Skip to content

chore(deps-dev): bump the development group with 16 updates - #52

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bun/development-e5f2b997d3
Closed

chore(deps-dev): bump the development group with 16 updates#52
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bun/development-e5f2b997d3

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 8, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the development group with 16 updates:

Package From To
@changesets/cli 3.0.2 3.0.3
eslint-plugin-sonarjs 4.2.0 4.2.2
oxfmt 0.68.0 0.72.0
oxlint 1.82.0 1.87.0
oxlint-plugin-react-doctor 0.9.13 0.9.17
pkg-pr-new 0.0.88 0.0.90
publint 0.3.24 0.3.25
turbo 2.10.12 2.11.7
ultracite 7.11.1 7.12.4
@types/node 26.5.1 26.6.4
@webgpu/types 0.1.72 0.1.74
postcss 8.5.28 8.5.29
@supabase/supabase-js 2.116.0 2.117.2
cloudflare 7.1.0 7.3.0
pg 8.23.0 8.23.1
redis 6.2.1 6.3.0

Updates @changesets/cli from 3.0.2 to 3.0.3

Release notes

Sourced from @​changesets/cli's releases.

@​changesets/cli@​3.0.3

Patch Changes

  • #2297 3f163da Thanks @​Andarist! - Fixed semver ranges (such as >=1.0.0 <2.0.0) getting cut off (>=2.0.0) when updating internal dependencies.

  • #2276 ca9d110 Thanks @​Andarist! - Fixed pnpm 10 compatibility with npm 12 when reading registry information, packing, and publishing packages.

  • Updated dependencies [3f163da, bfe9050, e522996]:

    • @​changesets/apply-release-plan@​8.1.1
    • @​changesets/config@​4.0.1
Changelog

Sourced from @​changesets/cli's changelog.

3.0.3

Patch Changes

  • #2297 3f163da Thanks @​Andarist! - Fixed semver ranges (such as >=1.0.0 <2.0.0) getting cut off (>=2.0.0) when updating internal dependencies.

  • #2276 ca9d110 Thanks @​Andarist! - Fixed pnpm 10 compatibility with npm 12 when reading registry information, packing, and publishing packages.

  • Updated dependencies [3f163da, bfe9050, e522996]:

    • @​changesets/apply-release-plan@​8.1.1
    • @​changesets/config@​4.0.1
Commits

Updates eslint-plugin-sonarjs from 4.2.0 to 4.2.2

Commits

Updates oxfmt from 0.68.0 to 0.72.0

Release notes

Sourced from oxfmt's releases.

oxfmt v0.72.0

💥 BREAKING CHANGES

  • e2c68b1 oxfmt: [BREAKING] Format parser:markdown files by oxc_formatter_markdown (#27256) (leaysgur)

🚀 Features

  • b538e3c formatter_css: Parse embedded CSS as a block's contents (#27284) (leaysgur)

🐛 Bug Fixes

  • 71e400b formatter_markdown: Fixed remaining issues found by fuzz (#27334) (leaysgur)
  • 7d0e54d formatter_markdown: Preserve line breaks around Chinese/Japanese characters in all proseWrap (#27331) (leaysgur)
  • e9ae2d8 formatter_css: Fix layouts found in mdn-content repo (css-in-md) (#27326) (leaysgur)
  • df85b4c oxfmt: Keep blank lines after a line break in Prettier Doc to IR (#27325) (leaysgur)
  • 7f65b75 formatter: Format assignment target property as assignment-like (#27289) (leaysgur)
  • 6c08f2a formatter_css: Apply the url() import exception to a lone comma group (#27288) (leaysgur)
  • 1967302 formatter_css: Hug a spaced ident ( only at the at-rule prelude head (#27283) (leaysgur)
  • 2445064 formatter_markdown: Keep a preserved line break before a delimiter row that opens no table (#27278) (leaysgur)
  • dd72fbf formatter_markdown: Keep container columns as spaces under useTabs (#27277) (leaysgur)
  • 1686018 oxfmt: Make one state conditionalGroup fit up to first hardline (#27275) (leaysgur)
  • fd4ddce formatter_json: Flatten block comment only array|object (#27274) (leaysgur)
  • 267557c formatter,oxfmt: Embed only original JSDoc plugin supported languages (#27241) (leaysgur)
  • 2606c60 oxfmt: Do not re-include a file below an excluded directory with a negated pattern (#27237) (Nicolas Le Cam)
  • c2de02b formatter: Decide embedded template layout from AST, not source shape (#27218) (leaysgur)
  • c9e1224 formatter: Handle quoteProps: consistent for patterns and computed keys (#27216) (leaysgur)
  • 36e14df formatter: Keep comments between callee and its opener on the callee side (#27172) (leaysgur)
  • 6da7657 oxfmt: Render diagnostics with source in Stdin mode (#27130) (leaysgur)
  • e9b2ec5 oxfmt/lsp: Reload .prettierignore on watched file change (#27129) (leaysgur)
  • 30eb463 oxfmt: Check global ignores before resolving nested config in Stdin mode (#27128) (leaysgur)

