chore(deps): bump the development-dependencies group with 9 updates

[dependabot]

Bumps the development-dependencies group with 9 updates:

Package	From	To
@changesets/cli	2.31.0	2.31.1
eslint-plugin-github	6.1.0	6.1.1
eslint-plugin-sonarjs	4.1.0	4.2.0
knip	6.25.0	6.27.0
oxfmt	0.58.0	0.59.0
oxlint	1.73.0	1.74.0
tsdown	0.22.4	0.22.12
typescript	7.1.0-dev.20260708.3	7.1.0-dev.20260720.1
ultracite	7.9.3	7.9.4

Updates @changesets/cli from 2.31.0 to 2.31.1

Release notes

Sourced from @​changesets/cli's releases.

@​changesets/cli@​2.31.1

Patch Changes

• #2159 15cf592 Thanks @​ingvaldlorentzen! - Fixed already-published version detection with npm 12, which always wraps successful npm info --json output in an array. The unwrapped output made changeset publish treat every package as unpublished and fail attempting to republish existing versions.

Commits

• a897bb8 Use a different publish tag for maintenance/v2 branch (#2162)
• e8650b9 Version Packages (#2161)
• 15cf592 Fixed handling of the npm 12 info output (#2159)
• 9f2cb2a Configure Changesets for maintenance/v2 line (#2076)
• 97247cb Change allowed publish pattern to maintenance/v* given rulesets behavior (#...
• 13286a8 Build(deps): Bump the github-actions group across 1 directory with 3 updates ...
• 8f6acd6 Update dependabot group to exclude major (#2067)
• c70c675 Setup backport workflow and sync next setup (#2057)
• 9672019 Remove SECURITY.md to defer to .github (#2055)
• 18e1661 Use internal bot for versioning (#2039)
• Additional commits viewable in compare view

Updates eslint-plugin-github from 6.1.0 to 6.1.1

Release notes

Sourced from eslint-plugin-github's releases.

v6.1.1

Fixed

• jsx-a11y recommended rules are now correctly applied in the flat React config. Previously, lib/configs/flat/react.js spread jsx-a11y's recommended config but then redefined its own rules object, which shallow-overwrote and silently dropped most of the recommended rule set — leaving only a handful of rules active. The recommended rules are now explicitly merged, so the full jsx-a11y/recommended baseline is enforced while GitHub-specific overrides are preserved.

Commits

• 7a5567b Merge pull request #715 from github/alaingoga/714-adding-jsxA11y-plugin-suppo...
• fa8eeb1 714 - Adding jsxA11y plugin support back
• See full diff in compare view

Updates eslint-plugin-sonarjs from 4.1.0 to 4.2.0

Changelog

Sourced from eslint-plugin-sonarjs's changelog.

Release Guide

SonarJS currently has two distinct release targets:

Target	Artifact	Main workflow	Notes
Standard SonarQube analyzer	Maven/JAR release artifacts	.github/workflows/automated-release.yml	This is the normal SonarJS release flow.
SQAA (previously A3S)	Docker image for LanguageAnalyzerService	.github/workflows/docker-sqaa.yml	Manual SQAA-only entry point and fallback.

Terminology

• SQAA is the current name for what older docs and repository names still call A3S.
• Some external identifiers still keep the legacy a3s name for compatibility. The important ones are:
  • the Docker repository path a3s/analysis/javascript
  • packages/grpc/src/proto/language_analyzer.proto with option java_package = "com.sonarsource.a3s.analyzer.grpc";
• Do not rename those compatibility-sensitive identifiers as part of a routine release.

Standard SonarQube Analyzer Release

This is the regular SonarJS analyzer release. It produces the standard SonarQube analyzer artifacts and can also automate the SQAA handoff using the same build number.

Entry points

1. Start .github/workflows/automated-release.yml.
2. That workflow orchestrates the release and then calls .github/workflows/release.yml for the actual artifact publication.
3. After the release succeeds, .github/workflows/bump-versions.yml opens the next development iteration PR.

