chore(deps-dev): bump the development-dependencies group with 6 updates

[dependabot]

Bumps the development-dependencies group with 6 updates:

Package	From	To
@types/node	26.4.1	26.5.1
markdown-it	15.0.1	15.0.2
oxfmt	0.66.0	0.67.0
oxlint	1.81.0	1.82.0
ultracite	7.10.7	7.11.1
vite	8.2.2	8.3.0

Updates @types/node from 26.4.1 to 26.5.1

Commits

• See full diff in compare view

Updates markdown-it from 15.0.1 to 15.0.2

Changelog

Sourced from markdown-it's changelog.

[15.0.2] - 2026-09-11

Security

• Fixed quadratic complexity in smartquotes when quote types don't match, #1209. Also limited the smartquotes stack to 1000 unmatched openers.

Commits

• 3c51991 15.0.2 released
• cf27366 Polish #1209 and limit smartquotes stack to 1000 openers
• 1b379c1 Fix quadratic complexity in smartquotes rule when quote types don't match (#1...
• See full diff in compare view

Updates oxfmt from 0.66.0 to 0.67.0

Changelog

Sourced from oxfmt's changelog.

[0.67.0] - 2026-09-07

🛡️ Security

• 9a612d5 deps: Update npm packages (#26178) (renovate[bot])

[0.64.0] - 2026-08-18

🚀 Features

• c07fe7c oxfmt: Support experimentalOperatorPosition (#25643) (leaysgur)

📚 Documentation

• fed6681 oxfmt: Skip expanding overrides options (#25572) (leaysgur)

[0.62.0] - 2026-08-03

🐛 Bug Fixes

• e6e584b oxfmt: Type jsdoc. enum options (#25008) (leaysgur)

[0.59.0] - 2026-07-13

🐛 Bug Fixes

• 415fe1e oxfmt: Error on ignorePatterns that cannot match files outside the config directory (#24286) (leaysgur)

[0.55.0] - 2026-06-15

🚀 Features

• 9a2788b linter/unicorn: Implement prefer-export-from rule (#22935) (AliceLanniste)

[0.54.0] - 2026-06-08

📚 Documentation

• dadafe3 oxlint, oxfmt: Mention migrate skills in npm READMEs (#22965) (Boshen)
• f88961a oxfmt: Annotate each config option with supported languages (#22953) (leaysgur)

[0.52.0] - 2026-05-26

🚀 Features

• 16b8058 oxfmt: Support vite-plus/resolveConfig for vite.config.ts (#22454) (leaysgur)

[0.50.0] - 2026-05-15

🐛 Bug Fixes

... (truncated)

Commits

• b4da00b release(apps): oxlint v1.82.0 && oxfmt v0.67.0 (#26384)
• 9a612d5 chore(deps): update npm packages (#26178)
• See full diff in compare view

Updates oxlint from 1.81.0 to 1.82.0

Release notes

Sourced from oxlint's releases.

oxlint v1.82.0 & oxfmt v0.67.0

Table of Contents

• Oxlint v1.82.0
• Oxfmt v0.67.0

Oxlint v1.82.0

💥 BREAKING CHANGES

• 66744f0 parser: [BREAKING] Rename panicked to fatal_error in ParserReturn (#26382) (overlookmotel)

🚀 Features

• 6a0e19c linter/eslint/no-unmodified-loop-condition: Support checkConditionalExpressions option (#26249) (camc314)

