGELOG.md unchanged. AGENTS.md requires an Unreleased entry for operational changes, and the changelog records comparable tooling refreshes. Add a concise entry covering these three updates.
  Confidence: 0.92

Overall correctness: patch is correct
Overall confidence: 0.93

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against c6e0ca1de44e.

Provenance checked

• Formatter and linter dependencies keeps the original intent (build(deps-dev): bump the development group with 2 updates #119: The earlier grouped update refreshed the existing formatter and linter; this PR advances the same tools rather than replacing their ownership or configuration.)
• Build tooling and dependency ranges keeps the original intent (c6e0ca1: The current main commit aligns tool ranges with qualified lockfile versions while retaining the dependency cooldown, pnpm 11, and supported Node versions.)
• Build entry point keeps the original intent (402f019: The build script generates Worker assets and bundles explicit portable entry points while keeping renderer and PTY packages external; this PR retains that script.)

Testing

Proof path: in-process harness.

Security

None.

Evidence

Acceptance criteria:

• pnpm run format:check
• git diff --check
• git diff -- CHANGELOG.md

What I checked:

• Pinned introduced changes: The introduced diff changes only package.json and pnpm-lock.yaml, updating three existing development tools without changing scripts, runtime peers, or public exports. (package.json:97, 759b3b46269c)
• Current main still uses earlier versions: GitHub confirms main remains at the pinned base; its lockfile resolves oxfmt 0.75.0, oxlint 1.90.0, and tsdown 0.23.4. (pnpm-lock.yaml:35, c6e0ca1de44e)
• Reviewed-head validation: All seven Node/platform check jobs, browser smoke, workflow lint, and CodeQL checks pass on the reviewed head; the two skipped checks are dispatch jobs. (.github/workflows/ci.yml:76, 759b3b46269c)
• Complete discussion and body inspected: The retrieved full body matches the supplied SHA-256 7b4473f734b4f2662dab2403079026fd2e620dfdaefb51998a5ff26592f826dc and contains the upstream release notes; both comments are review-status messages and there are no submitted reviews. (759b3b46269c)
• Toolchain intent and history: Recent main history deliberately refreshes these tools while retaining pnpm 11, the dependency cooldown, and supported Node versions; this PR preserves those choices. (package.json:98, c6e0ca1de44e)
• Applicable changelog policy: Root policy requires an Unreleased entry for operational changes, and existing changelog entries record comparable build and lint tooling refreshes; this PR adds no entry. The review followed the read-only instruction and ran no autoreview helper. (AGENTS.md:68, 759b3b46269c)

Likely related people:

• Peter Steinberger: Raw commit 7a94649 adds package.json:99 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: 7a94649de488; files: package.json)
• Vincent Koc: Raw commit 402f019 adds package.json:73 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: 402f019f2b17; files: package.json)

Preflight source

Source unknown. Source comparison at the observed PR snapshot only. Completion is self-reported; body, policy, tests, execution, and report bytes are not verified.

Labels

Label changes:

• add P3: This is routine development-tool maintenance with passing reviewed-head checks and a low-impact changelog omission.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action.

Label justifications:

• P3: This is routine development-tool maintenance with passing reviewed-head checks and a low-impact changelog omission.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed November 5, 2026, 12:28 PM ET / 17:28 UTC.