chore(deps-dev): bump the development-dependencies group across 1 directory with 14 updates

[dependabot]

Bumps the development-dependencies group with 14 updates in the / directory:

Package	From	To
@effect/tsgo	0.31.0	0.45.0
@types/node	26.1.2	26.5.1
bun	1.3.14	1.4.2
deno	2.9.4	2.9.6
esbuild	0.28.1	0.28.2
lint-staged	17.3.0	17.5.1
oxfmt	0.62.0	0.67.0
oxlint	1.77.0	1.82.0
playwright	1.62.1	1.63.0
skills	1.5.21	1.5.25
turbo	2.10.8	2.10.12
valibot	1.4.2	1.5.0
zod	4.4.3	4.6.2
@electric-sql/pglite	0.5.4	0.5.8

Updates @effect/tsgo from 0.31.0 to 0.45.0

Release notes

Sourced from @​effect/tsgo's releases.

@​effect/tsgo@​0.45.0

Minor Changes

• 066c4b0: Add the opt-in schemaSync diagnostic to prefer Effect-based Schema decoding and encoding over decodeSync, decodeUnknownSync, encodeSync, and encodeUnknownSync in any context. It recommends the corresponding Effect v3 or v4 method and is enabled by the effect-native preset.

Patch Changes

• bc87c9f: Update the TypeScript next tag to typescript@next, which ships typescript-go commit f3b04fe05642d53b4ff126a4af05fe2587b43748, and update the TypeScript latest tag to typescript@latest.

@​effect/tsgo-linux-arm@​0.45.0

No release notes provided.

@​effect/tsgo@​0.44.0

Minor Changes

• a64e17d: Add obsoleteMatchImport diagnostic (TS377127) to warn when importing @effect/match in projects targeting Effect v4. In Effect v4, pattern matching is built directly into effect (import { Match } from "effect" or import * as Match from "effect/Match").
• 63331b6: Add obsoleteSchemaImport diagnostic (TS377128) to warn when importing @effect/schema or @effect/schema/* in projects targeting Effect v4. In Effect v4, Schema is built directly into effect (import { Schema } from "effect" or import * as Schema from "effect/Schema").
• 29733f1: Add the timeoutCatchTagToTimeoutOrElse diagnostic and quick fixes for Effect v4. Suggest Effect.timeoutOrElse for Effect.timeout followed by Effect.catchTag("TimeoutError", ...), and Effect.timeoutOption for the corresponding Some/None pattern. Only suggest a rewrite when the input error channel excludes TimeoutError and the handler does not use the caught error.

Patch Changes

• a05d76b: Reuse the normalized piping-flow shape and sequence matchers across existing diagnostics.
• d990b0a: Fix cryptoRandomUUID and cryptoRandomUUIDInEffect diagnostic messages and rule descriptions in Effect v4 to recommend the Effect Crypto module instead of Random. In Effect v4, Random does not provide randomUUID and uses non-cryptographic Math.random, whereas cryptographic UUID generation is provided by Crypto.Crypto (such as yield* crypto.randomUUIDv4).
• 7993db9: Update the TypeScript next tag to typescript@next, which ships typescript-go commit 1f70213d4922b434345f639b441681e470c7cfc1, and update the TypeScript latest tag to typescript@latest.

@​effect/tsgo-linux-arm@​0.44.0

No release notes provided.

@​effect/tsgo@​0.43.0

Minor Changes

• 956b8d6: Extend nodeBuiltinImport to recommend Effect-native alternatives for console, timers, timers/promises, stream, stream/promises, and stream/web, including their node: forms.

  For Effect v4, also flag crypto and node:crypto imports and recommend Crypto from effect. For example, import { randomUUID } from "node:crypto" is now diagnosed; use the Crypto service's randomUUIDv4 effect instead. Effect v3 crypto imports remain allowed because that version has no corresponding Crypto service.

  Correct the Effect v4 child_process recommendation to point to effect/unstable/process. The rule remains disabled by default; configure nodeBuiltinImport with error severity to prohibit covered imports.

@​effect/tsgo-linux-arm@​0.43.0

No release notes provided.