⚡ Performance

  • 72f42a3 formatter_markdown: Pre-allocate the IR buffer (#27333) (leaysgur)
  • cea47e3 formatter_core: Avoid exponential will_break check on nested interned (#27211) (leaysgur)
  • 0aba566 oxfmt: Do not resolve root js config from nested context (#27147) (leaysgur)

📚 Documentation

  • 51506c6 formatter_css: Record divergences found in mdn-content (css-in-md) (#27327) (leaysgur)
  • 656b81c formatter_markdown: Record unclosed fences closing at a directive's closer (#27279) (leaysgur)
  • 66545bf formatter_markdown: Record setext heading wrap divergence (#27221) (leaysgur)
  • af4b269 oxfmt: Document why format() API does not take cwd (#27131) (leaysgur)

oxfmt v0.71.0

🚀 Features

  • e0b1f9f oxfmt: Bump bundled Prettier version to 3.9.9 (#27002) (leaysgur)
  • 342527d oxfmt: Bump bundled Prettier version to 3.9.8 (#26999) (leaysgur)

... (truncated)

Commits

Updates oxlint from 1.82.0 to 1.87.0

Release notes

Sourced from oxlint's releases.

oxlint v1.87.0

🚀 Features

  • 42dcfd2 linter/react/no-unescaped-entities: Implement suggestion (#27292) (Mikhail Baev)
  • cd4510d linter/unicorn/no-useless-switch-case: Implement suggestion (#27245) (Mikhail Baev)
  • 1a7c902 linter/react/jsx-no-target-blank: Implement suggestion (#27181) (Mikhail Baev)

🐛 Bug Fixes

  • 176b4b9 linter/jsx-a11y/label-has-associated-control: Validate label attribute values (#27302) (sama Pyb)
  • 7d381c3 linter/jsx-a11y/mouse-events-have-key-events: Handle nullish event handlers (#27306) (sama Pyb)
  • 4e09837 linter/jsx-a11y/lang: Validate lang expression strings (#27304) (sama Pyb)
  • 7d28a66 linter/unicorn/numeric-separators-style: Report misgrouped BigInt literals (#27207) (breken)
  • e928322 linter/unicorn/no-zero-fractions: Parenthesize separator and large integers in fixer (#27206) (breken)
  • 3d61a59 parser: Validate TypeScript type member separators (#27222) (camc314)
  • f08236b linter/eslint/prefer-exponentiation-operator: Preserve autofix precedence (#27150) (camc314)
  • 7d60ae3 linter/valid-title: Continue checks after allowed words (#27146) (Cameron)
  • ad5dd5d linter/eslint/no-unused-vars: Respect disabled argument checks for used ignore patterns (#26925) (camc314)

oxlint v1.86.0

🚀 Features

  • 9d80eed linter/react/only-export-components: Support allowCompoundComponents (#27117) (Kuroda Kayn)
  • e05b155 linter: Add typescript/no-generated-empty-object-type (#26958) (camc314)

🐛 Bug Fixes

  • 8306aa4 linter/typescript/no-unnecessary-parameter-property-assignment: Account for parameter property reassignment (#26955) (camc314)
  • 42dfbb5 linter/eslint/one-var: Keep declare when splitting declarations (#27081) (Cheolhee Lee)
  • 2ba7e33 linter/eslint/require-await: Count await using as an await (#27080) (Cheolhee Lee)
  • 611e4ed linter/plugins: Include executing selectors in JS plugin rule timings (#27111) (overlookmotel)
  • 2cac66f react-compiler: Handle recursive function expressions (#26796) (Brennan Butler)
  • e996e6c react-compiler: Treat zero-argument new Date as impure (#26894) (Boshen)
  • 571cfa3 oxlint: Skip type-aware lint rules in type-check-only mode (#27076) (camc314)
  • d0b2462 oxlint: Skip undefined children in CFG walker (#27075) (camc314)
  • 5186328 parser: Handle HTML comment values (#22933) (Boshen)
  • 0b630e8 linter/typescript/unified-signatures: Align rule with upstream (#26956) (camc314)
  • ebb22f1 linter/node/no-exports-assign: Change category from style to suspicious (#26555) (Bartok)
  • cce28a0 linter/import/no-duplicates: Distinguish import attributes (#26936) (camc314)
  • feb733b linter/unicorn/prefer-spread: Stop checking string split calls (#26935) (camc314)
  • 929e154 linter/eslint/no-unused-vars: Honor ignore patterns inside array rest bindings (#26923) (camc314)
  • 5bdb9b8 linter/eslint/no-unused-vars: Recognize consumed update expressions (#26782) (camc314)
  • 5c05bef linter/eslint/prefer-const: Ignore embedded assignments (#26920) (camc314)

⚡ Performance

  • ded4c29 linter/eslint/no-unused-vars: Skip sequence checks when absent (#26921) (camc314)

oxlint v1.85.0

🚀 Features

... (truncated)

Changelog

Sourced from oxlint's changelog.