🐛 Bug Fixes

• aa38ddf linter/unicorn/numeric-separators-style: Correct schema defaults (#26393) (camc314)
• 562dd14 jsx-a11y/anchor-has-content: Allow anchors passed as custom component props (#26360) (Mikhail Baev)
• 253cdb2 linter/eslint/id-length: Exempt TS interface/type-literal members with never (#26310) (Pearce Ropion)
• 8c7ea76 ast_visit: Account for trimmed source offsets (#26223) (Cameron)
• 5f9cffc linter/typescript/no-explicit-any: Fix rest parameter to unknown[] (#26279) (camc314)
• 4de9fa3 linter/react/jsx-no-literals: Check nested JSX expression literals (#26253) (camc314)
• 07851b9 parser: Fix debug assert failure when lexer error with tokens enabled (#26229) (overlookmotel)
• 9cee146 oxlint/lsp: Don't try to parse fix message, always fallback (#26204) (Sysix)
• a662c40 linter/eslint/no-useless-assignment: Handle destructuring assignments (#25925) (camc314)
• 304bd9a linter/eslint/no-array-constructor: Handle ASI hazards in fixer (#26166) (Hamody We)
• b41bb35 linter: Qualify rules in rules output (#26250) (camc314)
• 895c685 linter/typescript/no-extraneous-class: Avoid deleting class expressions (#26231) (camc314)
• 4ba33c8 linter/eslint/no-unused-vars: Handle stored arrow references (#26225) (camc314)

🛡️ Security

• 9a612d5 deps: Update npm packages (#26178) (renovate[bot])

Oxfmt v0.67.0

💥 BREAKING CHANGES

• 66744f0 parser: [BREAKING] Rename panicked to fatal_error in ParserReturn (#26382) (overlookmotel)
• 2c9a947 parser: [BREAKING] Reduce MAX_LEN to 256 bytes below u32::MAX (#26352) (overlookmotel)

🚀 Features

• 68e12ab formatter_css: Follow the oxc-css-parser's acceptance line (#26337) (leaysgur)

🐛 Bug Fixes

• f7acdc0 formatter: Treat a JSDoc cast target as opaque in chain layouts (#26375) (leaysgur)
• 104061b formatter: Keep JSDoc cast parens with a comment inside them (#26374) (leaysgur)
• 3d00a76 formatter_css: Keep comment inside important and simple-vars colon (#26370) (leaysgur)

... (truncated)

Changelog

Sourced from oxlint's changelog.

[1.82.0] - 2026-09-07

🚀 Features

• 6a0e19c linter/eslint/no-unmodified-loop-condition: Support checkConditionalExpressions option (#26249) (camc314)

Commits

• b4da00b release(apps): oxlint v1.82.0 && oxfmt v0.67.0 (#26384)
• aa38ddf fix(linter/unicorn/numeric-separators-style): correct schema defaults (#26393)
• 6a0e19c feat(linter/eslint/no-unmodified-loop-condition): support `checkConditionalEx...
• See full diff in compare view

Updates ultracite from 7.10.7 to 7.11.1

Release notes

Sourced from ultracite's releases.