@​effect/tsgo@​0.42.0

Minor Changes

• 7565750: Add the matchEffectToMapBoth style diagnostic and quick fix for replacing Effect.matchEffect handlers that return Effect.fail and Effect.succeed with Effect.mapBoth.

• a09feae: Add the catchAllTagDispatchToCatchTag style diagnostic and quick fix for replacing manual tagged-error dispatch with Effect.catchTag or Effect.catchTags.

• 2d501a2: Add the provideLayerSucceedToProvideService diagnostic and quick fix for replacing inline Layer.succeed and Layer.effect provision with direct service provision.

• 46c6e68: Add the matchEffectToMatch style diagnostic and quick fix for replacing Effect.matchEffect or Effect.matchCauseEffect whose handlers only return Effect.succeed with their non-effectful counterparts.

  Make lazy-expression parsing synchronous and non-generator by default, with flags for callers that explicitly accept thunks, async functions, or generators.

• 59c5fff: Adopt the piping flow parser in more diagnostics.

... (truncated)

Changelog

Sourced from @​effect/tsgo's changelog.

0.45.0

Minor Changes

• 066c4b0: Add the opt-in schemaSync diagnostic to prefer Effect-based Schema decoding and encoding over decodeSync, decodeUnknownSync, encodeSync, and encodeUnknownSync in any context. It recommends the corresponding Effect v3 or v4 method and is enabled by the effect-native preset.

Patch Changes

• bc87c9f: Update the TypeScript next tag to typescript@next, which ships typescript-go commit f3b04fe05642d53b4ff126a4af05fe2587b43748, and update the TypeScript latest tag to typescript@latest.

0.44.0

Minor Changes

• a64e17d: Add obsoleteMatchImport diagnostic (TS377127) to warn when importing @effect/match in projects targeting Effect v4. In Effect v4, pattern matching is built directly into effect (import { Match } from "effect" or import * as Match from "effect/Match").
• 63331b6: Add obsoleteSchemaImport diagnostic (TS377128) to warn when importing @effect/schema or @effect/schema/* in projects targeting Effect v4. In Effect v4, Schema is built directly into effect (import { Schema } from "effect" or import * as Schema from "effect/Schema").
• 29733f1: Add the timeoutCatchTagToTimeoutOrElse diagnostic and quick fixes for Effect v4. Suggest Effect.timeoutOrElse for Effect.timeout followed by Effect.catchTag("TimeoutError", ...), and Effect.timeoutOption for the corresponding Some/None pattern. Only suggest a rewrite when the input error channel excludes TimeoutError and the handler does not use the caught error.

Patch Changes

• a05d76b: Reuse the normalized piping-flow shape and sequence matchers across existing diagnostics.
• d990b0a: Fix cryptoRandomUUID and cryptoRandomUUIDInEffect diagnostic messages and rule descriptions in Effect v4 to recommend the Effect Crypto module instead of Random. In Effect v4, Random does not provide randomUUID and uses non-cryptographic Math.random, whereas cryptographic UUID generation is provided by Crypto.Crypto (such as yield* crypto.randomUUIDv4).
• 7993db9: Update the TypeScript next tag to typescript@next, which ships typescript-go commit 1f70213d4922b434345f639b441681e470c7cfc1, and update the TypeScript latest tag to typescript@latest.

0.43.0

Minor Changes

• 956b8d6: Extend nodeBuiltinImport to recommend Effect-native alternatives for console, timers, timers/promises, stream, stream/promises, and stream/web, including their node: forms.

  For Effect v4, also flag crypto and node:crypto imports and recommend Crypto from effect. For example, import { randomUUID } from "node:crypto" is now diagnosed; use the Crypto service's randomUUIDv4 effect instead. Effect v3 crypto imports remain allowed because that version has no corresponding Crypto service.

  Correct the Effect v4 child_process recommendation to point to effect/unstable/process. The rule remains disabled by default; configure nodeBuiltinImport with error severity to prohibit covered imports.

0.42.0

Minor Changes

• 7565750: Add the matchEffectToMapBoth style diagnostic and quick fix for replacing Effect.matchEffect handlers that return Effect.fail and Effect.succeed with Effect.mapBoth.

• a09feae: Add the catchAllTagDispatchToCatchTag style diagnostic and quick fix for replacing manual tagged-error dispatch with Effect.catchTag or Effect.catchTags.