Changelog

All notable changes to this package will be documented in this file.

The format is based on Keep a Changelog.

[1.86.0] - 2026-09-28

🚀 Features

  • 9d80eed linter/react/only-export-components: Support allowCompoundComponents (#27117) (Kuroda Kayn)
  • e05b155 linter: Add typescript/no-generated-empty-object-type (#26958) (camc314)
Commits
  • 2bd08eb release(apps): oxlint v1.87.0 && oxfmt v0.72.0 (#27341)
  • 2ae2939 release(apps): oxlint v1.86.0 && oxfmt v0.71.0 (#27132)
  • 9d80eed feat(linter/react/only-export-components): support allowCompoundComponents ...
  • e05b155 feat(linter): add typescript/no-generated-empty-object-type (#26958)
  • 88a0096 chore(oxlint): require tsgolint 7.0.2003 (#27021)
  • 288d8cc release(apps): oxlint v1.85.0 && oxfmt v0.70.0 (#26903)
  • f02a64a release(apps): oxlint v1.84.0 && oxfmt v0.69.0 (#26874)
  • 7bf68f7 release(apps): oxlint v1.83.0 && oxfmt v0.68.0 (#26631)
  • See full diff in compare view

Updates oxlint-plugin-react-doctor from 0.9.13 to 0.9.17

Release notes

Sourced from oxlint-plugin-react-doctor's releases.

oxlint-plugin-react-doctor@0.9.17

No release notes provided.

oxlint-plugin-react-doctor@0.9.16

Patch Changes

  • #1855 23d6160 Thanks @​aidenybai! - Avoid sequential-await warnings when local helpers read the same cache entry or delegate to the same imported operation with matching stable arguments. Follow bounded imported helpers to guarded, module-owned Map/WeakMap caches keyed by unchanged function parameters, with dependency fingerprints for cache invalidation. Preserve warnings for distinct imported operations sharing an input, and bound the diagnostic's parallelization advice.

    Keep diagnostics when a helper computes a cache key with an unknown call or property read. These values can change between calls.

  • #1855 23d6160 Thanks @​aidenybai! - Recognize convergent last-item equality guards in no-self-updating-effect, including literal tail replacements and appends with tail-preserving deferred trims.

  • #1855 23d6160 Thanks @​aidenybai! - Avoid no-derived-state false positives when custom hooks return draft state setters through immutable aliases.

  • #1846 6313667 Thanks @​aidenybai! - Disable require-pnpm-hardening by default; enable it explicitly through rules when wanted. Describe await parallelization as a conditional opportunity, preserving ordering, resource limits, and error semantics. Recognize local Promise.all/allSettled collectors and stop describing async array callbacks as sequential.

  • #1811 3242a81 Thanks @​skoshx! - Fix cache/navigation binding resolution and unsafe mutation parallelization (issue #1810)

    • server-cache-with-object-literal: Properly resolve React.cache imports through aliases and check all argument positions for fresh objects/arrays. Shadowed or non-React cache functions no longer trigger false positives.

    • nextjs-no-redirect-in-try-catch: Recognize Next.js unstable_rethrow(error) as a valid error forwarding pattern, suppressing the diagnostic when the caught error is correctly rethrown.

    • server-sequential-independent-await and async-parallel: Detect mutating HTTP requests (POST, PUT, PATCH, DELETE) and preserve their ordering, preventing incorrect parallelization suggestions for operations that must run sequentially.

  • #1832 8a950f0 Thanks @​skoshx! - Fix effect-needs-cleanup false positive for React 19 callback ref cleanup returns. React 19 callback refs can return cleanup functions with the signature (node: T | null) => void | (() => void). The rule now correctly handles cases where cleanup is only returned after resource usage (e.g., after ResizeObserver.observe()), allowing void returns on the null branch.

  • #1855 23d6160 Thanks @​aidenybai! - Resolve local Hook-shaped object methods before applying React Hook namespace heuristics, including inspection dispatchers and useEffectEvent. Preserve Hook diagnostics for unresolved invoked callbacks and bound Hook aliases, while resolving proven local callbacks at each call site.