ultracite@7.11.1

Patch Changes

• 24b2797: Update oxfmt to 0.67.0 and re-target the markdown ::: fence patch to the new dist chunk. The release changes no options; it fixes CSS/SCSS/Less comment preservation and a few JSDoc-cast edge cases in member chains.
• 24b2797: Update oxlint to 1.82.0. The release adds and removes no rules, so the presets are unchanged apart from one new option: no-unmodified-loop-condition now runs with checkConditionalExpressions: true in the oxlint and ESLint core presets, so each branch of a ternary in a loop condition must be modified inside the loop rather than only the expression as a whole.
• 24b2797: Update the ESLint family: @angular-eslint/eslint-plugin 22.5, @typescript-eslint/* 8.70, eslint-plugin-solid 0.18, eslint-plugin-vue 10.11, eslint-plugin-jsdoc 64.3.8, eslint-plugin-cypress 7.0.2, @darraghor/eslint-plugin-nestjs-typed 7.5.2 and prettier-plugin-astro 1.0. The dynamic presets pick up the seven new rules automatically: @typescript-eslint/no-generated-empty-object-type, @angular-eslint/reactive-context-must-read-signal, vue/no-shadow-native-events, and Solid's no-boolean-enumerated-attribute, no-store-mutation-outside-setter, no-unused-signal and no-write-in-pure-computation. Note that prettier-plugin-astro 1.0 is a rewrite on the Astro 7 Rust compiler (Node 22.12+); expect whitespace diffs on first run and mirror any custom compressHTML via its new astroCompressHTML option.
• 24b2797: Refresh the stylelint lock to 17.15.0 and enable its new selector-no-unmatchable rule, which flags selectors that can never match (for example label:checked, ::before:first-child or :is(::before)).
• a71dda4: Stop sorting object keys across the whole TanStack presets, not just route files. TanStack Query mutation options are order-sensitive too: TypeScript infers the onMutate context from context-sensitive callbacks in source order, so moving onError/onSettled above onMutate turns the context into {} and ultracite fix broke type-correct code (TS2339: Property '...' does not exist on type '{}'). Mutation and query options live anywhere (hooks, components, colocated files), so the route-file exemption could not cover them. ultracite/oxlint/tanstack now sets sort-keys to off and ultracite/biome/tanstack now sets useSortedKeys to off for all files.
• a9db61c: Disable github/filenames-match-regex for file-based route directories (**/routes/**) in the oxlint js-plugins preset, matching the existing unicorn/filename-case exemption in the TanStack preset. TanStack Router filenames such as __root.tsx, $.tsx, and posts.$postId.tsx no longer fail the GitHub filename rule. Resolves #799.

ultracite@7.11.0

Minor Changes

• d5d241f: Add ultracite upgrade, and make version drift between Ultracite and its linter visible instead of a crash. Bumping ultracite without bumping the linter fails on the next check/fix with Biome's Found an unknown key error (and the equivalent for ESLint and Oxlint), because each release enables rules from a specific linter version.

  • ultracite upgrade installs the latest ultracite, prints a release-notes link for the versions you crossed, then hands off to the freshly installed CLI to reinstall your toolchain at the versions that release was verified with: Biome; ESLint, Prettier, Stylelint and the plugins the preset imports; or Oxlint and Oxfmt. Optional extras already in your package.json (framework plugins, Oxlint JS plugins, oxlint-tsgolint) are bumped as well. Config files are never rewritten, and the run ends with the same diagnostics as doctor.
  • ultracite doctor now checks the installed Biome, ESLint, Prettier, Stylelint, Oxlint and Oxfmt versions against the range this release supports. Too old fails the check and points at ultracite upgrade; newer than the verified range only warns.
  • The supported ranges are declared as optional peer dependencies so package managers warn when they drift: @biomejs/biome ^2.5.0, eslint ^10.0.0, prettier ^3.0.0, stylelint ^17.0.0, oxlint ^1.79.0, oxfmt >=0.40.0. ultracite init now installs Prettier and Stylelint from those ranges instead of latest.

  Requires Biome >= 2.5.0, ESLint >= 10.0.0, Prettier >= 3.0.0, Stylelint >= 17.0.0, Oxlint >= 1.79.0 and Oxfmt >= 0.40.0.

Patch Changes

• 27d06f2: Update dependencies (@clack/prompts, semver, zod, ESLint plugins).
• d322691: Default ultracite init to Oxlint + Oxfmt when --linter is omitted in quiet or non-interactive mode
• c677cf5: Recommend Oxlint + Oxfmt in the ultracite init linter prompt and list it first
• c5be848: Disable no-use-before-define in TanStack Router route files for the oxlint tanstack preset. File routes are mutually recursive (Route references the component, and the component calls Route.useParams()), so no declaration order could satisfy the rule.

ultracite@7.10.8

Patch Changes

• 2a43fdd: Turn off unicorn/prefer-reflect-apply in the ultracite/oxlint/anti-slop preset. When extended after ultracite/oxlint/core, the core rule recommended rewriting Function#apply() to Reflect.apply(), which anti-slop's no-reflect-apply then rejected, leaving no way to satisfy both. Direct-call guidance for .apply() still comes from eslint/prefer-spread and eslint/no-useless-call.