• 2d501a2: Add the provideLayerSucceedToProvideService diagnostic and quick fix for replacing inline Layer.succeed and Layer.effect provision with direct service provision.

• 46c6e68: Add the matchEffectToMatch style diagnostic and quick fix for replacing Effect.matchEffect or Effect.matchCauseEffect whose handlers only return Effect.succeed with their non-effectful counterparts.

  Make lazy-expression parsing synchronous and non-generator by default, with flags for callers that explicitly accept thunks, async functions, or generators.

• 59c5fff: Adopt the piping flow parser in more diagnostics.

  • promiseInEffectSuccess: an explicit promise-success annotation (type arguments on Effect.succeed/as/map/zipWith) now suppresses the diagnostic from any position in the surrounding pipe, not only the last argument. base.pipe(Effect.as<Promise<number>>(promiseValue), Effect.as(promiseValue)) no longer reports, matching the reversed order that was already accepted.
  • allOfMapToForEach: now also detects the data-last form expressed through piping flows, e.g. pipe(values.map(effectful), Effect.all) and pipe(values.map(effectful), Effect.all, Effect.asVoid), which were previously invisible to the call-expression walk. These matches are diagnostic-only: the existing quick fix remains limited to the standalone Effect.all(xs.map(f), options?) call it can safely rewrite.
  • The piping flow parser now keeps the type arguments of parenthesized pipe arguments, e.g. pipe(x, (Effect.as<...>(v))).
  • The piping flow parser now normalizes curried pipeable applications, so Effect.catch(handler)(effect) has effect as its subject, Effect.catch as its callee, and handler as its transformation argument. The normalization is limited to calls whose signatures verify that they are the pipeable counterpart of a data-first overload of the same combinator, leaving unrelated curried APIs such as Effect.fn("name")(body) unchanged.

... (truncated)

Commits

• 54bbc1e Version Packages (#736)
• bc87c9f chore: update upstreams (#737)
• 066c4b0 feat: add opt-in schemaSync diagnostic (#735)
• f283fef Version Packages (#728)
• a64e17d feat(rules): add obsoleteMatchImport diagnostic for @​effect/match in Effect v...
• 7993db9 chore: update upstreams (#734)
• 63331b6 feat(rules): add obsoleteSchemaImport diagnostic for @​effect/schema in Effect...
• d990b0a fix(cryptoRandomUUID): recommend Effect Crypto module instead of Random in v4...
• 29733f1 Add timeoutCatchTagToTimeoutOrElse diagnostic (#723)
• 9a82ef8 Version Packages (#724)
• Additional commits viewable in compare view

Updates @types/node from 26.1.2 to 26.5.1

Commits

• See full diff in compare view

Updates bun from 1.3.14 to 1.4.2

Release notes

Sourced from bun's releases.

Bun v1.4.2

To install Bun v1.4.2

curl -fsSL https://bun.sh/install | bash
# or you can use npm
# npm install -g bun

Windows:

powershell -c "irm bun.sh/install.ps1|iex"

To upgrade to Bun v1.4.2:

bun upgrade

Read Bun v1.4.2's release notes on Bun's blog

Thanks to 3 contributors!

• @​dylan-conway
• @​jarred-sumner
• @​robobun

Bun v1.4.1

To install Bun v1.4.1

curl -fsSL https://bun.sh/install | bash
# or you can use npm
# npm install -g bun

Windows:

powershell -c "irm bun.sh/install.ps1|iex"

To upgrade to Bun v1.4.1:

bun upgrade

Read Bun v1.4.1's release notes on Bun's blog

Thanks to 7 contributors!