What .github/workflows/automated-release.yml does

The SonarJS workflow is a thin wrapper around SonarSource/release-github-actions/.github/workflows/automated-release.yml@v1 with SonarJS-specific inputs:

• project name SonarJS
• plugin name javascript
• Jira project JS
• optional SQC and SQS integration PRs
• optional SQAA integration, enabled in the SonarJS wrapper and implemented by a custom local workflow
• SLVS, SLVSCODE, SLE, and SLI integration tickets enabled
• the generic release-github-actions SQAA integration explicitly disabled, because SonarJS uses analysis/js_ts_image_tag instead of gradle/sonar-plugins.versions.toml

The reusable workflow performs the following steps:

1. Freeze the target branch.
2. Run the releasability checks with SonarSource/gh-action_releasability@v3.
3. Resolve the release version with get-release-version.
4. Resolve the Jira version with get-jira-version.
5. Generate Jira-based release notes with get-jira-release-notes unless explicit notes were provided.
6. Create the REL Jira ticket with create-jira-release-ticket.
7. Publish the GitHub release with publish-github-release.
8. Unfreeze the branch.
9. Release the Jira version, create the next Jira version, and move the REL ticket to Technical Release Done.

... (truncated)

Commits

• See full diff in compare view

Updates knip from 6.25.0 to 6.27.0

Release notes

Sourced from knip's releases.

Release 6.27.0

• Add Temporal plugin (98191a04aad0572bead191b101bfecef75067b0c)
• Handle -d alias for react-email dir argument (53d1fec3213db8d6a84dfa7a82050b122782e065)
• Expand pnpm script references with forwarded arguments (33e9799df39450033061b9c4c07daf22f5d15721)
• Treat path-shaped script tokens as file references, extend known global binaries (d9508c282ab81351beda4b2f859435b49f142c51)
• Mark tsdown neverBundle dependencies as referenced (5fd863ba12e68842f91ab1a94e7e30d1e571da92)
• Support TanStack Start in tanstack-router plugin (bd63cd8af88dac03a98aa17f1add322f7bdf4a94)
• Mark vite ssr.external dependencies as referenced (91de938032062cb667bced0eadef9e67d1e20b1f)
• Expand bun, npm, and yarn script references with forwarded arguments (b5a31767a83e2cec3fb20c3b146d94c0412a4fd6)
• Add Latitude as sponsor (42676759cad5fb10ac96fd7c0457037e906f4b68)
• Regenerate plugin list in docs (1d2cdffb4d4151f848c44e066eff43e9efbf44fe)
• Support Vue 2 template auto-imports (close #1881) (2157f3913f77216d268b2255899b6fc58609f9bb)
• Ignore block-commented stylesheet imports (resolve #1880, close #1882) (a627f53221547d5397d70722fcc2fd723889e579)
• Support TypeScript 5.0 narrowing for ssr.external (989292f79b9d19028bfc7ba988b74ba691041a45)
• Resolve local binaries from bun run (5e9a7f0286e2c2175bb299c514cc7b67a7cf24f1)
• Support Vitest inline project config extensions (f682327f6181f44e3924715efa7404aa39e532f0)
• Resolve package names from aliased node_modules paths (c273d5fbc1b0d3eaf27b38c3f31d3a2a4b6b184a)
• Support Tailwind CSS URL imports (57a4770447cc4c8f9ea4ffb9171c0c92eed4f255)
• Resolve unbuilt workspace package exports (close #1877) (1b0a2c0ee784db165c7f92fe10397a6cb513c1cf)
• Skip unresolved imports of gitignored generated files (605c9049f73838beb1c6fee83c6a5421ae1a6d07)
• Attribute imports of aliased packages to the declared dependency (d05e775c9a3a5676dc9eadcc1093f7d9983efd06)
• Flag unresolvable imports of transitive peer deps as unlisted (resolve #1883) (18f0bff4ea683837f75ca744d3fbde52df49b297)
• Don't count ambient module declarations in script files as imports (e52aecfd7c022cbe72b1c11dde3f4968579ac409)
• Update rolldown snapshot (a63e92788239062682603a5727ede371db7845c8)
• Remove obsolete workarounds from ecosystem tests (a521cf790d726c18e644e2e316cdc09eb654f607)
• Handle snapshotSerializers in Vitest plugin (resolve #1884) (b597de951f6f0e897afdbbbb8a7d0c06c8d2437d)
• Set the stage (c059c2be5803609924b852c2bf0cd90906a6a831)

