[dependabot]

Bumps the development-minor-and-patch group with 2 updates: oxfmt and oxlint.

Updates oxfmt from 0.74.0 to 0.75.0

Release notes

Sourced from oxfmt's releases.

oxfmt v0.75.0

🐛 Bug Fixes

• 5042019 formatter: Keep fill layout for array with comment after [ (#28170) (leaysgur)
• 9d37ff6 formatter: Use position-based comment checks for concise arrays (#28169) (leaysgur)
• 016c4a2 formatter: Keep a comment before } inside a JSX spread child (#28103) (vidigoat)
• 190bb1e formatter: Keep parens around an instantiation expression ending an operand through any tight parent (#28168) (leaysgur)
• a5314a1 formatter: Keep ; before in and instanceof class members (#28166) (leaysgur)
• 3a56e7c formatter: Keep closing HTML comments at the start of a line (#28064) (Cameron)
• 23d23d6 formatter_markdown: Honor range ignore inside directives (#28164) (leaysgur)
• 5f1fd3d formatter: Measure width heuristics by display width (#28098) (leaysgur)
• a5a52cf formatter: Keep parens around private in expressions (#28096) (leaysgur)
• 999496e formatter: Measure a short key by its display width (#28026) (vidigoat)
• 7e9aa44 formatter: Keep parens around a looser operand of an instantiation expression (#28025) (vidigoat)
• 6912d1f formatter: Keep an arrow signature that exactly fills the line for any body (#27989) (leaysgur)
• eb1d9f9 formatter_core: Count a flat line space in fits only when text follows (#27987) (leaysgur)

⚡ Performance

• 1ed93af data_structures: Copy short strings without a memcpy call (#27953) (leaysgur)
• 7948f0b formatter_core: Shrink FormatElement to 16B (#28012) (leaysgur)
• 788af22 formatter: Keep AstNodes on the stack, and only chain links in the arena (#27963) (leaysgur)

📚 Documentation

• 068a8ea formatter: Fix up wording (#28167) (leaysgur)
• db55461 formatter_core: Document text width divergence (#28095) (leaysgur)
• 880d229 formatter: Add vitest-test-call to known divergences (#28006) (leaysgur)

Commits

• 9b6fff4 release(apps): oxlint v1.90.0 && oxfmt v0.75.0 (#28191)
• 3e7f0f5 chore(oxfmt): bump prettier-plugin-astro to 1.1.2 (#28162)
• See full diff in compare view

Updates oxlint from 1.89.0 to 1.90.0

Release notes

Sourced from oxlint's releases.

oxlint v1.90.0

🚀 Features

• cf34678 oxlint: Export Oxlintrc type (#28132) (Sysix)
• 831cdf1 oxlint: Require mininum oxlint-tsgolint version v7.0.2005 (#28118) (camc314)
• d1b00f4 linter/typescript: Implement no-unsafe-enum-assignment rule (#28117) (camc314)
• 165c91f linter/typescript/await-thenable: Support allowMixedPromiseArrays option (#28116) (camc314)

🐛 Bug Fixes

• 7f3c908 linter/eslint/array-callback-return: Check callbacks passed with extra arguments (#28133) (sarankumar)
• 53be530 linter: Filter by type aware rules when looking up tsgolint rule severity (#28138) (NavpreetSSidhu)
• e0f8937 react-compiler: Compile a try whose catch is unreachable instead of panicking (#28066) (Dunqing)
• f5b625f linter/eslint/no-useless-concat: See through parenthesized expressions (#27984) (Rahul Kashyap)
• 4629bb2 linter/jest/no-conditional-expect: Check function expression callbacks (#28055) (camc314)
• 5c84098 semantic,linter: Report names with lone surrogates in enum and lint checks (#27991) (Dunqing)
• f3705a9 linter/eslint/prefer-const: Skip fixers if any declarator is reassigned (#28008) (Prince Jain)
• 4c0fa90 minifier,linter: Keep delete of constant members and later JSX keys (#27990) (Dunqing)
• 0298062 linter/arrow-body-style: Keep type assertions when adding a block body (#27978) (Yan Almeida)

Changelog

Sourced from oxlint's changelog.

