[dependabot]

Bumps the development group with 3 updates in the / directory: oxfmt, oxlint and tsdown.

Updates oxfmt from 0.75.0 to 0.76.0

Release notes

Sourced from oxfmt's releases.

oxfmt v0.76.0

💥 BREAKING CHANGES

• 296623d oxfmt: [BREAKING] Format parser:html files by oxc_formatter_htmlish (#28273) (Yuji Sugiura)

🚀 Features

• 336b2c1 oxfmt: Support html-in-js templates closing a dynamic tag name (#28389) (Yuji Sugiura)
• 0a42af6 formatter_htmlish: Format end tags of omitted html, head and body (#28388) (Yuji Sugiura)
• 44d8c2b formatter_htmlish: Implement HTML-ish formatter Html variant (#28272) (Yuji Sugiura)
• 36e5ddb oxfmt: Add debug span for reading files (#28204) (leaysgur)

🐛 Bug Fixes

• dbcc358 formatter: Keep arrow conditional body parens before a leading function/class (#28710) (Yuji Sugiura)
• fef809a formatter_htmlish: Handle XHTML (#28703) (leaysgur)
• f3dd201 formatter_htmlish: Keep SVG text under xml:space="preserve" as written (#28382) (Yuji Sugiura)
• fb3aefa formatter: Keep source parens around html-in-js placeholders past comments (#28381) (Yuji Sugiura)
• e738dae formatter: Quote keys added in an HTML event handler with single quotes (#28380) (Yuji Sugiura)
• 2e7a629 oxfmt: Format HTML in a <script> body as an embedded part (#28379) (Yuji Sugiura)
• f00862b formatter: Keep parens around a generic function type in a type assertion (#28173) (vidigoat)
• 9ead5c4 formatter: Handle this.b and super.b like foo.b (#28200) (leaysgur)
• 72a54cf formatter: Break parens of (a + b)[c] like (a + b).c (#28199) (leaysgur)
• b8f4f34 formatter: Print x.b and x.#b samely (#28193) (leaysgur)
• 9ddccb7 formatter: Keep parens for private field (#28188) (leaysgur)

⚡ Performance

• b6f1ac9 formatter_markdown: Bump parser to 0.0.4 and skip unread work (#28713) (leaysgur)
• 633ee96 formatter_css: Use u32 spans (#28708) (leaysgur)
• f680ee1 formatter_yaml: Use multiline flag for flow scalars (#28707) (leaysgur)
• ff7c203 formatter_css: Avoid repeated scans and allocations in values (#28706) (leaysgur)
• 7cd46cb formatter_htmlish: Search script end tags by < in embedded (#28704) (leaysgur)
• 46f8efd formatter_graphql: Print block string lines borrowed from the source (#28701) (leaysgur)
• dce1485 formatter_htmlish: Skip escaping attr values without the chosen quote (#28700) (leaysgur)
• e9392c8 formatter_core: Search line terminators with memchr (#28699) (leaysgur)
• ceb26be formatter_htmlish: Use char to escape attr quotes (#28697) (leaysgur)
• 8239dac parser: Replace dragonbox_ecma with zmij_ecma (#28282) (Boshen)

📚 Documentation

• 303d9e8 formatter: Strengthen start-token-no-double-parens rationale (#28711) (Yuji Sugiura)
• a82ce83 oxfmt: Update unclassified divergence (#28685) (Yuji Sugiura)
• 7f18c20 formatter_htmlish: Note class and srcset are formatted with embeddedLanguageFormatting: off (#28465) (Yuji Sugiura)
• 01ed68a oxfmt,formatter_htmlish,formatter: Clean up behavior comments (#28384) (Yuji Sugiura)
• a363c27 formatter_css,formatter_yaml: Point parser citations at AGENTS.md (#28466) (Yuji Sugiura)
• 6586050 formatter_core: Document tab width in text width policy (#28393) (leaysgur)
• 49fbffb formatter_core: Tighten FORMATTER_POLICY (#28206) (leaysgur)

Commits

• f3fcdcc release(apps): oxlint v1.91.0 && oxfmt v0.76.0 (#28718)
• See full diff in compare view

Updates oxlint from 1.90.0 to 1.91.0

Release notes

Sourced from oxlint's releases.

oxlint v1.91.0

🚀 Features

• 004647a track_memory_allocs: Add allocation tracking for linter rules (#28470) (Cam McHenry)
• 419c1b0 linter: Add allow and allowPattern options to react/capitalized-calls (Christian Vuerings)

🐛 Bug Fixes

• a205cd3 linter/eslint/no-control-regex: Detect raw control characters (#28548) (camc314)
• 7c65777 linter/unicorn/prefer-global-this: Align typeof and worker API handling (#28549) (camc314)
• 987d5f1 linter/unicorn/no-invalid-fetch-options: Avoid treating unknown methods as GET (#28547) (camc314)
• e234dc8 linter/unicorn/no-useless-error-capture-stack-trace: Move to suspicious category (#28545) (camc314)
• b3dc411 linter/typescript/no-non-null-asserted-nullish-coalescing: Move to suspicious category (#28546) (camc314)
• cb64638 regular_expression: Reject incomplete Unicode atom escapes (#28448) (Boshen)
• c67167e linter: Only run React Compiler rules on files with top-level components or hooks (Boshen)
• 4c9d5aa linter: Treat Reanimated shared values as ref-like in React Compiler rules (Boshen)
• 61fe2af linter/react: Ignore impure calls in async components in react/purity (Rahul Kashyap)
• ed7df7d ast/estree: Include comments in TS Program span (#28326) (camc314)
• 31cbe37 linter: Make gitlab fingerprints unique per diagnostic (#28307) (camc314)

⚡ Performance

• 564559d linter/prefer-const: Avoid collecting resolved references (#28732) (Dunqing)
• bb947dc linter: Skip numeric separator formatting for short integers (#28485) (Cam McHenry)
• 1043dfa linter: Avoid collecting prefer-const binding identifiers (#28484) (Cam McHenry)
• 7c93eef linter: Reduce branches-sharing-code scratch allocations (#28483) (Cam McHenry)
• c0065fd linter: Allocate escape-case replacements only when needed (#28482) (Cam McHenry)
• d837414 linter: Lazily normalize capitalized-comments text (#28481) (Cam McHenry)
• 6baaad6 linter: Avoid no-var binding identifier allocations (#28480) (Cam McHenry)
• 882053b linter: Skip read-only parameters in no-param-reassign (#28479) (Cam McHenry)
• 92deebf linter: Reduce no-unmodified-loop-condition allocations (#28478) (Cam McHenry)
• f01d52d linter: Reduce no-duplicate-case allocations (#28477) (Cam McHenry)
• 6a72d84 linter: Reduce no-dupe-class-members allocations (#28476) (Cam McHenry)
• 77599ef linter: Reduce no-this-before-super allocations (#28475) (Cam McHenry)
• 2ea9f58 linter/no-dupe-else-if: Use smallvec to reduce allocs (#28474) (Cam McHenry)
• 69f0204 linter/react/rules-of-hooks: Reduce allocs (#28473) (Cam McHenry)
• b138c20 linter: Reduce allocs in no-dupe-keys (#28472) (Cam McHenry)
• 6f3e982 linter: Avoid operator allocations in no-useless-length-check (#28471) (Cam McHenry)
• fd68928 react-compiler: Skip passes lint does not need (Yagiz Nizipli)
• 224f4dd linter/eslint/sort-keys: Reserve initial capacity for string (#27624) (Cam McHenry)
• e4e01a3 linter/import/no-cycle: Compare visited modules by absolute resolved path (#27517) (Cam McHenry)
• 741b29b linter/import/no-cycle: Cache sorted module record snapshots (#27516) (Cam McHenry)
• 20022bb linter/import/no-cycle: Reuse traversal buffers between imports (#27481) (Cam McHenry)
• fd5edb7 linter/import/no-cycle: Reuse module records in diagnostic stack (#27480) (Cam McHenry)
• 73e877c linter/import/no-cycle: Don't allocate paths already seen (#27478) (Cam McHenry)
• 1515d53 linter/react/forward-ref-uses-ref: Narrow forward-ref-uses-ref dispatch (#28367) (Cam McHenry)
• ee51c01 linter/react/no-string-refs: Narrow AST dispatch (#28366) (Cam McHenry)
• bbfd692 linter/react/no-children-pop: Narrow AST dispatch (#28365) (Cam McHenry)
• a86158b linter/unicorn/prefer-set-size: Narrow AST dispatch (#28364) (Cam McHenry)
• a777fa6 linter/eslint/no-iterator: Narrow member dispatch (#28363) (Cam McHenry)

... (truncated)

Changelog

Sourced from oxlint's changelog.

[1.91.0] - 2026-11-02

🚀 Features

• 419c1b0 linter: Add allow and allowPattern options to react/capitalized-calls (Christian Vuerings)

Commits

• f3fcdcc release(apps): oxlint v1.91.0 && oxfmt v0.76.0 (#28718)
• 419c1b0 feat(linter): add allow and allowPattern options to react/capitalized-calls
• See full diff in compare view

Updates tsdown from 0.23.4 to 0.23.5

Release notes

Sourced from tsdown's releases.

v0.23.5

Notes

rolldown-plugin-dts is now v0.29. tsdown passes dts options through to it unchanged, so its deprecations show up in your config too. Full details are in the rolldown-plugin-dts v0.29.0 release notes.

Migration

tsc-only dts options move under dts.tsc. The top-level build, incremental, parallel, eager, newContext and vue options still work but log a deprecation warning. Setting the same option at both levels throws an error. emitJs stays at the top level.

 export default defineConfig({
   dts: {
-    vue: true,
+    tsc: { vue: true },
   },
 })

tsgo (experimental, not covered by semver):

• @typescript/native-preview is no longer supported. Install TypeScript 7.1+ (typescript@7.1.0-beta), or point tsgo.moduleUrl at another build.
• On TypeScript 7.1+, tsgo.path is the API server executable, not the tsgo CLI. You usually don't need to set it.
• Declaration maps come only from compilerOptions.declarationMap: true in tsconfig; the sourcemap option no longer enables them.
• TypeScript 7.0 still works with a deprecation warning, but that backend will be removed soon.

---

   🚀 Features

• css: Support css: false to disable built-in CSS handling  -  by @​sxzzbot in rolldown/tsdown#1113 (181af)
• dts: Upgrade rolldown-plugin-dts to v0.29, upgrade deps  -  by @​sxzzbot in rolldown/tsdown#1121 (e12ab)

   🐞 Bug Fixes

• css: Remove dangling requires and handle CSS extensions in chunk names  -  by @​sxzzbot in rolldown/tsdown#1114 (c8ca3)

   🏎 Performance

• deps: Read each package.json once when resolving dep subpaths  -  by @​Cherry and @​sxzzbot in rolldown/tsdown#1093 (4435a)

    View changes on GitHub

Commits

• 7a50502 chore: release v0.23.5
• e12ab7f feat(dts): upgrade rolldown-plugin-dts to v0.29, upgrade deps (#1121)
• 4435a48 perf(deps): read each package.json once when resolving dep subpaths (#1093)
• daf9083 docs(vue): link to CSS support from the Vue recipe (#1117)
• c8ca303 fix(css): remove dangling requires and handle CSS extensions in chunk names (...
• 99b3b03 test(migrate): fold duplicate tsup default-value tests (#1116)
• 181af08 feat(css): support css: false to disable built-in CSS handling (#1113)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	oxfmt@​0.75.0 ⏵ 0.76.0	+8			-1
	tsdown@​0.23.4 ⏵ 0.23.5	+1		+1	+1
	oxlint@​1.90.0 ⏵ 1.91.0	+1			+2

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Priority	Alert  (click "▶" to expand/collapse)	Action
	Low adoption: npm @yuku-toolchain/darwin-x64 Location: Package overview From: pnpm-lock.yaml → npm/tsdown@0.23.5 → npm/@yuku-toolchain/darwin-x64@0.25.0 ℹ Read more on: This package | This alert | What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@yuku-toolchain/darwin-x64@0.25.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Low adoption: npm @yuku-toolchain/linux-arm64 Location: Package overview From: pnpm-lock.yaml → npm/tsdown@0.23.5 → npm/@yuku-toolchain/linux-arm64@0.25.0 ℹ Read more on: This package | This alert | What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@yuku-toolchain/linux-arm64@0.25.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Low adoption: npm @yuku-toolchain/linux-x64 Location: Package overview From: pnpm-lock.yaml → npm/tsdown@0.23.5 → npm/@yuku-toolchain/linux-x64@0.25.0 ℹ Read more on: This package | This alert | What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@yuku-toolchain/linux-x64@0.25.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Low adoption: npm @yuku-toolchain/win32-arm64 Location: Package overview From: pnpm-lock.yaml → npm/tsdown@0.23.5 → npm/@yuku-toolchain/win32-arm64@0.25.0 ℹ Read more on: This package | This alert | What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@yuku-toolchain/win32-arm64@0.25.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Low adoption: npm @yuku-toolchain/win32-x64 Location: Package overview From: pnpm-lock.yaml → npm/tsdown@0.23.5 → npm/@yuku-toolchain/win32-x64@0.25.0 ℹ Read more on: This package | This alert | What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@yuku-toolchain/win32-x64@0.25.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn

View full report

[clawsweeper]

Codex review: needs maintainer review before merge.

What this changes

This PR updates oxfmt to 0.76.0, oxlint to 1.91.0, and tsdown to 0.23.5 with their transitive dependencies.

Example: A contributor installs dependencies using the frozen lockfile.

• Before: The workspace resolves oxfmt 0.75.0, oxlint 1.90.0, and tsdown 0.23.4.
• After: The workspace resolves oxfmt 0.76.0, oxlint 1.91.0, and tsdown 0.23.5.

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	Focused, consistent maintenance with passing checks and limited direct behavior evidence.
Proof confidence	🦐 gold shrimp (3/6)	This Dependabot maintenance PR is outside the ordinary contributor proof gate; passing build and test checks support compatibility without constituting direct formatter behavior proof.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Product

Kind: Maintenance · Worth it: Yes · Fix scope: Complete
User problem: Contributors use older formatter, linter, and bundler releases.
Reason: The update follows established dependency maintenance and adds no configuration, public API, or runtime behavior convention.

Merge readiness

✅ Ready for maintainer review

Keep this PR open: the dependency updates are absent from main, the reviewed head passes its build and test checks, and no actionable defect was identified.

Priority: P3
Reviewed head: 8213987d594fdafc418004256e920818231ac848

Before merge

None.

Findings

None.

Tests

• Missing end-to-end proof: No supplied direct run exercises oxfmt 0.76.0 against the repository; CI's Format job uses bun fmt.

Agent review details

How this fits together

These development dependencies format and lint repository files and compile TypeScript into the distributed CLI and declaration files.

flowchart LR
  A[Manifest and lockfile] --> B[Frozen dependency install]
  B --> C[Formatter and linter]
  B --> D[tsdown and declaration generator]
  C --> E[Repository checks]
  D --> F[CLI and declaration files]

Loading

Technical review

Best possible solution:

Retain this focused dependency update for normal landing through the existing checks.

Do we have a high-confidence way to reproduce the issue?

This is dependency maintenance rather than a reported product bug; the pinned diff directly establishes the version changes.

Is this the best way to solve the issue?

Updating the existing dependency requirement and lockfile is the smallest complete change for this maintenance task.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 34b167d50c90.

Provenance checked

• Formatter and linter dependency versions keeps the original intent (build(deps-dev): bump the development group across 1 directory with 4 updates #924: Advance the existing development tools through a grouped dependency update.)
• Bundler and declaration-generation dependencies keeps the original intent (f2aff94: Refresh tooling and consolidate dependency updates while preserving the existing runtime and protocol boundaries.)

Testing

Proof path: in-process harness.

Security

None.

Evidence

What I checked:

• Exact introduced change: The pinned diff changes only the formatter requirement and development dependency lockfile records; runtime dependencies, scripts, publishing metadata, and permissions are unchanged. (package.json:107, 8213987d594f)
• Updates remain absent from main: The default-branch manifest retains oxfmt ^0.75.0, and its lockfile resolves oxlint 1.90.0 and tsdown 0.23.4. (package.json:107, 34b167d50c90)
• Validation on the reviewed head: Build, Lint, Typecheck, Mutation, conformance smoke, and tests on Node 22, 24, and 26 pass for the exact reviewed head. Format passes using bun fmt, so it does not directly validate the updated oxfmt. (.github/workflows/ci.yml, 8213987d594f)
• Dependency changes and security discussion: The declaration generator now uses rolldown-plugin-dts 0.29.0 and yuku 0.25.0. Socket's discussion alerts concern low adoption of platform packages, rather than a reported vulnerability; npm metadata identifies the expected upstream repositories and shows no install lifecycle scripts in the inspected packages. (pnpm-lock.yaml:5007, 8213987d594f)
• Applicable declaration-generator contract: The target build executes tsdown with --dts and the lockfile selects this generator. Its v0.29.0 notes describe tsgo and configuration migrations; acpx supplies TypeScript 6.0.2 and uses plain --dts without the affected options.
• Prior maintenance intent: The merged maintenance change at build(deps): refresh runtime tooling and patch URI advisories #910 established compatible tooling refreshes while preserving the runtime floor and release-age policy; this PR preserves those boundaries. (package.json:108, 26849fd33785)

Likely related people:

• Peter Steinberger: Raw commit 26849fd adds package.json:108 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: 26849fd33785; files: package.json)
• Vincent Koc: Raw commit 67bf0e9 adds package.json:42 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: medium; commits: 67bf0e9c7111; files: package.json)
• Mason Huang: Raw commit f2aff94 adds package.json:113 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: medium; commits: f2aff942ffd4; files: package.json)

Preflight source

Source unknown. Source comparison at the observed PR snapshot only. Completion is self-reported; body, policy, tests, execution, and report bytes are not verified.

Labels

Label changes:

• add P3: Routine development-tool maintenance with no demonstrated urgent runtime impact.
• add rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Label justifications:

• P3: Routine development-tool maintenance with no demonstrated urgent runtime impact.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed November 6, 2026, 8:38 AM ET / 13:38 UTC.