Build(deps-dev): Bump the dependencies group with 11 updates

[dependabot]

Bumps the dependencies group with 11 updates:

Package	From	To
@axe-core/playwright	4.11.3	4.12.1
@playwright/test	1.60.0	1.61.1
@types/node	24.13.1	26.1.0
@vitest/coverage-v8	4.1.8	4.1.9
eslint-plugin-sonarjs	4.0.3	4.1.0
fallow	2.89.0	2.104.0
oxfmt	0.51.0	0.57.0
oxlint	1.68.0	1.72.0
oxlint-tsgolint	0.23.0	0.24.0
vite	8.0.16	8.1.2
vitest	4.1.8	4.1.9

Updates @axe-core/playwright from 4.11.3 to 4.12.1

Changelog

Sourced from @​axe-core/playwright's changelog.

4.12.1 (2026-06-22)

Features

• Update axe-core to v4.12.1 (#1378) (4263054)

Commits

• See full diff in compare view

Updates @playwright/test from 1.60.0 to 1.61.1

Release notes

Sourced from @​playwright/test's releases.

v1.61.1

Bug Fixes

• #41365 [Bug]: Expect.Extend matcher with same name as default matcher in same expect instance overrides default matchers implementation to custom matcher
• #41351 [Bug]: Playwright UI mode: apiRequestContext._wrapApiCall reports unexpected number of bytes (same test passes in headed mode)
• #41360 [Bug]: Trace viewer: message times in websockets are downscaled by 1000
• #41311 [Bug]: [Regression]: Sync loader throws "context.conditions?.includes is not a function" on Node 22.15
• #41371 [Regression]: Sync ESM loader (registerHooks) fails to resolve extensionless .ts subpath imports across pnpm workspace symlinks

v1.61.0

🔑 WebAuthn passkeys

New Credentials virtual authenticator, available via browserContext.credentials, lets tests register passkeys and answer navigator.credentials.create() / navigator.credentials.get() ceremonies in the page — no real hardware key required, works in all browsers:

const context = await browser.newContext();
// Seed a passkey your backend provisioned for a test user.
await context.credentials.create('example.com', {
id: credentialId,
userHandle,
privateKey,
publicKey,
});
await context.credentials.install();
const page = await context.newPage();
await page.goto('https://example.com/login');
// The page's navigator.credentials.get() is answered with the seeded passkey.

You can also let the app register a passkey once in a setup test, read it back with credentials.get(), and seed it into later tests — see Credentials for details.

🗃️ Web Storage

New WebStorage API, available via page.localStorage and page.sessionStorage, reads and writes the page's storage for the current origin:

await page.localStorage.setItem('token', 'abc');
const token = await page.localStorage.getItem('token');
const items = await page.sessionStorage.items();

New APIs

Network

• apiResponse.securityDetails() and apiResponse.serverAddr() mirror the browser-side response.securityDetails() and response.serverAddr().

Browser and Screencast

... (truncated)

Commits

• 39e3553 cherry-pick(#41399): fix(test): load require-reached files as commonjs in syn...
• 4328122 chore: mark v1.61.1 (#41404)
• 2c29a94 fix(tracing): stop recording websocket frames outside of chunks (#41398)
• 4324b19 cherry-pick(#41367): fix(test): keep builtin expect matchers on base extend
• 041e7e3 cherry-pick(#41364): fix(har): WebSocket message timestamps should be in mi...
• b8a0fc3 cherry-pick(#41309, #43149): Revert "fix(firefox): treat `navigationCommitted...
• b5a3175 cherry-pick(#41319): fix(loader): support other node versions
• d4724a9 cherry-pick(#41290): feat(docker): add Ubuntu 26.04 (Resolute Raccoon) image
• 1cc5a90 cherry-pick(#41295): chore: PLAYWRIGHT_TRACING_NO_WEBSOCKET_FRAMES and PLAYWR...
• a6772bd cherry-pick(#41280): Revert "fix(trace-viewer): add keyboard navigation to `N...
• Additional commits viewable in compare view

Updates @types/node from 24.13.1 to 26.1.0

Commits

• See full diff in compare view

Updates @vitest/coverage-v8 from 4.1.8 to 4.1.9

Release notes

Sourced from @​vitest/coverage-v8's releases.