  • #1855 23d6160 Thanks @​aidenybai! - Avoid display-name diagnostics for data factories that return descriptors containing JSX icons.

    Preserve anonymous-component diagnostics for proven array maps and React useMemo callbacks that return render output.

  • #1855 23d6160 Thanks @​aidenybai! - Recognize effect-owned timer replacements that clear the previous handle before assignment and release the final timer during teardown.

  • #1855 23d6160 Thanks @​aidenybai! - Respect Solid JSX applicability in handler naming, DOM property, and module-scope helper advice while preserving React diagnostics in mixed-runtime files.

oxlint-plugin-react-doctor@0.9.14

Patch Changes

  • #1783 1239043 Thanks @​aidenybai! - Upgrade oxlint to 1.81 and oxc-parser to 0.148.

  • #1762 ff7dd67 Thanks @​skoshx! - Avoid effect-needs-cleanup diagnostics for owned chained timers, guarded post-await timers, and listeners released through an abort handler.

  • #1763 0fbef9b Thanks @​skoshx! - Fix an async-defer-await false positive on exact live and isLive liveness guards without exempting unrelated names that only contain the same text.

  • #1761 6ac8b71 Thanks @​skoshx! - Fix false positive in nextjs-no-side-effect-in-get-handler when locally-built Headers object is passed to a same-file helper that mutates it.

    The rule now transfers locally-created response object safety through the exact same-file helper call. Calls that pass external state to the same helper remain reportable.

... (truncated)

Changelog

Sourced from oxlint-plugin-react-doctor's changelog.

0.9.17

0.9.16

Patch Changes

  • #1855 23d6160 Thanks @​aidenybai! - Avoid sequential-await warnings when local helpers read the same cache entry or delegate to the same imported operation with matching stable arguments. Follow bounded imported helpers to guarded, module-owned Map/WeakMap caches keyed by unchanged function parameters, with dependency fingerprints for cache invalidation. Preserve warnings for distinct imported operations sharing an input, and bound the diagnostic's parallelization advice.

    Keep diagnostics when a helper computes a cache key with an unknown call or property read. These values can change between calls.

  • #1855 23d6160 Thanks @​aidenybai! - Recognize convergent last-item equality guards in no-self-updating-effect, including literal tail replacements and appends with tail-preserving deferred trims.

  • #1855 23d6160 Thanks @​aidenybai! - Avoid no-derived-state false positives when custom hooks return draft state setters through immutable aliases.

  • #1846 6313667 Thanks @​aidenybai! - Disable require-pnpm-hardening by default; enable it explicitly through rules when wanted. Describe await parallelization as a conditional opportunity, preserving ordering, resource limits, and error semantics. Recognize local Promise.all/allSettled collectors and stop describing async array callbacks as sequential.

  • #1811 3242a81 Thanks @​skoshx! - Fix cache/navigation binding resolution and unsafe mutation parallelization (issue #1810)

    • server-cache-with-object-literal: Properly resolve React.cache imports through aliases and check all argument positions for fresh objects/arrays. Shadowed or non-React cache functions no longer trigger false positives.

    • nextjs-no-redirect-in-try-catch: Recognize Next.js unstable_rethrow(error) as a valid error forwarding pattern, suppressing the diagnostic when the caught error is correctly rethrown.

    • server-sequential-independent-await and async-parallel: Detect mutating HTTP requests (POST, PUT, PATCH, DELETE) and preserve their ordering, preventing incorrect parallelization suggestions for operations that must run sequentially.

  • #1832 8a950f0 Thanks @​skoshx! - Fix effect-needs-cleanup false positive for React 19 callback ref cleanup returns. React 19 callback refs can return cleanup functions with the signature (node: T | null) => void | (() => void). The rule now correctly handles cases where cleanup is only returned after resource usage (e.g., after ResizeObserver.observe()), allowing void returns on the null branch.

  • #1855 23d6160 Thanks @​aidenybai! - Resolve local Hook-shaped object methods before applying React Hook namespace heuristics, including inspection dispatchers and useEffectEvent. Preserve Hook diagnostics for unresolved invoked callbacks and bound Hook aliases, while resolving proven local callbacks at each call site.

  • #1855 23d6160 Thanks @​aidenybai! - Avoid display-name diagnostics for data factories that return descriptors containing JSX icons.

    Preserve anonymous-component diagnostics for proven array maps and React useMemo callbacks that return render output.

  • #1855 23d6160 Thanks @​aidenybai! - Recognize effect-owned timer replacements that clear the previous handle before assignment and release the final timer during teardown.

  • #1855 23d6160 Thanks @​aidenybai! - Respect Solid JSX applicability in handler naming, DOM property, and module-scope helper advice while preserving React diagnostics in mixed-runtime files.