Release 6.26.0

• ci: add path filters (#1871) (4249935adffe1b8eca9570fb325fa19cc8010584) - thanks @​trueberryless!
• Add CodeRabbit as gold sponsor (1da09fdc8f4d851f3cad30659200018bfb47a5e0)
• Fix up docs a bit more (39125a7f473e006f61629781bff1ac4a050ca460)
• Don't report ambient declaration files as unused (aed361c00a82829c2fc80a65a2f7af174316782e)
• Register oclif command files as entries (3b4d58c9da83d93b6821a2b24f57b919ba886756)
• Add electron-vite plugin (d92107ea504833b3ee7ad2b695e22d40528b24c3)
• Add esbuild plugin (ef3b601d957546554de2cb1fbff859f5bdafb741)
• Ignore more globally available binaries (829298129fdfd1b41a1f8dff5022b9fbbe25f454)
• Resolve #-imports to source when node condition is unbuilt (resolve #1873) (f2713ed1e499ab286b86615d4b8ec34f711d1bd2)
• Ignore gh as a globally available binary (a6f0772e5db03a8412a3ac036756779f22d1a27d)
• Resolve Vitest benchmark files as entries (57429139f7e93f2a4bee35a53d450c4f45dea9ff)
• Extract shared Vue auto-import machinery into plugins/_vue (73010753d432ae58eb12c7eec9c5723036009749)
• Scope compiler extensions per workspace (5e6f82b963a83e5801484efbc01a4b6a9ce39ea3)
• Resolve auto-imported components in the Vue SFC compiler (009aad8f9dab589898e5dba4c85fa41ea57c1a49)
• Add plugins for the Vue auto-import ecosystem (f638c8302cdd26a63e477344a7cf44ef60af7788)
• Enable Vue SFC compiler on unplugin-vue and @​vitejs/plugin-vue (9396ab159919147ef81dad16e365e531b32b4b12)
• Recognize vite-plugin-vue-meta-layouts (same layouts convention) (3ceee89228b0173eddc0466bf50e8181286ffebc)
• Add vite-plugin-pages and unplugin-icons plugins (9bc17540bcf8eb142474ed84837c1e2cebb7fe73)
• Add vite-plugin-pwa and @​intlify/unplugin-vue-i18n plugins (45dea0a397ed754c34617ed18deef4dc6f0ec0d4)
• Dog, food. (e1249ade2558d3801d85e2dc63349d884f3443d4)
• Update query snapshot (a45941d2db381c04f8a38416533217ee84f77ca7)

... (truncated)

Commits

• e463b61 Release knip@6.27.0
• b597de9 Handle snapshotSerializers in Vitest plugin (resolve #1884)
• e52aecf Don't count ambient module declarations in script files as imports
• 18f0bff Flag unresolvable imports of transitive peer deps as unlisted (resolve #1883)
• d05e775 Attribute imports of aliased packages to the declared dependency
• 605c904 Skip unresolved imports of gitignored generated files
• 1b0a2c0 Resolve unbuilt workspace package exports (close #1877)
• 57a4770 Support Tailwind CSS URL imports
• c273d5f Resolve package names from aliased node_modules paths
• f682327 Support Vitest inline project config extensions
• Additional commits viewable in compare view

Updates oxfmt from 0.58.0 to 0.59.0

Changelog

Sourced from oxfmt's changelog.

[0.59.0] - 2026-07-13

🐛 Bug Fixes

• 415fe1e oxfmt: Error on ignorePatterns that cannot match files outside the config directory (#24286) (leaysgur)

[0.55.0] - 2026-06-15

🚀 Features

• 9a2788b linter/unicorn: Implement prefer-export-from rule (#22935) (AliceLanniste)

[0.54.0] - 2026-06-08

📚 Documentation

• dadafe3 oxlint, oxfmt: Mention migrate skills in npm READMEs (#22965) (Boshen)
• f88961a oxfmt: Annotate each config option with supported languages (#22953) (leaysgur)

[0.52.0] - 2026-05-26

🚀 Features

• 16b8058 oxfmt: Support vite-plus/resolveConfig for vite.config.ts (#22454) (leaysgur)

[0.50.0] - 2026-05-15

🐛 Bug Fixes

• 43b9978 formatter/sort_imports: Treat subpath imports as internal (#22440) (leaysgur)

[0.49.0] - 2026-05-11

🚀 Features

• 6e8e818 oxfmt: Experimental .svelte support (#21700) (leaysgur)