v4.1.9

🐞 Bug Fixes

• Fix importOriginal with optimizer and query import [backport to v4] - by Hiroshi Ogawa, David Harris, Codexand Vladimir in vitest-dev/vitest#10546 (a5180)
• browser:
  • Wait for orchestrator readiness before resolving browser sessions [backport to v4] - by Vladimir and Séamus O'Connor in vitest-dev/vitest#10555 (7fb29)
  • Wait for iframe tester readiness before preparing [backport to v4] - by Vladimir and Séamus O'Connor in vitest-dev/vitest#10497 and vitest-dev/vitest#10556 (fbc62)
• mocker:
  • Hoist vi.mock() for vite-plus/test imports [backport to v4] - by Hiroshi Ogawa, LongYinan, Claude Opus 4.8 and Vladimir in vitest-dev/vitest#10548 (2c955)
• pool:
  • Prevent test run hang on worker crash [backport to v4] - by Ari Perkkiö and Jattioui Ismail in vitest-dev/vitest#10543 and vitest-dev/vitest#10564 (934b0)

View changes on GitHub

Commits

• a7a61e7 chore: release v4.1.9 (#10598)
• See full diff in compare view

Updates eslint-plugin-sonarjs from 4.0.3 to 4.1.0

Commits

• See full diff in compare view

Updates fallow from 2.89.0 to 2.104.0

Release notes

Sourced from fallow's releases.

v2.104.0: CSS-in-JS intelligence, styling health, token blast-radius

Highlights

This release is heavy on CSS intelligence. fallow health --css now understands CSS-in-JS (styled-components, emotion, linaria, vanilla-extract, StyleX, Panda) as first-class, ships a second styling-health quality axis, and adds a design-token blast-radius index. Plus a staged human review walkthrough, an opt-in unused-prop exemption, and a batch of framework false-positive fixes.

CSS intelligence (CSS program, Phases 3-4)

• CSS-in-JS is first-class in fallow health --css. styled-components / emotion / linaria (tagged templates) and vanilla-extract / StyleX / Panda / emotion-object (object notation) previously produced null css_analytics. A lexical lifter now extracts the CSS body from both forms and feeds it through the same structural analytics and styling-health pipeline, so a CSS-in-JS app gets real duplicate-block, structural, and token-sprawl signals. Dep-gated on a declared CSS-in-JS library, so non-CSS-in-JS projects are byte-unchanged.
• Styling-health: a second CSS-quality axis, confidence-aware. fallow health --css reports a separate styling_health score (0-100) and A-F grade with a Deductions: breakdown across five capped penalty categories. It carries a confidence marker (high / low) so a thin authored-CSS surface (utility-first Tailwind app) renders dimmed with a caveat instead of an authoritative grade. Descriptive-only: no exit code, badge, or CI gating.
• Formula v3 weights value drift over exact repetition. Research is clear that exact CSS duplication is the least-harmful pattern while design-token inconsistency is the real maintenance harm, so the exact-block penalty is down-weighted to a soft hint and token-erosion gains a hardcoded-value-sprawl drift term (distinct un-tokenized box-shadow / border-radius / line-height values). STYLING_HEALTH_FORMULA_VERSION bumps to 3. If you diff styling_health.score/grade over time, re-baseline or gate on formula_version; the one-time step-change at this boundary is expected.
• Design-token blast-radius (token_consumers) for Tailwind v4 AND CSS-in-JS tokens. fallow health --css --format json now carries a reverse index of where each design token is consumed. Change --color-brand (Tailwind @theme) or a StyleX defineVars / vanilla-extract createTheme token and see a consumer_count plus located consumers[] before touching it. consumer_count is a static lower bound (descriptive context, not a deletion gate); the authoritative dead-token finding stays unused_theme_tokens.
• New get_token_blast_radius MCP tool. A focused, read-only tool that surfaces the token blast-radius directly without the agent needing to know the data hides inside css_analytics.
• Fuzzy CSS clones via value canonicalization. fallow dupes now canonicalizes CSS values on the stylesheet path (a zero-with-unit collapses to bare 0, a hex color expands to its long lowercased form), so value-drifted clones (0px vs 0, #fff vs #ffffff) hash equal and the same shadow / gradient / transition recipe re-implemented with drift finally matches. Scoped to CSS-family files and SFC/Astro <style> regions; JS/TS clone detection is unchanged.

Review and configuration

• fallow review --walkthrough: a staged terminal tour. Renders the review walkthrough guide as an ordered, human-readable tour (Review Focus header, staged sections, per-file one-line facts and grounded badges, a collapsed "cleared" panel). --format markdown emits a paste-into-PR artifact; --format json is byte-identical to --walkthrough-guide. Per-file viewed state persists locally (--mark-viewed) and tolerates a moved tree. Always exits 0.
• unusedComponentProps.ignorePattern: exempt intentionally-unused props. Set "unusedComponentProps": { "ignorePattern": "^_" } to exempt props whose local destructure binding matches the regex (the leading-underscore convention that TS noUnusedParameters and ESLint varsIgnorePattern honor). Applies to Vue, Svelte, Astro, and React/Preact. Opt-in; default behavior is unchanged. Thanks @​hniedner for the request. (Closes #1648)

CI, coverage, and architecture

• The GitLab CI template can reuse a pre-installed fallow binary. Set FALLOW_SKIP_INSTALL: "true" to skip npm install -g fallow and run a fallow already on PATH (for example a version pinned through a pnpm catalog), so CI runs the same binary as your local lint gate. The job fails fast when no fallow is found. Thanks @​Jerc92 for the patch in #1662.
• Coverage upload enrichment. fallow coverage --with-callers uploads importer edges, and the inventory upload now emits per-function complexity and per-file churn.
• Typed architecture boundaries. fallow-engine, fallow-output, and fallow-api now own the command-neutral analysis runners, output contracts, and programmatic Rust boundary; LSP, MCP, and NAPI callers consume typed results and serialize JSON only at protocol boundaries. The old fallow-programmatic-cli compatibility crate has been removed.

Bug fixes

• Iterating a typed class array no longer false-flags the class members as unused. A cluster of unused-class-member false positives where the class is only used through an iteration loop variable is now fixed across array-method callbacks (.map / .forEach / .filter / ...), for...of, React/Preact JSX .map, Svelte {#each}, Vue v-for (including props.<field> sources), Angular @for / *ngFor inline templates, and Astro template .map. Over-credit only: a genuinely unused member still reports. Thanks @​Ericlm for the report and minimal reproduction. (Closes #1707, #1711, #1712, #1713)
• unused-files no longer false-flags a Next.js page.mdx when next.config wraps its config object. export default withMDX(nextConfig) (the official @next/mdx idiom), module.exports = createJestConfig(cfg), and nested/curried wrappers now resolve, which also fixes the same class for any wrapped Vite / Webpack / Jest config. Thanks @​AlonMiz for the report. (Closes #1642)
• unused-files no longer false-flags a commit-and-tag-version updater script. A new plugin (legacy enabler standard-version) credits each bumpFiles[] / packageFiles[] updater module and filename target, from both the package.json key and standalone .versionrc configs, gated on the file existing on disk. Thanks @​rbalet for the report. (Closes #1640)
• unused-class-members no longer false-flags framework-dispatched OpenLayers methods or a coercion-only toString. A handleEvent on an ol/interaction/* subclass and a toString used only through string coercion (template interpolation, String(...), +) are now credited, with tight gating so genuinely-dead members still report. (Closes #1638)
• Telemetry findings_present is recorded again for fallow flags, fallow watch, and the security survivors / blind-spots subcommands. A debug-build invariant now fails fast if any finding-surfacing workflow records an event without noting its find-state, preventing the whole regression class. No change to the telemetry payload shape. (Closes #1650)

Full Changelog: fallow-rs/fallow@v2.103.0...v2.104.0

v2.103.0: typed output contracts, runtime trust-output, false-positive fixes

Runtime coverage trust-output

coverage analyze --format json now mirrors the cloud runtime trust-output contract on the local report, so an agent can reproduce a verdict instead of re-deriving it:

• Actionability + provenance. Each report carries actionable, actionability_reason, and actionability_verdict (a capture with no tracked functions is a first-class insufficient_evidence verdict, never silently read as cold), plus a provenance block (data_source, freshness_days, untracked_ratio, unresolved_ratio, stale, stale_after_days). The block is context only: it never gates a positive verdict or a confidence score.
• Confidence discriminators. Every finding now carries a discriminators block exposing the inputs behind its verdict: tracking_state (called / never_called / untracked), invocation_ratio, the low_traffic_threshold and min_observation_volume in effect, and trace_count with meets_observation_volume.
• Source-map upload hint. When coverage analyze --cloud cannot map runtime positions to source and built source maps exist on disk, fallow prints the exact fallow coverage upload-source-maps --dir <dir> command. Human output only; JSON consumers already get the structured coverage_unresolved warning.

All three additions are additive and backwards-compatible.

Typed output contracts

The engine, output, API, and programmatic-CLI boundaries are now explicit: typed engine results feed the CLI, LSP, NAPI, MCP, and programmatic consumers through shared contracts instead of CLI rendering being the implicit API surface.

... (truncated)

Changelog

Sourced from fallow's changelog.

[2.104.0] - 2026-07-01

Added

• The GitLab CI template can reuse a pre-installed fallow binary. Set FALLOW_SKIP_INSTALL: "true" to skip npm install -g fallow and run the fallow already resolvable on PATH, for example a version pinned through a pnpm catalog and exposed on PATH, so CI runs the same binary as your local lint gate. The job fails fast with a clear error when no fallow is found. Default behavior is unchanged. Thanks @​Jerc92 for the patch in #1662.

• Design-token blast-radius for CSS-in-JS tokens (CSS program Phase 3d). The Phase 2 token blast-radius (css_analytics.token_consumers + the get_token_blast_radius MCP tool) covered only Tailwind v4 @theme tokens. It now also covers CSS-in-JS token DEFINITIONS, so changing a StyleX defineVars or vanilla-extract createTheme / createThemeContract / createGlobalTheme token shows its blast radius (a consumer_count plus located consumers[]) the same way an @theme token does. Because CSS-in-JS tokens are defined in JS objects and consumed via cross-module member access (import { vars } from './tokens'; vars.color.primary, including bracket access vars.color['gray-100']), the consumer scan resolves each relative import to its defining file and matches the member-access chain against the defined leaf token paths, so an unrelated same-named binding is never counted. Entries reuse the existing token_consumers shape with a new consumers[].kind of js-member; token is the binding-qualified access path (vars.color.primary) and namespace is the defining binding (vars). Dep-gated on a declared CSS-in-JS library (@stylexjs/stylex / @vanilla-extract/css), descriptive-only (no actions, no exit-code effect), no new wire field, and no CACHE_VERSION bump; a non-CSS-in-JS project and a plain fallow health run (no --css) are byte-unchanged, and the Tailwind token_consumers output is untouched. consumer_count is a static lower bound (path-aliased / bare-package imports are not resolved), and unlike Tailwind there is no corroborating dead-token finding, so a CSS-in-JS consumer_count of 0 is a weaker signal. Panda (defineTokens / token('...')) is a planned follow-on.

• Fuzzy CSS clones via CSS-aware value canonicalization (CSS program Phase 4). fallow dupes already tokenized CSS, but the lexer was character-naive, so near-miss / value-drifted CSS clones (the same shadow / gradient / transition recipe re-implemented with 0px vs 0 or #fff vs #ffffff drift, the shape of design-system erosion) never matched. The duplicate-detection tokenizer now canonicalizes CSS values on the stylesheet path: a zero-with-unit collapses to a bare 0 (0px/0em/0%) and a hex color expands to its long lowercased form (#fff -> #ffffff, #abcd -> #aabbccdd), so semantically-equal CSS hashes equal and the clone engine surfaces the fuzzy duplicates. Scoped to CSS-family files and SFC/Astro <style> regions only; JS/TS clone detection is unchanged. (PR #1669)

• CSS-in-JS first-class in fallow health --css (CSS program Phase 3). styled-components / emotion / linaria apps previously got null css_analytics

... (truncated)

Commits

• e36026d chore: release v2.104.0
• ea88340 fix(napi): align smoke test with consolidated engine root-validation message
• bcc1f78 docs: link iteration-binding residual follow-up issues (#1716, #1717, #1718)
• b8ef5a0 fix(extract): credit deferred iteration-binding sibling class members (#1715)
• 8ce42a1 docs: link iteration-binding follow-up issues (#1714)
• 91fb0ee fix(extract): credit iteration-binding class members (#1710)
• db54051 fix(extract): credit Vue v-for loop variable class member accesses (#1709)
• 66697dd refactor(architecture): finish typed engine split
• 3352186 chore(license): drop redundant ed25519-dalek dev-dependency
• 16d7934 chore(deps): bump syn from 2.0.117 to 2.0.118 (#1695)
• Additional commits viewable in compare view

Updates oxfmt from 0.51.0 to 0.57.0

Commits

• 5306f24 release(apps): oxlint v1.72.0 && oxfmt v0.57.0 (#23935)
• c4be770 release(apps): oxlint v1.71.0 && oxfmt v0.56.0 (#23707)
• aa79b5b release(apps): oxlint v1.70.0 && oxfmt v0.55.0 (#23442)
• 9a2788b feat(linter/unicorn): implement prefer-export-from rule (#22935)
• 44ae845 release(apps): oxlint v1.69.0 && oxfmt v0.54.0 (#23116)
• dadafe3 docs(oxlint, oxfmt): mention migrate skills in npm READMEs (#22965)
• f88961a docs(oxfmt): annotate each config option with supported languages (#22953)
• 964a758 release(apps): oxlint v1.68.0 && oxfmt v0.53.0 (#22883)
• 68b455d release(apps): oxlint v1.67.0 && oxfmt v0.52.0 (#22735)
• 16b8058 feat(oxfmt): Support vite-plus/resolveConfig for vite.config.ts (#22454)
• See full diff in compare view

Updates oxlint from 1.68.0 to 1.72.0

Release notes

Sourced from oxlint's releases.

oxlint v1.27.0 && oxfmt v0.12.0

Oxlint v1.27.0

🚀 Features

• 222a8f0 linter/plugins: Implement SourceCode#isSpaceBetween (#15498) (overlookmotel)
• 2f9735d linter/plugins: Implement context.languageOptions (#15486) (overlookmotel)
• bc731ff linter/plugins: Stub out all Context APIs (#15479) (overlookmotel)
• 5822cb4 linter/plugins: Add extend method to FILE_CONTEXT (#15477) (overlookmotel)
• 7b1e6f3 apps: Add pure rust binaries and release to github (#15469) (Boshen)
• 2a89b43 linter: Introduce debug assertions after fixes to assert validity (#15389) (camc314)
• ad3c45a editor: Add oxc.path.node option (#15040) (Sysix)

🐛 Bug Fixes

• 6f3cd77 linter/no-var: Incorrect warning for blocks (#15504) (Hamir Mahal)
• 6957fb9 linter/plugins: Do not allow access to Context#id in createOnce (#15489) (overlookmotel)
• 7409630 linter/plugins: Allow access to cwd in createOnce in ESLint interop mode (#15488) (overlookmotel)
• 732205e parser: Reject using / await using in a switch case / default clause (#15225) (sapphi-red)
• a17ca32 linter/plugins: Replace Context class (#15448) (overlookmotel)
• ecf2f7b language_server: Fail gracefully when tsgolint executable not found (#15436) (camc314)
• 3c8d3a7 lang-server: Improve logging in failure case for tsgolint (#15299) (camc314)
• ef71410 linter: Use jsx if source type is JS in fix debug assertion (#15434) (camc314)
• e32bbf6 linter/no-var: Handle TypeScript declare keyword in fixer (#15426) (camc314)
• 6565dbe linter/switch-case-braces: Skip comments when searching for : token (#15425) (camc314)
• 85bd19a linter/prefer-class-fields: Insert value after type annotation in fixer (#15423) (camc314)
• fde753e linter/plugins: Block access to context.settings in createOnce (#15394) (overlookmotel)
• ddd9f9f linter/forward-ref-uses-ref: Dont suggest removing wrapper in invalid positions (#15388) (camc314)
• dac2a9c linter/no-template-curly-in-string: Remove fixer (#15387) (camc314)
• 989b8e3 linter/no-var: Only fix to const if the var has an initializer (#15385) (camc314)
• cc403f5 linter/plugins: Return empty object for unimplemented parserServices (#15364) (magic-akari)

⚡ Performance

• 25d577e language_server: Start tools in parallel (#15500) (Sysix)
• 3c57291 linter/plugins: Optimize loops (#15449) (overlookmotel)
• 3166233 linter/plugins: Remove Arcs (#15431) (overlookmotel)
• 9de1322 linter/plugins: Lazily deserialize settings JSON (#15395) (overlookmotel)
• 3049ec2 linter/plugins: Optimize deepFreezeSettings (#15392) (overlookmotel)
• 444ebfd linter/plugins: Use single object for parserServices (#15378) (overlookmotel)

📚 Documentation

• 97d2104 linter: Update comment in lint.rs about default value for tsconfig path (#15530) (Connor Shea)
• 2c6bd9e linter: Always refer as "ES2015" instead of "ES6" (#15411) (sapphi-red)
• a0c5203 linter/import/named: Update "ES7" comment in examples (#15410) (sapphi-red)
• 3dc24b5 linter,minifier: Always refer as "ES Modules" instead of "ES6 Modules" (#15409) (sapphi-red)
• 2ad77fb linter/no-this-before-super: Correct "Why is this bad?" section (#15408) (sapphi-red)
• 57f0ce1 linter: Add backquotes where appropriate (#15407) (sapphi-red)

Oxfmt v0.12.0

... (truncated)

Changelog

Sourced from oxlint's changelog.

[1.72.0] - 2026-06-29

🚀 Features

• 1c8f50c linter: Add schema for eslint/no-restricted-import (#23642) (Sysix)

🐛 Bug Fixes

• 742be36 refactor/node/handle-callback-err: Reject invalid regex config (#23740) (camc314)

[1.71.0] - 2026-06-22

🚀 Features

• 0dc2405 linter: Add schema for eslint/no-restricted-properties (#23619) (Sysix)
• b638d0e linter: Add schema for node/callback-return (#23615) (Sysix)
• eb8bedc linter: Add schema for import/extensions (#23557) (WaterWhisperer)
• 46f3625 linter: Implement node/no-sync rule (#23589) (fujitani sora)
• b01739a linter: Add schema for unicorn/numeric-separators-style (#23554) (Mikhail Baev)
• 68afd2a linter/node: Implement no-mixed-requires rule (#23539) (fujitani sora)
• a421215 linter: Add schema for eslint/prefer-destructuring (#23410) (WaterWhisperer)
• 84438be linter/jsdoc: Added missing options to require-param-description (#23416) (kapobajza)
• 51910df linter/jsdoc: Add missing options to require-param-type rule (#23418) (kapobajza)
• e90925f linter/unicorn: Implement prefer-number-coercion rule (#23497) (Shekhu☺️)
• dd1c866 linter/vue: Implement no-async-in-computed-properties rule (#23493) (bab)
• b02444e linter: Add schema for react/jsx-no-script-url (#23475) (WaterWhisperer)
• a8dce46 linter/unicorn: Implement max-nested-calls rule (#23461) (arieleli01212)

🐛 Bug Fixes

• a303c23 linter/jsx-a11y: Align anchor-is-valid config with upstream (#23446) (camc314)

📚 Documentation

• b50bf4d linter: Remove manually written options doc for eslint/arrow-body-style (#23490) (Mikhail Baev)

[1.70.0] - 2026-06-15

🚀 Features

• 2e8bda4 linter/vue: Implement no-dupe-keys rule (#23350) (bab)
• 1490a0a linter/react: Implement react-compiler rule (#23202) (Boshen)
• dd560ae linter/unicorn: Implement no-array-fill-with-reference-type rule (#23397) (Mikhail Baev)
• af36c2f linter: Add schema for react/jsx-curly-brace-presence (#23400) (WaterWhisperer)
• 47d34a3 linter: Add schema for react/jsx-handler-names (#23393) (WaterWhisperer)
• f4250d0 linter: Add schema for unicorn/import-style (#23386) (WaterWhisperer)
• 30c74ce linter: Add schema for jsx_a11y/no-noninteractive-element-to-interactive-role (#23384) (Sysix)
• cfbe8dc linter: Add schema for jsx_a11y/no-interactive-element-to-noninteractive-role (#23382) (WaterWhisperer)
• d15b7ff linter: Add schema for typescript/no-restricted-types (#23381) (WaterWhisperer)
• 028a811 linter: Add schema for jsx-a11y/media-has-caption (#23377) (Sysix)

... (truncated)

Commits

• 5306f24 release(apps): oxlint v1.72.0 && oxfmt v0.57.0 (#23935)
• 742be36 fix(refactor/node/handle-callback-err): reject invalid regex config (#23740)
• 1c8f50c feat(linter): add schema for eslint/no-restricted-import (#23642)
• c4be770 release(apps): oxlint v1.71.0 && oxfmt v0.56.0 (#23707)
• 0dc2405 feat(linter): add schema for eslint/no-restricted-properties (#23619)
• b638d0e feat(linter): add schema for node/callback-return (#23615)
• 6d355ab refactor(linter): remove number_as_object_schema helper (#23614)
• eb8bedc feat(linter): add schema for import/extensions (#23557)
• 46f3625 feat(linter): implement node/no-sync rule (#23589)
• 953c7b3 refactor(linter): make unicorn/numeric-separators-style options u32 (#23558)
• Additional commits viewable in compare view

Updates oxlint-tsgolint from 0.23.0 to 0.24.0

Release notes

Sourced from oxlint-tsgolint's releases.

v0.24.0

What's Changed

• ci: run windows e2e pnpm commands outside workspace by @​camc314 in oxc-project/tsgolint#969
• test(no-deprecated): add test for only allow by @​camc314 in oxc-project/tsgolint#970
• fix(no-deprecated): report contextual object literal properties by @​camc314 in oxc-project/tsgolint#944
• Update README with PRs note on new rules by @​camchenry in oxc-project/tsgolint#972
• fix(strict-boolean-expressions): guard invalid predicate indexes by @​camchenry in oxc-project/tsgolint#971
• fix(no-deprecated): fix crash when getting prop name for non-literal by @​camchenry in oxc-project/tsgolint#973
• test(no-deprecated): add non-literal computed key regression by @​camc314 in oxc-project/tsgolint#974
• test(no-floating-promises): sync tests with typescript-eslint by @​camc314 in oxc-project/tsgolint#975
• fix(no-floating-promises): handle spread arguments before rejection handlers by @​camc314 in oxc-project/tsgolint#976
• chore(deps): update crate-ci/typos action to v1.46.2 by @​renovate[bot] in oxc-project/tsgolint#979
• refactor: remove unneeded nil checks in strict-boolean-expressions by @​camchenry in oxc-project/tsgolint#980
• perf(no-unsafe-assignment): add fast-path for sender type by @​camchenry in oxc-project/tsgolint#981
• feat: add per-rule debug timings by @​camchenry in oxc-project/tsgolint#960
• chore: update typescript-go submodule by @​camc314 in oxc-project/tsgolint#982
• chore(deps): update dprint plugins by @​renovate[bot] in oxc-project/tsgolint#984
• chore(deps): update github actions by @​renovate[bot] in oxc-project/tsgolint#985
• chore(deps): update gomod by @​renovate[bot] in oxc-project/tsgolint#986
• chore(deps): update crate-ci/typos action to v1.46.3 by @​renovate[bot] in oxc-project/tsgolint#988
• test(no-deprecated): cover call and jsx deprecated properties by @​camc314 in oxc-project/tsgolint#989
• chore: update typescript-go submodule by @​camc314 in oxc-project/tsgolint#991
• chore(deps): update github actions by @​renovate[bot] in oxc-project/tsgolint#993
• chore(deps): update crate-ci/typos action to v1.47.0 by @​renovate[bot] in oxc-project/tsgolint#995
• chore(deps): update module github.com/dlclark/regexp2/v2 to v2.1.1 by @​renovate[bot] in oxc-project/tsgolint#994
• fix(prefer-optional-chain): suggest unsafe nullish rewrite by @​camc314 in oxc-project/tsgolint#996
• chore(deps): update pnpm to v11.4.0 by @​renovate[bot] in oxc-project/tsgolint#997
• refactor: cache suppress program diagnostics env by @​camc314 in oxc-project/tsgolint#999
• refactor: use sync.OnceValue for logLevel by @​camc314 in oxc-project/tsgolint#1000
• test(no-unnecessary-type-assertion): sync tests with typescript-eslint by @​camc314 in oxc-project/tsgolint#998
• fix(no-unnecessary-type-assertion): enable skipped upstream cases by @​camc314 in oxc-project/tsgolint#1001
• fix(justfile): use --ignore-workspace for e2e pnpm commands by @​swandir in oxc-project/tsgolint#983
• test(no-unnecessary-type-arguments): sync tests with typescript-eslint by @​camc314 in oxc-project/tsgolint#1003
• test(no-unnecessary-type-assertion): cover nullable literal assertion by @​camc314 in oxc-project/tsgolint#1002
• fix(no-unnecessary-type-arguments): preserve constructor inference by @​camc314 in oxc-project/tsgolint#1004
• refactor: remove OXLINT_TSGOLINT_TIMINGS env var by @​camc314 in oxc-project/tsgolint#1005
• chore: update typescript-go submodule by @​camc314 in oxc-project/tsgolint#1007
• fix(prefer-optional-chain): optional chain type assertion handling by @​camc314 in oxc-project/tsgolint#1009
• chore(deps): update typos to v1.47.1 by @​renovate[bot] in oxc-project/tsgolint#1010
• chore(deps): update typos to v1.47.2 by @​renovate[bot] in oxc-project/tsgolint#1012
• chore(deps): update github actions by @​renovate[bot] in oxc-project/tsgolint#1013
• chore(deps): update gomod by @​renovate[bot] in oxc-project/tsgolint#1014
• chore(deps): update github actions to v2.81.5 by @​renovate[bot] in oxc-project/tsgolint#1015
• chore: update typescript-go submodule by @​camc314 in oxc-project/tsgolint#1016
• chore(deps): update github actions by @​renovate[bot] in oxc-project/tsgolint#1017
• chore(deps): update gomod to v0.46.0 by @​renovate[bot] in oxc-project/tsgolint#1018
• chore(deps): update gomod to v2.2.2 by @​renovate[bot] in oxc-project/tsgolint#1021
• chore(deps): update github actions to v2.82.0 by @​renovate[bot] in oxc-project/tsgolint#1023
• chore(deps): update dprint plugins to v0.22.0 by @​renovate[bot] in oxc-project/tsgolint#1022
• chore(deps): update github actions to v7 by @​renovate[bot] in oxc-project/tsgolint#1024

... (truncated)

Commits

• 5a37e89 fix(dot-notation): determine the relevant accessor (#1028)
• 67a281f perf(consistent-return): defer per-function type resolution (#1031)
• a5e2ff0 perf(no-unnecessary-qualifier): skip symbol resolution outside namespaces. (#...
• a8fc668 perf(no-confusing-void-expression): check ancestor position before type query...
• 03158cc perf(no-unnecessary-type-conversion): hoist constant builtin-name slices (#1040)
• d9e645c perf(prefer-optional-chain): lazily allocate chain-processor caches (#1041)
• 63f578a refactor(no-unnecessary-condition): remove dead containsUnguardedElementAcces...
• f174876 chore(deps): update gomod (#1035)
• 47de9cf chore(deps): update github actions (#1036)
• e209b5b chore(deps): update actions/cache action to v6 (#1037)
• Additional commits viewable in compare view

Updates vite from 8.0.16 to 8.1.2

Release notes

Sourced from vite's releases.

v8.1.2

Please refer to CHANGELOG.md for details.

v8.1.1

Please refer to CHANGELOG.md for details.

create-vite@8.1.0

Please refer to CHANGELOG.md for details.

plugin-legacy@8.1.0

Please refer to CHANGELOG.md for details.

v8.1.0

Please refer to...

Description has been truncated

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[codescene-delta-analysis]

No application code in the PR — skipped Code Health checks.

See analysis details in CodeScene

Quality Gate Profile: Custom Configuration
Install CodeScene MCP: safeguard and uplift AI-generated code. Catch issues early with our IDE extension and CLI tool.

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.