0.9.15

Patch Changes

  • #1837 83466a8 Thanks @​skoshx! - Fix a stack overflow in no-hydration-branch-on-browser-global when resolving arguments across files. Track parameters and visited bindings by symbol identity so file-local numeric IDs cannot collide, and preserve cycle tracking across imported helpers.

  • #1814 499a020 Thanks @​aidenybai! - Stop no-impure-state-updater reporting callbacks handed to a helper that merely runs them (run(async () => setValue("x"))). Only a wrapper that forwards its parameter into a React setter's updater slot still counts as an updater.

    Stop nextjs-no-side-effect-in-get-handler reporting .set() on a Headers object the helper constructs itself; mutations on stores the helper did not create still report.

    Treat a ternary between static values (hasHeader ? 0 : 16) as static spacing in rn-scrollview-dynamic-padding, and reword its recommendation to name the matching contentInset edge and its iOS-only scope.

    Accept a Zustand store.setState(awaitedValue) re-sync as a cache update in query-mutation-missing-invalidation; plain UI-state writes and non-store bindings still report.

... (truncated)

Commits
  • 0a046d2 chore: version packages (#1865)
  • 675ad3c chore: version packages (#1838)
  • 23d6160 fix: resolve latest repository audit false positives (#1855)
  • 6313667 fix: make pnpm hardening opt-in and correct async advice (#1846)
  • 3242a81 fix: resolve cache/navigation binding and unsafe mutation parallelization (#1...
  • d741d58 chore: version packages (#1806)
  • 8a950f0 fix: support React 19 callback ref cleanup returns in effect-needs-cleanup (#...
  • 83466a8 fix: stop hydration argument cycles across files (#1837)
  • 95db911 test: stabilize CI performance and worktree checks (#1834)
  • a4daa0a RD CLEANUP: simplify cleanup helpers (#1833)
  • Additional commits viewable in compare view

Updates pkg-pr-new from 0.0.88 to 0.0.90

Commits

Updates publint from 0.3.24 to 0.3.25

Release notes

Sourced from publint's releases.

publint@0.3.25

Patch Changes

  • #260 54aebea - Fix FILE_INVALID_JSX_EXTENSION not detecting the .ctsx extension

  • #265 78604f3 - Skip file existence check for browser field values that point at another package

Changelog

Sourced from publint's changelog.

0.3.25

Patch Changes

  • #260 54aebea - Fix FILE_INVALID_JSX_EXTENSION not detecting the .ctsx extension

  • #265 78604f3 - Skip file existence check for browser field values that point at another package

Commits

Updates turbo from 2.10.12 to 2.11.7

Release notes

Sourced from turbo's releases.

Turborepo v2.11.7

What's Changed

Changelog

Full Changelog: vercel/turborepo@v2.11.6...v2.11.7

Turborepo v2.11.6

What's Changed

Changelog

New Contributors

Full Changelog: vercel/turborepo@v2.11.5...v2.11.6

Turborepo v2.11.5

What's Changed

Changelog

... (truncated)

Commits

Updates ultracite from 7.11.1 to 7.12.4

Release notes

Sourced from ultracite's releases.

ultracite@7.12.4

Patch Changes

  • 1cdaf87: Add opt-in ultracite/oxlint/gdp and ultracite/eslint/gdp presets for gdp-ts, which makes authorization checks visible to the type checker. Following upstream's strict mode, they stop proofs being forged with type assertions ({} as UserIsProjectAdmin<U, P>) or minted outside proofs/, ban other type assertions outside proofs/ and lib/ids.ts (except as const), and keep provers private to their trusted module. Upstream's no-any is left off because core already bans any. Inside proofs/, empty proof interfaces (interface X<P> extends Proof<"X", [P]> {}) are allowed, and the ESLint preset ignores _-prefixed proof arguments in no-unused-vars, as Oxlint does by default. @gdp-ts/core ships the plugin, so there is nothing extra to install: extend the preset after core.

ultracite@7.12.3

Patch Changes

  • f753c14: Add opt-in TSDoc syntax validation and public TypeScript API documentation checks to the Oxlint js-plugins preset. Selecting a plugin with --js-plugins on a config that extends the full js-plugins preset now keeps the preset's plugins.

  • ade34d3: Update @biomejs/biome to 2.5.15. The release adds 11 nursery rules and changes no stable rules, so the Biome presets, which exclude nursery rules, are unchanged. It speeds up HTML formatting and big-file analysis, fixes Astro expression indentation and Svelte comment placement, and reports configuration errors that Biome 2.5.14 silently ignored.

  • 631e0dd: Update oxfmt to 0.71.0. The release changes no options; it bundles Prettier 3.9.9 for embedded languages and fixes comment placement around assignments, JSDoc alignment and several Markdown edge cases.

