[bompus]

Bumps three exact-pinned devDependencies that were behind their newest releases that pass the three-day release-age gate: oxlint 1.91.0 to 1.92.0, oxlint-tsgolint 7.0.2005 to 7.0.2006, typebox 1.4.3 to 1.4.5. bun.lock was regenerated by bun install. The earlier oxlint 1.91.0 and oxfmt 0.76.0 bumps (#246, #247) are already on main, so nothing here supersedes them.

Contract

• Must: change the three pins in package.json and their bun.lock entries (oxlint and its platform bindings, oxlint-tsgolint and its platform packages, typebox).
• Must not: change any source, test, workflow or Dependabot file, or any other dependency. oxfmt stays 0.76.0 and typescript stays 7.1.0-beta.
• Accepted residual: oxlint 1.93.0 and typebox 1.4.6 exist but are newer than this selection or inside the release-age gate.

Release notes read

• oxlint 1.92.0: new type-aware discovery of tsrs, a no-redeclare option, and rule fixes (no breaking change listed). It requires oxlint-tsgolint >=7.0.2005, which 7.0.2006 satisfies.
• oxlint-tsgolint 7.0.2006: npm dependency updates and a Go 1.26.10 requirement (no breaking change).
• typebox 1.4.4 and 1.4.5 publish no release notes; the tag compare shows stricter IRI and IRI-reference format validators and type-level fixes. typebox is used only by three test files (Schema.Compile on plain JSON Schema objects with no format keys), so neither change reaches them.

Checks

• bun run check: exit 0.
• bun test: 1545 pass, 7 skip, 0 fail (Linux). Windows runs in CI.
• Review: one model family (SWE-2, read-only) compared bun.lock against its parent line by line and found only the three packages and their platform entries changed; the new libc fields on some oxlint binding entries are registry metadata that Bun now writes for entries it rewrites. A single family read it because this is a mechanical three-pin bump.

No documentation or tool description changes, and no user-visible change, so no changelog entry.

• The checks in the README's Development section pass.
• A change users will notice has a CHANGELOG.md entry under Unreleased. (No user-visible change.)
• Nothing names a private project or repository, a local path, a home directory or a credential.

[bompus-ai-review]

Bompus AI Review (Muse Wonder Full, high reasoning): 0 finding(s).