• 03196df: Update @biomejs/biome to 2.5.12. Releases 2.5.10 through 2.5.12 only add nursery rules, which the Biome presets exclude, so the presets are unchanged. The releases also carry linter and formatter fixes, including fewer noUnusedVariables false positives on merged interfaces, namespaces, and overload type parameters, an unsafe-by-default fix for noThisInStatic, and a large batch of Astro expression parsing fixes.

• 031b867: Update oxfmt to 0.66.0. The 0.65 and 0.66 releases are formatter fixes only, mainly around comment placement between a statement head and its body, suppressed statements (decorators, typecast parens, semicolons), custom side-effect groups in sortImports, CommonMark list interruption in JSDoc, and trailing whitespace in YAML block scalars. The ::: container-directive fence patch is re-targeted to the new markdown bundle; the patched code itself is unchanged.

• 54affee: Update oxlint to 1.81.0. The 1.80 and 1.81 releases add no rules and remove none, so the presets are unchanged and the peer range stays at ^1.79.0. Notable fixes carried in: no-use-before-define now runs on JS and JSX files, object-shorthand preserves __proto__ semantics, unicorn/prefer-math-min-max no longer applies an unsafe autofix, and JS plugin diagnostics with invalid or reversed locations are clamped instead of crashing.

• 0b058d1: Fix ultracite fix --codex failing on recent Codex CLI releases. The Codex adapter invoked codex exec --full-auto, a flag Codex has since removed, so every attempt failed at argument parsing. It now runs codex exec --sandbox workspace-write, the equivalent non-interactive, workspace-scoped mode, which is also accepted by older Codex versions. Resolves #794.

• e2346bb: Update the ESLint family to latest: eslint 10.9.1, typescript-eslint 8.69.0, eslint-plugin-unicorn 74, eslint-plugin-solid 0.17, eslint-plugin-jsdoc 64.3.5, eslint-plugin-react-doctor and oxlint-plugin-react-doctor 0.9.13, globals 17.12, and the angular, nestjs-typed, next, tanstack-query, cypress, html, jest and storybook plugins. The dynamic presets pick up the new rules automatically: the solid preset gains the eleven rules added in eslint-plugin-solid 0.16 and 0.17 (removed-api, no-single-arg-create-effect, no-accessor-as-prop, valid-use-server, require-async-server-function, no-invalid-server-capture, no-browser-globals-in-server-function, no-module-scope-reactive-primitive, no-restated-default-options, prefer-onSettled-for-side-effects, prefer-structured-class), which only report Solid 2.0 issues when settings.solid.version is set to 2 and stay silent on Solid 1.x code; the nestjs preset gains forward-ref-injection-should-use-wrapper-type, swagger-file-upload-should-be-documented and uploaded-file-should-be-validated. The curated jsdoc and react-doctor lists are unchanged. No enabled rule was removed or deprecated, and the ESLint/oxlint parity check still passes.

• 7b0456e: ultracite fix now runs lint fixes before the formatter: oxlint before oxfmt, and ESLint then Stylelint before Prettier. A fixer can insert unformatted code, such as the braces curly adds, the imports consistent-type-specifier-style splits, or the font names Stylelint requotes, and running the formatter first left that code unformatted until the next run. Fixer-inserted code is now formatted in the same run. The --claude and --codex agent passes follow the same order.

  unicorn/no-nested-ternary is now off in the oxlint and ESLint presets: its fixer adds parentheses that oxfmt and Prettier remove, so the two tools rewrote the file on every run. The core no-nested-ternary rule still reports nested ternaries.