[0.45.0] - 2026-04-13

🐛 Bug Fixes

• 50c389b oxfmt: Support .editorconfig quote_type (#20989) (leaysgur)

[0.44.0] - 2026-04-06

🐛 Bug Fixes

• dd2df87 npm: Export package.json for oxlint and oxfmt (#20784) (kazuya kawaguchi)
• 4216380 oxfmt: Support .editorconfig tab_width fallback (#20988) (leaysgur)

... (truncated)

Commits

• 2d4e8d2 release(apps): oxlint v1.74.0 && oxfmt v0.59.0 (#24454)
• 415fe1e fix(oxfmt): error on ignorePatterns that cannot match files outside the confi...
• See full diff in compare view

Updates oxlint from 1.73.0 to 1.74.0

Release notes

Sourced from oxlint's releases.

oxlint v1.27.0 && oxfmt v0.12.0

Oxlint v1.27.0

🚀 Features

• 222a8f0 linter/plugins: Implement SourceCode#isSpaceBetween (#15498) (overlookmotel)
• 2f9735d linter/plugins: Implement context.languageOptions (#15486) (overlookmotel)
• bc731ff linter/plugins: Stub out all Context APIs (#15479) (overlookmotel)
• 5822cb4 linter/plugins: Add extend method to FILE_CONTEXT (#15477) (overlookmotel)
• 7b1e6f3 apps: Add pure rust binaries and release to github (#15469) (Boshen)
• 2a89b43 linter: Introduce debug assertions after fixes to assert validity (#15389) (camc314)
• ad3c45a editor: Add oxc.path.node option (#15040) (Sysix)

🐛 Bug Fixes

• 6f3cd77 linter/no-var: Incorrect warning for blocks (#15504) (Hamir Mahal)
• 6957fb9 linter/plugins: Do not allow access to Context#id in createOnce (#15489) (overlookmotel)
• 7409630 linter/plugins: Allow access to cwd in createOnce in ESLint interop mode (#15488) (overlookmotel)
• 732205e parser: Reject using / await using in a switch case / default clause (#15225) (sapphi-red)
• a17ca32 linter/plugins: Replace Context class (#15448) (overlookmotel)
• ecf2f7b language_server: Fail gracefully when tsgolint executable not found (#15436) (camc314)
• 3c8d3a7 lang-server: Improve logging in failure case for tsgolint (#15299) (camc314)
• ef71410 linter: Use jsx if source type is JS in fix debug assertion (#15434) (camc314)
• e32bbf6 linter/no-var: Handle TypeScript declare keyword in fixer (#15426) (camc314)
• 6565dbe linter/switch-case-braces: Skip comments when searching for : token (#15425) (camc314)
• 85bd19a linter/prefer-class-fields: Insert value after type annotation in fixer (#15423) (camc314)
• fde753e linter/plugins: Block access to context.settings in createOnce (#15394) (overlookmotel)
• ddd9f9f linter/forward-ref-uses-ref: Dont suggest removing wrapper in invalid positions (#15388) (camc314)
• dac2a9c linter/no-template-curly-in-string: Remove fixer (#15387) (camc314)
• 989b8e3 linter/no-var: Only fix to const if the var has an initializer (#15385) (camc314)
• cc403f5 linter/plugins: Return empty object for unimplemented parserServices (#15364) (magic-akari)

⚡ Performance

• 25d577e language_server: Start tools in parallel (#15500) (Sysix)
• 3c57291 linter/plugins: Optimize loops (#15449) (overlookmotel)
• 3166233 linter/plugins: Remove Arcs (#15431) (overlookmotel)
• 9de1322 linter/plugins: Lazily deserialize settings JSON (#15395) (overlookmotel)
• 3049ec2 linter/plugins: Optimize deepFreezeSettings (#15392) (overlookmotel)
• 444ebfd linter/plugins: Use single object for parserServices (#15378) (overlookmotel)

📚 Documentation

• 97d2104 linter: Update comment in lint.rs about default value for tsconfig path (#15530) (Connor Shea)
• 2c6bd9e linter: Always refer as "ES2015" instead of "ES6" (#15411) (sapphi-red)
• a0c5203 linter/import/named: Update "ES7" comment in examples (#15410) (sapphi-red)
• 3dc24b5 linter,minifier: Always refer as "ES Modules" instead of "ES6 Modules" (#15409) (sapphi-red)
• 2ad77fb linter/no-this-before-super: Correct "Why is this bad?" section (#15408) (sapphi-red)
• 57f0ce1 linter: Add backquotes where appropriate (#15407) (sapphi-red)

Oxfmt v0.12.0

... (truncated)

Changelog

Sourced from oxlint's changelog.