[1.90.0] - 2026-10-27

🚀 Features

• 831cdf1 oxlint: Require mininum oxlint-tsgolint version v7.0.2005 (#28118) (camc314)
• d1b00f4 linter/typescript: Implement no-unsafe-enum-assignment rule (#28117) (camc314)
• 165c91f linter/typescript/await-thenable: Support allowMixedPromiseArrays option (#28116) (camc314)

Commits

• 9b6fff4 release(apps): oxlint v1.90.0 && oxfmt v0.75.0 (#28191)
• 831cdf1 feat(oxlint): require mininum oxlint-tsgolint version v7.0.2005 (#28118)
• d1b00f4 feat(linter/typescript): implement no-unsafe-enum-assignment rule (#28117)
• 165c91f feat(linter/typescript/await-thenable): support allowMixedPromiseArrays opt...
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge.

What this changes

Updates development tooling to Oxfmt 0.75.0 and Oxlint 1.90.0 with matching platform bindings.

Example: A contributor installs dependencies using the frozen lockfile.

• Before: Formatting uses Oxfmt 0.74.0 and linting uses Oxlint 1.89.0.
• After: Formatting uses Oxfmt 0.75.0 and linting uses Oxlint 1.90.0.

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	A focused, apparently correct maintenance patch supported by successful CI, with evidence limited to automated validation.
Proof confidence	🦐 gold shrimp (3/6)	This bot-authored dependency maintenance PR is outside the ordinary contributor proof gate; reviewed-head CI supports validation, and no separate live demonstration was supplied or claimed.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Product

Kind: Maintenance · Worth it: Yes · Fix scope: Complete
User problem: Contributors remain on older formatter and linter releases.
Reason: The update follows established tooling maintenance, stays confined to development dependencies, and passes the existing validation gate.

Merge readiness

✅ Ready for maintainer review

Keep this PR open for landing: main still uses the older tooling, the update is focused, and no actionable defect was found.

Priority: P3
Reviewed head: a590bc6b431a9b01ca75fc9b14e0fb6e75525633

Before merge

None.

Findings

None.

Agent review details

How this fits together

The development dependency graph supplies formatter and linter executables that consume repository files and produce formatting checks or diagnostics.

flowchart LR
  A[Package manifest] --> B[Frozen lockfile install]
  B --> C[Oxfmt and Oxlint]
  D[Repository files] --> C
  C --> E[Formatting checks and diagnostics]

Loading

Technical review

Best possible solution:

Land the focused tooling update through the repository's normal review process.

Do we have a high-confidence way to reproduce the issue?

This is dependency maintenance rather than a reported product bug; source inspection verifies the old and new resolved versions.

Is this the best way to solve the issue?

The manifest and lockfile update is the smallest complete change, retaining existing scripts, runtime requirements, and dependency policy.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 8b8a21d779bd.

Provenance checked

• Formatter and linter dependency versions keeps the original intent (79c1495: The preceding merged refresh advanced development tooling while retaining the Node 22 runtime floor and 48-hour cooldown; scoped history shows repeated maintenance of the same tools.)

Testing

Proof path: unit tests only.

Security

None.

Evidence

What I checked:

• Verified introduced change: The pinned diff changes only the Oxfmt manifest range and the Oxfmt/Oxlint lockfile entries, bindings, integrity values, and optional peer constraints. (package.json:47, a590bc6b431a)
• Still absent from main: Current main retains Oxfmt ^0.74.0 and resolves Oxfmt 0.74.0 and Oxlint 1.89.0; this PR remains open and unmerged. (pnpm-lock.yaml:35, 8b8a21d779bd)
• Existing maintenance direction: The preceding tooling refresh, build(deps): refresh tooling and secret scanning #251, deliberately preserved the Node 22 floor and 48-hour release cooldown; this update retains both. (package.json:47, 79c1495f20d3)
• Reviewed-head validation: The successful Linux job identifies the reviewed head and records successful frozen install, typecheck, lint, formatting check, coverage, and packaged CLI smoke steps; Node 22/24 runtime and Windows checks also passed. (.github/workflows/ci.yml:27, a590bc6b431a)
• Dependency review limitation: The dependency-review job succeeded through its configured fallback: the dependency graph API was unavailable, so dependency-review-action did not run; this is not evidence of a completed vulnerability scan. (.github/workflows/dependency-review.yml, a590bc6b431a)
• Release cooldown: The upstream Oxfmt 0.75.0 and Oxlint 1.90.0 releases were published on October 27, 2026, before the repository's 48-hour cooldown cutoff for this November 2 update.

Labels

Label changes:

• add P3: Routine development tooling maintenance with no demonstrated production failure or urgent regression.
• add rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Label justifications:

• P3: Routine development tooling maintenance with no demonstrated production failure or urgent regression.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed November 2, 2026, 12:20 PM ET / 17:20 UTC.