  • 08e83af: Update oxlint to 1.86.0 and enable its new type-aware rule, typescript/no-generated-empty-object-type, in the core Oxlint preset. It reports type operations such as Pick<Data, never> that resolve to the empty object type {}, matching the @typescript-eslint rule of the same name that the ESLint preset already enables. Like the other type-aware rules, it only runs with oxlint --type-aware and oxlint-tsgolint installed. Older oxlint releases fail to parse a config that names the rule, so the oxlint peer range moves to ^1.86.0.

    Requires oxlint >= 1.86.0

  • 2a9348c: Update the ESLint presets' plugins: eslint 10.12, eslint-plugin-unicorn 77, eslint-plugin-jsdoc 65, @typescript-eslint 8.71, eslint-plugin-sonarjs 4.2.2, eslint-plugin-react-doctor and oxlint-plugin-react-doctor 0.9.16, plus patch releases of the Next.js, TanStack Query, n, Solid and Storybook plugins.

    The ESLint core preset enables every non-deprecated JavaScript rule from unicorn, so it now also runs unicorn 77's 21 new JavaScript rules, including no-unnecessary-parameters, no-unsafe-json-serialization, prefer-promise-static-methods and a set of no-invalid-* checks for DOM, Intl, Response, Temporal and property descriptor arguments. It also enables the new type-aware @typescript-eslint/no-unsafe-enum-assignment. Unicorn 77 moves its CSS-only rules to eslint-cssicorn; the preset never enabled them for JavaScript files, so nothing is lost.

  • 864cde1: Raise the eslint peer dependency to ^10.9.0. The ESLint core preset configures no-unmodified-loop-condition with checkConditionalExpressions, an option ESLint 10.0 to 10.8 reject, so every preset except Vue failed with Key "rules": Key "no-unmodified-loop-condition" on those releases even though the old ^10.0.0 range allowed them (eslint-plugin-unicorn also needs ESLint 10.4 or later). ultracite init and ultracite upgrade now install a release that loads the presets, and ultracite doctor and your package manager flag older ones. @eslint/js, which is no longer versioned with ESLint, keeps its own ^10.0.1 range.

    Requires eslint >= 10.9.0

  • d7563b3: ultracite init now skips every prompt when you pass any of --pm, --editors, --agents, --hooks, --integrations, --frameworks or --workspace-framework, as documented. Before, the editor, agent, hook, skill and (with --frameworks) integration prompts still asked, which stalled scaffolding tools that call init without a TTY. --js-plugins with a linter other than Oxlint now stops init with an error instead of being silently ignored, and without --linter it skips the linter prompt.

  • 6c7e149: ultracite init no longer hangs on a .pre-commit-config.yaml or lefthook config with CRLF line endings and many consecutive comment lines. The check that keeps the file's sequence indentation could backtrack exponentially on that input.

  • 3dc6431: On Windows, a linter or formatter that isn't installed is now reported as missing instead of as "exited with code 1". ultracite check and ultracite fix warn and skip CSS linting when the optional Stylelint is missing, as they already did on macOS and Linux, and ultracite fix --agent now skips a missing Stylelint on every platform instead of failing.

  • 7f085b2: Type jsPlugins as a non-null array on the Oxlint presets that always ship plugins (js-plugins, shadcn, anti-slop, next/js-plugins, tanstack/js-plugins...

    Description has been truncated

@dependabot
chore(deps-dev): bump the development group with 16 updates
b774e31 
Bumps the development group with 16 updates:

| Package | From | To |
| --- | --- | --- |
| [@changesets/cli](https://github.com/changesets/changesets/tree/HEAD/packages/cli) | `3.0.2` | `3.0.3` |
| [eslint-plugin-sonarjs](https://github.com/SonarSource/SonarJS) | `4.2.0` | `4.2.2` |
| [oxfmt](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt) | `0.68.0` | `0.72.0` |
| [oxlint](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint) | `1.82.0` | `1.87.0` |
| [oxlint-plugin-react-doctor](https://github.com/millionco/react-doctor/tree/HEAD/packages/oxlint-plugin-react-doctor) | `0.9.13` | `0.9.17` |
| [pkg-pr-new](https://github.com/stackblitz-labs/pkg.pr.new/tree/HEAD/packages/cli) | `0.0.88` | `0.0.90` |
| [publint](https://github.com/publint/publint/tree/HEAD/packages/publint) | `0.3.24` | `0.3.25` |
| [turbo](https://github.com/vercel/turborepo) | `2.10.12` | `2.11.7` |
| [ultracite](https://github.com/haydenbleasel/ultracite) | `7.11.1` | `7.12.4` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.5.1` | `26.6.4` |
| [@webgpu/types](https://github.com/gpuweb/types) | `0.1.72` | `0.1.74` |
| [postcss](https://github.com/postcss/postcss) | `8.5.28` | `8.5.29` |
| [@supabase/supabase-js](https://github.com/supabase/supabase-js/tree/HEAD/packages/core/supabase-js) | `2.116.0` | `2.117.2` |
| [cloudflare](https://github.com/cloudflare/cloudflare-typescript) | `7.1.0` | `7.3.0` |
| [pg](https://github.com/brianc/node-postgres/tree/HEAD/packages/pg) | `8.23.0` | `8.23.1` |
| [redis](https://github.com/redis/node-redis) | `6.2.1` | `6.3.0` |