• @​alii
• @​dylan-conway

... (truncated)

Commits

• 744846f Bump to 1.4.2
• 7b0b70e Decode CMYK and YCCK JPEGs in Bun.Image (#31898)
• 7e37445 WebKit 2e2aa2290fac: JSArray shift/splice/setLength cleared live butterfly sl...
• 814fa03 Remove the unused function-slot vector from JSCommonJSExtensions (#41405)
• 9584239 WebKit fbd894680a6c: IC stub routine watchpoints could outlive the cells thei...
• 86b2e06 install: key the lockfile string pool by the bytes, not a stored hash (#41366)
• 5fb9ecb Reject json() with the JSON.parse SyntaxError on the buffered path (#41387)
• 74326db AsyncLocalStorage: don't retain the outer store from exit() / nested run() (#...
• 3044dc6 io: leave the fd with the caller when a POSIX pipe writer fails to start (#38...
• 9fdcf5a worker_threads: post 'online' before the entry point runs (#41383)
• Additional commits viewable in compare view

Updates deno from 2.9.4 to 2.9.6

Release notes

Sourced from deno's releases.

v2.9.6

2.9.6 / 2026.08.27

• feat(compressible): add support for 'text/x-component' content type (#36450)
• feat(desktop): clipboard api (#35750)
• feat(desktop): support checked, icon, and tooltip on menu items (#36649)
• fix(bundle): isolate esbuild downloads from workspace registries (#36467)
• fix(cache): combine duplicate headers for Vary matching (#36476)
• fix(cli_parser): remove orphaned sync-types parser
• fix(core): cap adaptive buffer initial allocations (#36432)
• fix(core): make Unix pipe fd ownership explicit (#36353)
• fix(core): make user timer waker state thread-safe (#36495)
• fix(coverage): compare a range against a line in V8's units (#36613)
• fix(crypto): preserve RSA-OAEP label bytes (#36441)
• fix(desktop): keep dots in the app name when resolving the runtime library (#36006)
• fix(desktop): keep the macOS bundle signature valid unless an update is applied (#36574)
• fix(desktop): never block the JS thread on the error-report dialog (#36575)
• fix(desktop): propagate deno.json version and license into packaged installers (#36577)
• fix(desktop): run Vite-based HMR dev servers inside the desktop runtime (#36488)
• fix(desktop): transport binding args and results as DesktopValue so Uint8Array survives (#36573)
• fix(ext/fetch): enforce permissions for proxy transports (#36217)
• fix(ext/fetch): only retry transport errors on pooled connections (#36415)
• fix(ext/fetch): raise default HTTP/2 SETTINGS_MAX_HEADER_LIST_SIZE to 256KB (#36558)
• fix(ext/http): keep request body readable after response is sent (#36629)
• fix(ext/http): route invalid async responses to onError (#36437)
• fix(ext/napi): don't invoke napi_wrap finalizer twice at teardown (#36556)
• fix(ext/napi): run JS-calling finalizers safely, NULL string result, and Float16Array (#36572)
• fix(ext/napi): surface OS error and path on addon load failure (#36630)
• fix(ext/napi): track pending finalizers by identity (#36551)
• fix(ext/napi): wake the event loop at the next uv_timer deadline (#36559)
• fix(ext/net): skip unsupported DNS records in ANY queries (#36650)
• fix(ext/node): accept string ports in dns.lookupService (#36546)
• fix(ext/node): build the proxied request target with the URL parser (#36557)
• fix(ext/node): do not resume client TLS sessions unless requested (#36592)
• fix(ext/node): fix perf_hooks detail.req.url proxied path duplication (#36407)
• fix(ext/node): handle readv short reads (#36211)
• fix(ext/node): require sys permission for inspector.open (#36465)
• fix(ext/node_sqlite): invalidate sessions on database close (#36633)
• fix(ext/tls): avoid panic for mismatched client certificate and key (#36457)
• fix(ext/web): clean up abort handlers when listeners are removed (#36226)
• fix(ext/web): close transfer MessagePort when a transferred readable is cancelled (#36270)
• fix(ext/web): snapshot SharedArrayBuffer input in TextDecoder.decode()

... (truncated)

Changelog

Sourced from deno's changelog.