[1.74.0] - 2026-07-13

🚀 Features

• 0433a83 linter/eslint/no-inner-declarations: Add namespaces option (#24044) (Boshen)

🐛 Bug Fixes

• 8337835 linter: Error on ignorePatterns that cannot match files aoutside the config directory (#24341) (leaysgur)
• 2ce5a33 linter: Resolve ignorePatterns relative to the config dir (#24339) (leaysgur)

⚡ Performance

• 7f80cac linter/vue/prop-name-casing: Precompile ignoreProps regex pattern (#24413) (connorshea)
• 6272051 linter/typescript/no-require-imports: Compile allow patterns once (#24417) (connorshea)
• 33805b9 linter/jsdoc/require-param: Compile checkTypesPattern regex once (#24420) (connorshea)

Commits

• 2d4e8d2 release(apps): oxlint v1.74.0 && oxfmt v0.59.0 (#24454)
• 7f80cac perf(linter/vue/prop-name-casing): precompile ignoreProps regex pattern (#2...
• 6272051 perf(linter/typescript/no-require-imports): compile allow patterns once (#24417)
• 33805b9 perf(linter/jsdoc/require-param): compile checkTypesPattern regex once (#24420)
• 0433a83 feat(linter/eslint/no-inner-declarations): add namespaces option (#24044)
• 8337835 fix(linter): error on ignorePatterns that cannot match files aoutside the c...
• 2ce5a33 fix(linter): resolve ignorePatterns relative to the config dir (#24339)
• See full diff in compare view

Updates tsdown from 0.22.4 to 0.22.12

Release notes

Sourced from tsdown's releases.

v0.22.12

   🚨 Breaking Changes

• exe: Standardize minimum Node.js version  -  by @​sxzz (85f23)

    View changes on GitHub

v0.22.11

   🚀 Features

• deps: Add resolveDepSubpath option  -  by @​sxzz in rolldown/tsdown#1026 (346cb)

    View changes on GitHub

v0.22.10

   🚀 Features

• exe: Support custom node index and download url  -  by @​anytinz in rolldown/tsdown#1023 (0d24a)

   🐞 Bug Fixes

• deps: External peerDependenciesMeta deps  -  by @​sxzz (bad1b)
• exe: Handle Windows node archives on Linux  -  by @​sxzz (074e4)

    View changes on GitHub

v0.22.9

   🚀 Features

• Upgrade rolldown to v1.2  -  by @​sxzz (91bb5)

   🐞 Bug Fixes

• deps: Check dynamic imports in onlyImport  -  by @​sxzz in rolldown/tsdown#1019 (a625a)

    View changes on GitHub

v0.22.8

   🚀 Features

• deps: Add onlyImport option  -  by @​sxzz and Claude Fable 5 (c5798)

   🐞 Bug Fixes

• config: Concat plugins arrays when merging config  -  by @​sxzz (b1c80)

    View changes on GitHub

v0.22.7

   🚀 Features

... (truncated)

Commits

• bd7b522 chore: release v0.22.12
• 85f23ea feat(exe)!: standardize minimum Node.js version
• 3157082 refactor: reorganize UserConfig interface
• 466d756 chore: release v0.22.11
• a6df89e ci: migrate Void deploy to GitHub OIDC (#1025)
• 346cb00 feat(deps): add resolveDepSubpath option (#1026)
• e2ddc05 chore: upgrade deps
• 95a04d2 chore: release v0.22.10
• 074e4f7 fix(exe): handle Windows node archives on Linux
• 0d24a0e feat(exe): support custom node index and download url (#1023)
• Additional commits viewable in compare view

Updates typescript from 7.1.0-dev.20260708.3 to 7.1.0-dev.20260720.1

Release notes

Sourced from typescript's releases.

TypeScript 6.0.1 RC

For release notes, check out the release announcement blog post.

• fixed issues query for TypeScript 6.0.0 (Beta).
• fixed issues query for TypeScript 6.0.1 (RC).

Downloads are available on:

• npm

Commits

• See full diff in compare view

Updates ultracite from 7.9.3 to 7.9.4

Release notes

Sourced from ultracite's releases.

ultracite@7.9.4

Patch Changes

• f480c12: Upgrade Biome to 2.5.3 to fix the LSP scanner deadlock (#10845) where editors get stuck on "Biome is scanning the project".
• 1d70c40: Fail fast with an actionable message when Biome can't resolve ultracite/biome/core. Biome resolves that config out of the project's node_modules, so it errors with an opaque "module not found" whenever Ultracite isn't installed there — a state npx ultracite check / bunx ultracite check hide, because they run the CLI from a temp cache regardless. check and fix now detect it before invoking Biome and say what's actually wrong, and doctor verifies that Ultracite resolves rather than just appearing in package.json (#750).
• 38d10bc: Move Biome's noUnknownAttribute rule out of the core preset and into the react preset. The rule only recognises React's JSX attribute names, so projects using Solid, Svelte, Vue, or Qwik were incorrectly flagged for framework-standard attributes such as class.
• cf723bd: Add interactive and non-interactive selection for optional Oxlint JS plugins during init.

Commits

• 595490a Version Packages (#751)
• 227f87c Substitute every wildcard when resolving an exports target
• 52af6b0 Fix flaky doctor tests leaking a config-resolution mock into other test files
• 1d70c40 Resolves #750
• f5e2752 Update Blume
• 38d10bc Removed react exclusive rule form core (#748)
• f480c12 fix: upgrade Biome to 2.5.3 to fix LSP scanner deadlock (#749)
• 154e70d chore: pin GitHub Actions to SHAs (#747)
• cf723bd feat: add Oxlint JS plugin init selection (#746)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

---

Summary by cubic

Update dev tooling (linting, formatting, bundling, TS nightly) to pick up fixes and keep CI stable. No runtime code changes.

• Dependencies

  • Lint/format: eslint-plugin-github 6.1.1 fixes jsx-a11y rules in flat configs; eslint-plugin-sonarjs 4.2.0 rule updates; oxfmt 0.59.0 and oxlint 1.74.0 improve ignorePatterns handling and performance.
  • Build: tsdown 0.22.12 upgrades internals and standardizes minimum Node.js version.
  • TypeScript: typescript 7.1.0-dev.20260720.1 bump.
  • Analysis: knip 6.27.0 adds plugins and better framework support.
  • Tooling: @changesets/cli 2.31.1 fixes npm 12 publish detection; ultracite 7.9.4 upgrades Biome to resolve editor scan deadlock.

• Migration

  • Ensure CI/dev machines meet tsdown’s minimum supported Node.js version.

^{Written for commit 3b36cc1. Summary will update on new commits.}

Note

Bump development dependencies including oxfmt, ultracite, oxlint, rolldown, and TypeScript

Updates nine development dependencies in package.json and bun.lock, including oxfmt (^0.58.0 → ^0.59.0), ultracite (7.9.3 → 7.9.4), oxlint (1.74.0), rolldown (1.2.0), and a TypeScript dev build. No runtime or production dependencies are affected.

^{Macroscope summarized 3b36cc1.}

[changeset-bot]

⚠️ No Changeset found

Latest commit: 3b36cc1

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[pkg-pr-new]

Open in StackBlitz

bun add https://pkg.pr.new/@mynameistito/codex-usage@3b36cc1

commit: 3b36cc1

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	eslint-plugin-sonarjs@​4.1.0 ⏵ 4.2.0				+4
	oxfmt@​0.58.0 ⏵ 0.59.0			+1	+1
	typescript@​7.1.0-dev.20260708.3 ⏵ 7.1.0-dev.20260720.1	-5			+5
	tsdown@​0.22.4 ⏵ 0.22.12	+1		+1	+1
	oxlint@​1.73.0 ⏵ 1.74.0	+1		+1
	eslint-plugin-github@​6.1.0 ⏵ 6.1.1	+1			+3
	knip@​6.25.0 ⏵ 6.27.0	+1		+1
	@​changesets/​cli@​2.31.0 ⏵ 2.31.1	+1		+1	+2
	ultracite@​7.9.3 ⏵ 7.9.4	+1		+1

View full report