• 8ddc078: Enable three rules added in Stylelint 17 in the Stylelint preset: selector-no-deprecated and selector-no-invalid report selectors that CSS has dropped or that cannot parse, and relative-selector-nesting-notation is set to explicit, so nested relative selectors are written & > b rather than > b. The property-layout-mappings, unit-layout-mappings and value-keyword-layout-mappings rules are deliberately left off, since they reject every physical property, unit and keyword and can only autofix with a per-project languageOptions.directionality setting. The repo's own Stylelint lock is refreshed from 16.26.1 to 17.14.1, which the config packages already required; ultracite init already installs stylelint@latest so users are unaffected by the lock change.

• 4609d79: Update the vendored anti-slop Oxlint plugin to upstream v0.1.2 (commit e8c4880). The rule set is unchanged; this picks up a round of correctness fixes: no-known-value-widening now also reports known values passed into local unknown-typed type predicates, no-object-parameters, no-unknown-parameters, no-unknown-returns and no-unknown-type-aliases resolve scoped and transparent generic aliases (including block-scoped aliases and forward references), no-unknown-returns covers PromiseLike<unknown>, no-unsafe-dictionary-type allows generic constraints such as T extends Record<string, unknown>, no-runtime-typeof always allows existence probes against "undefined", no-shape-in-symbol-names allows static member reads such as Zod's schema.shape, and require-safety-comment-for-type-assertion rejects empty justifications and gains a markers option (default ["SAFETY"]). Upstream also added a separate opt-in anti-slop-effect plugin for Effect projects, which is not vendored.

Commits

• 38c3c28 Version Packages (#802)
• 24b2797 Update the linter toolchain and adopt the new rules
• a9db61c fix: support TanStack route filenames in GitHub rule (#800)
• a71dda4 Disable key sorting across the TanStack presets
• 47a87bf Update blume to 1.6.3
• e8ba72f Version Packages (#798)
• db4983b Fix Windows path handling in doctor and upgrade tests
• 27d06f2 Update dependencies
• d5d241f Add ultracite upgrade and toolchain version checks
• d322691 Default init to Oxlint + Oxfmt when the linter prompt is skipped
• Additional commits viewable in compare view

Updates vite from 8.2.2 to 8.3.0

Release notes

Sourced from vite's releases.

create-vite@8.3.0

Please refer to CHANGELOG.md for details.

v8.3.0

Features

• build: avoid settling seen preload dependencies for performance (#23446) (e6f6b3e)

Bug Fixes

• handle CRLF line endings in code frame positions (#23219) (9913672)
• only treat whole node_modules path segments as dependencies (fix #17467) (#23437) (ef0dc17)

Performance Improvements

• proxy: pre-compile context matchers at server creation (#23263) (8abf700)

v8.3.0-beta.1

Features

• devtools: enable dev server integration (#23333) (68aeb8a)

Bug Fixes

• build: keep hash placeholders as-is in resolveFileUrl hook (#23422) (e8d6a4d)
• bundled-dev: mark payload delivered on client report (#23373) (a6d43bc)
• deps: update all non-major dependencies (#23445) (fc7c104)
• html: don't inline preload link targets (fix #13355) (#23387) (12e709c)
• resolve the actual package root in findNearestMainPackageData for nested package.json (#23356) (8492422)
• shortcuts extend error (#23447) (4ec58d1)

Miscellaneous Chores

• introducing @e18e/eslint-plugin (#23357) (f794133)
• remove unnecessary comment (#23448) (b919a1a)

v8.3.0-beta.0

Features

• accept Rolldown watch options in server.watch (#23133) (1b5cfe3)
• add closeServer and closePreviewServer hooks (#23110) (e17d2d5)
• add top-level tsconfig option (#23310) (93164c3)
• add warning for unsupported hooks in plugin returned from applyToEnvironment hook (#23191) (fdef04f)
• cli: support naming the CPU profile via --profile [name] (#23042) (a500dee)
• config: warn on named imports from JSON modules (#23378) (472385e)
• css: minify style tag (#23183) (8156684)
• searched params attached to workers are now preserved (#22280) (517b97f)
• support subpath imports in dynamic import statements (#23185) (b78e2f1)
• use import.meta.ROLLDOWN_FILE_URL_* for assets in JS (#22888) (4366ac4)
• use import.meta.ROLLDOWN_FILE_URL_* for other plugins (#22894) (e38f29e)

... (truncated)

Changelog

Sourced from vite's changelog.