2.9.6 / 2026.08.27

• feat(compressible): add support for 'text/x-component' content type (#36450)
• feat(desktop): clipboard api (#35750)
• feat(desktop): support checked, icon, and tooltip on menu items (#36649)
• fix(bundle): isolate esbuild downloads from workspace registries (#36467)
• fix(cache): combine duplicate headers for Vary matching (#36476)
• fix(cli_parser): remove orphaned sync-types parser
• fix(core): cap adaptive buffer initial allocations (#36432)
• fix(core): make Unix pipe fd ownership explicit (#36353)
• fix(core): make user timer waker state thread-safe (#36495)
• fix(coverage): compare a range against a line in V8's units (#36613)
• fix(crypto): preserve RSA-OAEP label bytes (#36441)
• fix(desktop): keep dots in the app name when resolving the runtime library (#36006)
• fix(desktop): keep the macOS bundle signature valid unless an update is applied (#36574)
• fix(desktop): never block the JS thread on the error-report dialog (#36575)
• fix(desktop): propagate deno.json version and license into packaged installers (#36577)
• fix(desktop): run Vite-based HMR dev servers inside the desktop runtime (#36488)
• fix(desktop): transport binding args and results as DesktopValue so Uint8Array survives (#36573)
• fix(ext/fetch): enforce permissions for proxy transports (#36217)
• fix(ext/fetch): only retry transport errors on pooled connections (#36415)
• fix(ext/fetch): raise default HTTP/2 SETTINGS_MAX_HEADER_LIST_SIZE to 256KB (#36558)
• fix(ext/http): keep request body readable after response is sent (#36629)
• fix(ext/http): route invalid async responses to onError (#36437)
• fix(ext/napi): don't invoke napi_wrap finalizer twice at teardown (#36556)
• fix(ext/napi): run JS-calling finalizers safely, NULL string result, and Float16Array (#36572)
• fix(ext/napi): surface OS error and path on addon load failure (#36630)
• fix(ext/napi): track pending finalizers by identity (#36551)
• fix(ext/napi): wake the event loop at the next uv_timer deadline (#36559)
• fix(ext/net): skip unsupported DNS records in ANY queries (#36650)
• fix(ext/node): accept string ports in dns.lookupService (#36546)
• fix(ext/node): build the proxied request target with the URL parser (#36557)
• fix(ext/node): do not resume client TLS sessions unless requested (#36592)
• fix(ext/node): fix perf_hooks detail.req.url proxied path duplication (#36407)
• fix(ext/node): handle readv short reads (#36211)
• fix(ext/node): require sys permission for inspector.open (#36465)
• fix(ext/node_sqlite): invalidate sessions on database close (#36633)
• fix(ext/tls): avoid panic for mismatched client certificate and key (#36457)
• fix(ext/web): clean up abort handlers when listeners are removed (#36226)
• fix(ext/web): close transfer MessagePort when a transferred readable is cancelled (#36270)
• fix(ext/web): snapshot SharedArrayBuffer input in TextDecoder.decode() (#36611)

... (truncated)

Commits

• e518fbd 2.9.6 (#36706)
• aa0367e fix(cli_parser): remove orphaned sync-types parser
• 31e6bc4 feat(desktop): clipboard api (#35750)
• 1797a4c fix(desktop): keep dots in the app name when resolving the runtime library (#...
• 873219d fix(desktop): propagate deno.json version and license into packaged installer...
• 6115624 chore: upgrade deno_doc to 0.207.0 and deno_graph to 0.111.0 (#36699)
• 483e669 fix(desktop): transport binding args and results as DesktopValue so Uint8Arra...
• eab6182 fix(publish): authenticate the package existence check so private packages wo...
• 0251c1d fix(desktop): keep the macOS bundle signature valid unless an update is appli...
• 0b9e290 fix(desktop): never block the JS thread on the error-report dialog (#36575)
• Additional commits viewable in compare view

Updates esbuild from 0.28.1 to 0.28.2

Release notes

Sourced from esbuild's releases.

v0.28.2

• Fix tree shaking bug due to TypeScript import alias (#4507)

  This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific import assignment and looks something like this:

  import Base from './dep.js';
  import Alias = Base.SomeType;

• Fix CSS minification bug involving & (#4497)

  This release fixes a bug where esbuild's CSS minifier incorrectly removed a & when it was unsafe to do so. Here is an example:

  /* Original code */
  .a .b {
    & .b:not(& .c) {
      color: red;
    }
  }
  /* Old output (with --minify) */
  .a .b{.b:not(& .c){color:red}}
  /* New output (with --minify) */
  .a .b{& .b:not(& .c){color:red}}

  This should match <span class="a"><span class="b"><span class="b">yes</span></span></span> but not <span class="a"><span class="b">no</span></span>. The old output incorrectly matched both.

• Avoid overwriting input files without --allow-overwrite (#4484)

  For example: esbuild input.js --outfile=input.js tells esbuild to overwrite input.js with the output of running esbuild on it. This was supposed to already be prevented by default, but it accidentally regressed in version 0.17.0 and apparently didn't have any test coverage. The error message was being printed but the input file was still being overwritten. Oops.

  This release puts the original behavior back. With this release, esbuild should now actually avoid overwriting input files unless --allow-overwrite is explicitly present. This is done by not writing out any files when a build error is encountered.

• Fix incorrect code generated when using top-level await (#4498)

  Previously esbuild could generate code containing a syntax error in complex scenarios involving top-level await used in a dependency cycle. The problem was a missing async on one or more module wrapper closures. With this release, esbuild now uses a fixed-point iteration algorithm to correctly annotate all dependencies in the cycle as needing an async module wrapper.

• Fix a minification bug with lowered logical assignment operators (#4508)

  This release fixes a bug that could cause esbuild to generate incorrect code for logical assignment operators when lowering them to an older target environment. Specifically the lowering process requires duplicating the left-hand side, but esbuild incorrectly failed to count the duplicate as a new usage when the left-hand side is an identifier. That then caused the minifier to believe that the left-hand side was only used once and could attempt to incorrectly inline an initializer into the first usage. This bug has now been fixed:

  // Original code
  function foo() {
    let x
    bar(x ||= {})

... (truncated)

Changelog

Sourced from esbuild's changelog.

0.28.2

• Fix tree shaking bug due to TypeScript import alias (#4507)

  This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific import assignment and looks something like this:

  import Base from './dep.js';
  import Alias = Base.SomeType;

• Fix CSS minification bug involving & (#4497)

  This release fixes a bug where esbuild's CSS minifier incorrectly removed a & when it was unsafe to do so. Here is an example:

  /* Original code */
  .a .b {
    & .b:not(& .c) {
      color: red;
    }
  }
  /* Old output (with --minify) */
  .a .b{.b:not(& .c){color:red}}
  /* New output (with --minify) */
  .a .b{& .b:not(& .c){color:red}}

  This should match <span class="a"><span class="b"><span class="b">yes</span></span></span> but not <span class="a"><span class="b">no</span></span>. The old output incorrectly matched both.

• Avoid overwriting input files without --allow-overwrite (#4484)

  For example: esbuild input.js --outfile=input.js tells esbuild to overwrite input.js with the output of running esbuild on it. This was supposed to already be prevented by default, but it accidentally regressed in version 0.17.0 and apparently didn't have any test coverage. The error message was being printed but the input file was still being overwritten. Oops.

  This release puts the original behavior back. With this release, esbuild should now actually avoid overwriting input files unless --allow-overwrite is explicitly present. This is done by not writing out any files when a build error is encountered.

• Fix incorrect code generated when using top-level await (#4498)

  Previously esbuild could generate code containing a syntax error in complex scenarios involving top-level await used in a dependency cycle. The problem was a missing async on one or more module wrapper closures. With this release, esbuild now uses a fixed-point iteration algorithm to correctly annotate all dependencies in the cycle as needing an async module wrapper.

• Fix a minification bug with lowered logical assignment operators (#4508)

  This release fixes a bug that could cause esbuild to generate incorrect code for logical assignment operators when lowering them to an older target environment. Specifically the lowering process requires duplicating the left-hand side, but esbuild incorrectly failed to count the duplicate as a new usage when the left-hand side is an identifier. That then caused the minifier to believe that the left-hand side was only used once and could attempt to incorrectly inline an initializer into the first usage. This bug has now been fixed:

  // Original code
  function foo() {
    let x

... (truncated)

Commits

• 609683d publish 0.28.2 to npm
• 11b1fe4 add to release notes
• ab50d91 css: fix green/blue channel swap in oklch gamut mapping (#4488)
• 04627b6 fix #4498: async TLA checks need a worklist
• 5c15177 disable gopls in the go folder
• fc2ee9b css: adjust parser to allow --foo: {...}
• 209db54 release notes for css nesting bugfix
• c625d31 fix #4497: preserve nested ampersands during minification (#4500)
• 34474e2 better isolation of current part in js parser
• 07f6e8c fix #4507: import assignment tree-shaking bug
• Additional commits viewable in compare view

Updates lint-staged from 17.3.0 to 17.5.1

Release notes

Sourced from lint-staged's releases.

v17.5.1

Patch Changes

• #1852 bfcca94 - Fix TypeScript issue TS1254 from defineConfig() by changing the signature from const to a function:

  A 'const' initializer in an ambient context must be a string or numeric literal or literal enum reference.

v17.5.0

Minor Changes

• #1847 f9063b7 - Lint-staged now refuses to run when files were staged with --intent-to-add, because Git stash doesn't support them. Previously this was an unhandled error.

Patch Changes

• #1848 d718ccc - Lint-staged now handles color support better in non-TTY streams, and honors the FORCE_COLOR environment variable.

• #1845 7e5ece8 - Update tinyexec@1.3.1 so that local binaries from node_modules/.bin are resolved starting from the directory of each lint-staged configuration file (in monorepo setups). This behavior was broken in lint-staged@16.3.0 where they were only resolved from the current working directory and up.

• #1845 eb8a4e3 - Do not try to restore untracked files when using --hide-all and there is no initial commit yet.

v17.4.1

17.4.1

Patch Changes

• #1840 efe5b63 - This is a version-bump-only release because the previous version 17.4.0 was not published to npmjs.com due to problems with GitHub Actions and Changesets.

17.4.0

Minor Changes

• #1836 90ec282 - Added a new defineConfig helper for type-checking the lint-staged configuration:

  // lint-staged.config.ts
  import { defineConfig } from 'lint-staged/config'
  export default defineConfig({
  '*.js': ['prettier --check', 'eslint'],
  })

• #1832 510a27c - Added a new flag --all to make lint-staged include all files tracked by Git, instead of only staged.

  By default lint-staged only runs tasks on files that include staged changes (hence the name). Use this flag to include all files tracked in Git version control (standard exclusions apply). Using this flag implies the --no-stash flag, disabling the automatic backup, and the --allow-empty flag so that lint-staged doesn't fail when there are no changes after running. This makes it easier to run npx lint-staged --all on a clean state, for example in CI.

Patch Changes

• #1838 69bec99 - The behavior of the automatic backup stash has been improved when running lint-staged in multiple worktrees in parallel. You should still avoid running multiple instances of lint-staged in parallel in the same tree, because some of the Git operations are locking and might lead to data loss.

... (truncated)

Changelog

Sourced from lint-staged's changelog.

17.5.1

Patch Changes

• #1852 bfcca94 - Fix TypeScript issue TS1254 from defineConfig() by changing the signature from const to a function:

  A 'const' initializer in an ambient context must be a string or numeric literal or literal enum reference.

17.5.0

Minor Changes

• #1847 f9063b7 - Lint-staged now refuses to run when files were staged with --intent-to-add, because Git stash doesn't support them. Previously this was an unhandled error.

Patch Changes

• #1848 d718ccc - Lint-staged now handles color support better in non-TTY streams, and honors the FORCE_COLOR environment variable.

• #1845 7e5ece8 - Update tinyexec@1.3.1 so that local binaries from node_modules/.bin are resolved starting from the directory of each lint-staged configuration file (in monorepo setups). This behavior was broken in lint-staged@16.3.0 where they were only resolved from the current working directory and up.

• #1845 eb8a4e3 - Do not try to restore untracked files when using --hide-all and there is no initial commit yet.

17.4.1

Patch Changes

• #1840 efe5b63 - This is a version-bump-only release because the previous version 17.4.0 was not published to npmjs.com due to problems with GitHub Actions and Changesets.

17.4.0

Minor Changes

• #1836 90ec282 - Added a new defineConfig helper for type-checking the lint-staged configuration:

  // lint-staged.config.ts
  import { defineConfig } from 'lint-staged/config'
  export default defineConfig({
  '*.js': ['prettier --check', 'eslint'],
  })

• #1832 510a27c - Added a new flag --all to make lint-staged include all files tracked by Git, instead of only staged.

  By default lint-staged only runs tasks on files that include staged changes (hence the name). Use this flag to include all files tracked in Git version control (standard exclusions apply). Using this flag implies the --no-stash flag, disabling the automatic backup, and the --allow-empty flag so that lint-staged doesn't fail when there are no changes after running. This makes it easier to run npx lint-staged --all on a clean state, for example in CI.

Patch Changes

... (truncated)

Commits

• f8b1ab1 Merge pull request #1853 from lint-staged/changeset-release/main
• 3b54961 chore(changeset): release
• 09317ff Merge pull request #1852 from lint-staged/fix-ambient-declaration
• bfcca94 fix: change defineConfig signature from const to a function
• dcb59f6 Merge pull request #1846 from lint-staged/changeset-release/main
• 9c8c6dc chore(changeset): release
• 586466f Merge pull request #1849 from lint-staged/improve-intent-to-add
• 45eda5f refactor: improve --intent-to-add detection
• 26372e3 Merge pull request #1848 from lint-staged/fix-color-detection
• d718ccc fix: honor FORCE_COLOR/NO_COLOR env variables in non-TTY streams
• Additional commits viewable in compare view

Updates oxfmt from 0.62.0 to 0.67.0

Changelog

Sourced from oxfmt's changelog.

[0.67.0] - 2026-09-07

🛡️ Security

• 9a612d5 deps: Update npm packages (#26178) (renovate[bot])

[0.64.0] - 2026-08-18

🚀 Features

• c07fe7c oxfmt: Support experimentalOperatorPosition (#25643) (leaysgur)

📚 Documentation

• fed6681 oxfmt: Skip expanding overrides options (#25572) (leaysgur)

Commits

• b4da00b release(apps): oxlint v1.82.0 && oxfmt v0.67.0 (#26384)
• 9a612d5 chore(deps): update npm packages (#26178)
• 0b4e2e6 release(apps): oxlint v1.81.0 && oxfmt v0.66.0 (#26199)
• 5ff57f8 fix(formatter/sort-imports): handle custom side effect groups (#26217)
• 63bc313 chore(npm): update funding URL (#26066)
• 97e99b8 release(apps): oxlint v1.80.0 && oxfmt v0.65.0 (#26045)
• 0db127c release(apps): oxlint v1.79.0 && oxfmt v0.64.0 (#25866)
• c07fe7c feat(oxfmt): support experimentalOperatorPosition (#25643)
• fed6681 docs(oxfmt): skip expanding overrides options (#25572)
• c42d639 release(apps): oxlint v1.78.0 && oxfmt v0.63.0 (#25473)
• Additional commits viewable in compare view

Updates oxlint from 1.77.0 to 1.82.0

Release notes

Sourced from oxlint's releases.

oxlint v1.82.0 & oxfmt v0.67.0

Table of Contents

• Oxlint v1.82.0
• Oxfmt v0.67.0

Oxlint v1.82.0

💥 BREAKING CHANGES

• 66744f0 parser: [BREAKING] Rename panicked to fatal_error in ParserReturn (#26382) (overlookmotel)

🚀 Features

• 6a0e19c linter/eslint/no-unmodified-loop-condition: Support checkConditionalExpressions option (#26249) (camc314)

🐛 Bug Fixes

• aa38ddf linter/unicorn/numeric-separators-style: Correct schema defaults (#26393) (camc314)
• 562dd14 jsx-a11y/anchor-has-content: Allow anchors passed as custom component props (#26360) (Mikhail Baev)
• 253cdb2 linter/eslint/id-length: Exempt TS interface/type-literal members with never (#26310) (Pearce Ropion)
• 8c7ea76 ast_visit: Account for trimmed source offsets (#26223) (Cameron)
• 5f9cffc linter/typescript/no-explicit-any: Fix rest parameter to unknown[] (#26279) (camc314)
• 4de9fa3 linter/react/jsx-no-literals: Check nested JSX expression literals (#26253) (camc314)
• 07851b9 parser: Fix debug assert failure when lexer error with tokens enabled (#26229) (overlookmotel)
• 9cee146 oxlint/lsp: Don't try to parse fix message, always fallback (#26204) (Sysix)
• a662c40 linter/eslint/no-use...

  Description has been truncated

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 3f13804b-e0f3-492b-932b-ed9e921933fb

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.