Updates `@changesets/cli` from 3.0.2 to 3.0.3
- [Release notes](https://github.com/changesets/changesets/releases)
- [Changelog](https://github.com/changesets/changesets/blob/main/packages/cli/CHANGELOG.md)
- [Commits](https://github.com/changesets/changesets/commits/@changesets/cli@3.0.3/packages/cli)

Updates `eslint-plugin-sonarjs` from 4.2.0 to 4.2.2
- [Release notes](https://github.com/SonarSource/SonarJS/releases)
- [Changelog](https://github.com/SonarSource/SonarJS/blob/master/docs/RELEASE.md)
- [Commits](https://github.com/SonarSource/SonarJS/commits)

Updates `oxfmt` from 0.68.0 to 0.72.0
- [Release notes](https://github.com/oxc-project/oxc/releases)
- [Changelog](https://github.com/oxc-project/oxc/blob/main/npm/oxfmt/CHANGELOG.md)
- [Commits](https://github.com/oxc-project/oxc/commits/oxfmt_v0.72.0/npm/oxfmt)

Updates `oxlint` from 1.82.0 to 1.87.0
- [Release notes](https://github.com/oxc-project/oxc/releases)
- [Changelog](https://github.com/oxc-project/oxc/blob/main/npm/oxlint/CHANGELOG.md)
- [Commits](https://github.com/oxc-project/oxc/commits/oxlint_v1.87.0/npm/oxlint)

Updates `oxlint-plugin-react-doctor` from 0.9.13 to 0.9.17
- [Release notes](https://github.com/millionco/react-doctor/releases)
- [Changelog](https://github.com/millionco/react-doctor/blob/main/packages/oxlint-plugin-react-doctor/CHANGELOG.md)
- [Commits](https://github.com/millionco/react-doctor/commits/oxlint-plugin-react-doctor@0.9.17/packages/oxlint-plugin-react-doctor)

Updates `pkg-pr-new` from 0.0.88 to 0.0.90
- [Commits](https://github.com/stackblitz-labs/pkg.pr.new/commits/v0.0.90/packages/cli)

Updates `publint` from 0.3.24 to 0.3.25
- [Release notes](https://github.com/publint/publint/releases)
- [Changelog](https://github.com/publint/publint/blob/master/packages/publint/CHANGELOG.md)
- [Commits](https://github.com/publint/publint/commits/publint@0.3.25/packages/publint)

Updates `turbo` from 2.10.12 to 2.11.7
- [Release notes](https://github.com/vercel/turborepo/releases)
- [Changelog](https://github.com/vercel/turborepo/blob/main/RELEASE.md)
- [Commits](vercel/turborepo@v2.10.12...v2.11.7)

Updates `ultracite` from 7.11.1 to 7.12.4
- [Release notes](https://github.com/haydenbleasel/ultracite/releases)
- [Commits](https://github.com/haydenbleasel/ultracite/compare/ultracite@7.11.1...ultracite@7.12.4)

Updates `@types/node` from 26.5.1 to 26.6.4
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `@webgpu/types` from 0.1.72 to 0.1.74
- [Commits](gpuweb/types@v0.1.72...v0.1.74)

Updates `postcss` from 8.5.28 to 8.5.29
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.5.28...8.5.29)

Updates `@supabase/supabase-js` from 2.116.0 to 2.117.2
- [Release notes](https://github.com/supabase/supabase-js/releases)
- [Changelog](https://github.com/supabase/supabase-js/blob/master/packages/core/supabase-js/CHANGELOG.md)
- [Commits](https://github.com/supabase/supabase-js/commits/v2.117.2/packages/core/supabase-js)

Updates `cloudflare` from 7.1.0 to 7.3.0
- [Release notes](https://github.com/cloudflare/cloudflare-typescript/releases)
- [Changelog](https://github.com/cloudflare/cloudflare-typescript/blob/main/CHANGELOG.md)
- [Commits](cloudflare/cloudflare-typescript@v7.1.0...v7.3.0)