8.3.0 (2026-09-10)

Features

• build: avoid settling seen preload dependencies for performance (#23446) (e6f6b3e)
• devtools: enable dev server integration (#23333) (68aeb8a)
• accept Rolldown watch options in server.watch (#23133) (1b5cfe3)
• add closeServer and closePreviewServer hooks (#23110) (e17d2d5)
• add top-level tsconfig option (#23310) (93164c3)
• add warning for unsupported hooks in plugin returned from applyToEnvironment hook (#23191) (fdef04f)
• cli: support naming the CPU profile via --profile [name] (#23042) (a500dee)
• config: warn on named imports from JSON modules (#23378) (472385e)
• css: minify style tag (#23183) (8156684)
• searched params attached to workers are now preserved (#22280) (517b97f)
• support subpath imports in dynamic import statements (#23185) (b78e2f1)
• use import.meta.ROLLDOWN_FILE_URL_* for assets in JS (#22888) (4366ac4)
• use import.meta.ROLLDOWN_FILE_URL_* for other plugins (#22894) (e38f29e)
• worker: remove worker chunk if it's detected that it's not referenced (#22473) (924997a)

Bug Fixes

• handle CRLF line endings in code frame positions (#23219) (9913672)
• only treat whole node_modules path segments as dependencies (fix #17467) (#23437) (ef0dc17)
• build: keep hash placeholders as-is in resolveFileUrl hook (#23422) (e8d6a4d)
• bundled-dev: mark payload delivered on client report (#23373) (a6d43bc)
• deps: update all non-major dependencies (#23445) (fc7c104)
• html: don't inline preload link targets (fix #13355) (#23387) (12e709c)
• resolve the actual package root in findNearestMainPackageData for nested package.json (#23356) (8492422)
• shortcuts extend error (#23447) (4ec58d1)
• config: close bundles when generation fails (#23256) (6bacc95)
• css: keep newline-separated srcset candidates intact (#23265) (4f9d2f4)
• deps: update all non-major dependencies (#23337) (d550815)
• deps: update all non-major dependencies (#23404) (238ad81)
• deps: update rolldown-related dependencies (#23338) (76e8082)
• deps: update rolldown-related dependencies (#23405) (b882566)
• dev: run closeBundle after buildEnd failure (#23165) (8cb872e)
• hmr: handle import.meta.hot.invalidate in virtual module (#23171) (6162968)
• utils: handle dot in srcset density descriptor (#23346) (b50e1b4)
• utils: match timestamp query parameter with proper delimiters (#23364) (41f3c6f)

Performance Improvements

• proxy: pre-compile context matchers at server creation (#23263) (8abf700)

Miscellaneous Chores

• introducing @e18e/eslint-plugin (#23357) (f794133)
• remove unnecessary comment (#23448) (b919a1a)
• delete unused PluginContainerOptions (#23382) (ee64401)
• use oxfmt sortImports (#23319) (97ad042)

... (truncated)

Commits

• 95e8923 release: v7.3.1
• 9d39d37 feat: add ignoreOutdatedRequests option to optimizeDeps (#21364)
• acf7e05 release: v7.3.0
• cff26ec feat(deps): update esbuild from ^0.25.0 to ^0.27.0 (#21183)
• 317b3b2 release: v7.2.7
• 721f163 fix: plugin shortcut support (#21211)
• bda5dbb release: v7.2.6
• 3aa7527 release: v7.2.5
• 72e398a fix(deps): update all non-major dependencies (#21175)
• 3765f7b fix: shortcuts not rebound after server restart (#21166)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: automated, dependencies. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: ff5d0837-95bf-475e-a742-975fddccffc9

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}