Updates `pg` from 8.23.0 to 8.23.1
- [Changelog](https://github.com/brianc/node-postgres/blob/master/CHANGELOG.md)
- [Commits](https://github.com/brianc/node-postgres/commits/pg@8.23.1/packages/pg)

Updates `redis` from 6.2.1 to 6.3.0
- [Release notes](https://github.com/redis/node-redis/releases)
- [Changelog](https://github.com/redis/node-redis/blob/master/CHANGELOG.md)
- [Commits](https://github.com/redis/node-redis/compare/redis@6.2.1...redis@6.3.0)

---
updated-dependencies:
- dependency-name: "@changesets/cli"
  dependency-version: 3.0.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: development
- dependency-name: eslint-plugin-sonarjs
  dependency-version: 4.2.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: development
- dependency-name: oxfmt
  dependency-version: 0.72.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development
- dependency-name: oxlint
  dependency-version: 1.87.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development
- dependency-name: oxlint-plugin-react-doctor
  dependency-version: 0.9.17
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: development
- dependency-name: pkg-pr-new
  dependency-version: 0.0.90
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: development
- dependency-name: publint
  dependency-version: 0.3.25
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: development
- dependency-name: turbo
  dependency-version: 2.11.7
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development
- dependency-name: ultracite
  dependency-version: 7.12.4
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development
- dependency-name: "@types/node"
  dependency-version: 26.6.4
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development
- dependency-name: "@webgpu/types"
  dependency-version: 0.1.74
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: development
- dependency-name: postcss
  dependency-version: 8.5.29
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: development
- dependency-name: "@supabase/supabase-js"
  dependency-version: 2.117.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development
- dependency-name: cloudflare
  dependency-version: 7.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development
- dependency-name: pg
  dependency-version: 8.23.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: development
- dependency-name: redis
  dependency-version: 6.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 8, 2026
@vercel

vercel Bot commented Oct 8, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
vecstore-sdk Ready Ready Preview Oct 8, 2026 10:11pm UTC

@changeset-bot

changeset-bot Bot commented Oct 8, 2026

Copy link
Copy Markdown

⚠️ No Changeset found

Latest commit: b774e31

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@coderabbitai

coderabbitai Bot commented Oct 8, 2026

Copy link
Copy Markdown

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration
  • Configuration used: Organization UI
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: b4d38a70-fbd1-4129-87c5-c23b61711231

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
  • Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@pkg-pr-new

pkg-pr-new Bot commented Oct 8, 2026

Copy link
Copy Markdown

Open in StackBlitz

npm i https://pkg.pr.new/vecstore-sdk@52

commit: b774e31

@socket-security

socket-security Bot commented Oct 8, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatedpkg-pr-new@​0.0.88 ⏵ 0.0.90100 +11007094 +2100
Updatedeslint-plugin-sonarjs@​4.2.0 ⏵ 4.2.299100100 +195 +770
Updated@​changesets/​cli@​3.0.2 ⏵ 3.0.399 +110074 +195100
Updatedcloudflare@​7.1.0 ⏵ 7.3.079100100 +194 -1100
Updated@​types/​node@​26.5.1 ⏵ 26.6.4100 +110081 +196100
Updatedpublint@​0.3.24 ⏵ 0.3.25100 +110081 +192100
Updatedpostcss@​8.5.28 ⏵ 8.5.29100 +110082 +194100
Updatedturbo@​2.10.12 ⏵ 2.11.710010085 +197 +1100
Updatedoxfmt@​0.68.0 ⏵ 0.72.094 +810088 +196 +1100
Updated@​supabase/​supabase-js@​2.116.0 ⏵ 2.117.289 +110010097 +2100
Updatedoxlint@​1.82.0 ⏵ 1.87.09910091 +195 -1100
Updatedpg@​8.23.0 ⏵ 8.23.199 +1100100 +191 +2100
Updated@​webgpu/​types@​0.1.72 ⏵ 0.1.74100100100 +194 -1100
Updatedzod@​4.6.1 ⏵ 4.6.510010010095100
Updatedredis@​6.2.1 ⏵ 6.3.0100 +1100100 +196100
Updatedultracite@​7.11.1 ⏵ 7.12.49810098 +196 +1100
Updatedoxlint-plugin-react-doctor@​0.9.13 ⏵ 0.9.1710010010096100

View full report

@dependabot @github

dependabot Bot commented on behalf of github Oct 15, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Oct 15, 2026
@dependabot
dependabot Bot deleted the dependabot/bun/development-e5f2b997d3 branch October 15, 2026 22:07

This branch was successfully deployed

1 active deployment
Preview — b774e313 Deployed Oct 8, 2026 by vercel[bot]
View deployment
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants