chore(deps): bump the production group across 1 directory with 6 updates

[dependabot]

Bumps the production group with 6 updates in the / directory:

Package	From	To
@oxlint/plugins	1.81.0	1.85.0
@types/bun	1.4.0	1.4.2
@types/node	26.4.1	26.6.2
oxfmt	0.66.0	0.70.0
oxlint	1.81.0	1.85.0
zod	4.5.4	4.6.5

Updates @oxlint/plugins from 1.81.0 to 1.85.0

Release notes

Sourced from @​oxlint/plugins's releases.

oxlint v1.85.0

🚀 Features

• 415b742 oxlint,oxfmt: Do not discover nested config in Vite+ mode (#26763) (leaysgur)

oxlint v1.84.0 & oxfmt v0.69.0

Table of Contents

• Oxlint v1.84.0
• Oxfmt v0.69.0

Oxlint v1.84.0

🚀 Features

• 809090c oxlint,oxfmt: Find all vite.config.* variants (#26755) (leaysgur)
• a047b67 linter: Report JavaScript plugin rule timings (#26415) (Alexander Lichter)
• 2300898 linter/unicorn/no-unreadable-iife: Implement suggestion (#26658) (Mikhail Baev)

🐛 Bug Fixes

• 12cb547 linter/eslint/no-unused-vars: Report private namespace bindings (#26842) (camc314)
• 927bfa4 oxlint/lsp: Align nested config handling with configPath semantics (#26762) (leaysgur)
• e096dfd linter/esliny/no-unused-vars: Handle comments when removing imports (#26781) (camc314)
• 9d48bae linter/esliny/no-unused-vars: Preserve rest bindings when removing array elements (#26778) (camc314)
• 62a2bb2 linter/eslint/preserve-caught-error: Prevent conflicting fixes with prefer-optional-catch-binding (#26726) (camc314)
• 0d565bc linter/unicorn/consistent-function-scoping: Detect ancestor-only function captures (#26625) (camc314)
• 3c98cde linter/vitest/prefer-to-be-truthy: Suggest assertion rewrites (#26761) (camc314)
• 7811f0a parser: Preserve reparsed await tokens (#26619) (camc314)
• e15f103 linter/react: Add a few more missing properties to no-unknown-property (#26572) (Connor Shea)

⚡ Performance

• c6a00e6 linter/eslint/no-restricted-exports: Skip inactive configurations (#26772) (camc314)
• 0026008 linter/eslint/capitalized-comments: Avoid unnecessary case-conversion allocations (#26754) (camc314)
• 34482c9 linter/oxc/no-map-spread: Avoid collecting spread spans twice (#26718) (camc314)
• 2ce913e linter/eslint/no-inline-comments: Skip unnecessary JSX node scans (#26714) (camc314)
• b946951 linter/eslint/no-control-regex: Avoid temporary diagnostic allocations (#26713) (camc314)
• 8903402 linter/promise/no-multiple-resolved: Avoid collecting executor parameters (#26691) (camc314)
• 3aa4b25 linter/jsx-a11y/anchor-ambiguous-text: Avoid temporary word allocations (#26692) (camc314)
• 2e07b32 linter/react/jsx-handler-names: Avoid temporary prefix collections (#26688) (camc314)
• 2d3b7a6 linter/typescript/consistent-generic-constructors: Avoid intermediate comment strings (#26687) (camc314)
• 97beefb linter/typescript/triple-slash-reference: Avoid attribute parsing allocations (#26686) (camc314)
• 6b9452d linter/unicorn/prefer-export-from: Avoid temporary attribute vector (#26685) (camc314)
• 8759780 linter/eslint/no-useless-assignment: Short-circuit identical scopes (#26684) (camc314)

📚 Documentation

• 68baaa4 linter/typescript/await-thenable: Revert add missing lang for markdown doc comment (#26757) (camc314)
• aa7de00 lsp: Document that the run option only applies to push mode clients (#26670) (im10furry)

... (truncated)

Commits

• 288d8cc release(apps): oxlint v1.85.0 && oxfmt v0.70.0 (#26903)
• f02a64a release(apps): oxlint v1.84.0 && oxfmt v0.69.0 (#26874)
• 7bf68f7 release(apps): oxlint v1.83.0 && oxfmt v0.68.0 (#26631)
• b4da00b release(apps): oxlint v1.82.0 && oxfmt v0.67.0 (#26384)
• See full diff in compare view

Updates @types/bun from 1.4.0 to 1.4.2

Commits

• See full diff in compare view

Updates @types/node from 26.4.1 to 26.6.2

Commits

• See full diff in compare view

Updates oxfmt from 0.66.0 to 0.70.0

Release notes

Sourced from oxfmt's releases.

oxfmt v0.70.0

🚀 Features

• 415b742 oxlint,oxfmt: Do not discover nested config in Vite+ mode (#26763) (leaysgur)

Commits

• 288d8cc release(apps): oxlint v1.85.0 && oxfmt v0.70.0 (#26903)
• f02a64a release(apps): oxlint v1.84.0 && oxfmt v0.69.0 (#26874)
• 7bf68f7 release(apps): oxlint v1.83.0 && oxfmt v0.68.0 (#26631)
• b4da00b release(apps): oxlint v1.82.0 && oxfmt v0.67.0 (#26384)
• 9a612d5 chore(deps): update npm packages (#26178)
• See full diff in compare view

Updates oxlint from 1.81.0 to 1.85.0

Release notes

Sourced from oxlint's releases.

oxlint v1.85.0

🚀 Features

• 415b742 oxlint,oxfmt: Do not discover nested config in Vite+ mode (#26763) (leaysgur)

Changelog

Sourced from oxlint's changelog.

Changelog

All notable changes to this package will be documented in this file.

The format is based on Keep a Changelog.

[1.82.0] - 2026-09-07

🚀 Features

• 6a0e19c linter/eslint/no-unmodified-loop-condition: Support checkConditionalExpressions option (#26249) (camc314)

Commits

• 288d8cc release(apps): oxlint v1.85.0 && oxfmt v0.70.0 (#26903)
• f02a64a release(apps): oxlint v1.84.0 && oxfmt v0.69.0 (#26874)
• 7bf68f7 release(apps): oxlint v1.83.0 && oxfmt v0.68.0 (#26631)
• b4da00b release(apps): oxlint v1.82.0 && oxfmt v0.67.0 (#26384)
• aa38ddf fix(linter/unicorn/numeric-separators-style): correct schema defaults (#26393)
• 6a0e19c feat(linter/eslint/no-unmodified-loop-condition): support `checkConditionalEx...
• See full diff in compare view

Updates zod from 4.5.4 to 4.6.5

Release notes

Sourced from zod's releases.

v4.6.5

Commits:

• d2b135cfb7a3582b9eb515756b9166bcb9521f4a docs: add the 4.6.x patch highlights to the 4.6 post
• f1448f7cee00df9fe1e9ad84a000aa1828cc8bc1 docs: fold the 4.6.x patch highlights into the 4.6 post's own sections
• de65a5cb39ed22a507fac935788f718fa88d104f docs: lead the properties section with the check and add a Zod Mini tab (#6598)
• 56222cd1532c07bcb91b67df529cab4c0a215330 feat(instanceof): key the .properties() shape off the instance type (#6600)
• ca0229a404818290e6cdcfefcd7eb2d04bcbb543 Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)"
• cc4cd4ee9c52fcaa10964e48cc144541e41a5ed9 Revert "Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)""
• 0f3f5ee3ca56c7574bf849e54f79e9a6e02562ee 4.6.5
• 59bbc03e10c636b9eb3c393dfeb552819774ec21 chore: re-pin the integration peers to the workspace zod after the 4.6.5 bump

v4.6.4

A patch on top of 4.6.3.

• d6bc1e30 feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)
• ad32d751 perf: z.url() rejects an invalid URL with URL.canParse() instead of a throwing constructor, about 50x faster; fewer allocations on the validation path (#6588)
• 2bb08717 chore: re-pin the integration peers to the workspace zod after the 4.6.4 bump
• f6e1701a chore(deps): bump next to 15.5.25 and vite to 7.3.6 (#6153)

v4.6.3

A patch on top of 4.6.2.

• 413cce9a fix(v4): make z.properties() a check again (#6594) — removes the standalone z.properties() schema from 4.6.0; z.instanceof().properties() and .check(...z.properties()) are unchanged
• 75d63ee1 docs: show only the .properties() method form in the 4.6 post
• 46da9572 docs: match the error-message examples to what the parsers emit

v4.6.2

A patch on top of 4.6.1.

• 9446b5cc fix: preserve undefined prefault outputs and object keys (#6587) — closes #6585
• 0c483c58 docs: the Zod 4.6 announcement post (#6546)
• a00c3f34 docs: use Trigger.dev's brand-kit lockups for the platinum card

v4.6.1

A patch on top of 4.6.0.

• b12aa523 fix: preserve unique tags with defaulted discriminators (#6582) — closes #6577
• dd9c36fa fix(v4): defer recursive object index inference (#6580)
• 3b154992 feat(lang): add Tajik (tg) locale (#6581) by @​ismoil77
• 2efa8b80 ci: give the npm wait a real budget and drop the back-publish path (#6583)

v4.6.0

Zod 4.6 is now available.

npm install zod@latest

At a glance:

... (truncated)

Commits

• 59bbc03 chore: re-pin the integration peers to the workspace zod after the 4.6.5 bump
• 0f3f5ee 4.6.5
• cc4cd4e Revert "Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, ref...
• ca0229a Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed w...
• 56222cd feat(instanceof): key the .properties() shape off the instance type (#6600)
• de65a5c docs: lead the properties section with the check and add a Zod Mini tab (#6598)
• f1448f7 docs: fold the 4.6.x patch highlights into the 4.6 post's own sections
• d2b135c docs: add the 4.6.x patch highlights to the 4.6 post
• 2bb0871 chore: re-pin the integration peers to the workspace zod after the 4.6.4 bump
• 743aedb 4.6.4
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Advanced

Run ID: 2e9d98af-42f4-42c0-a828-f38a04483534

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Benchmark comparison

main 294ff73 → PR 85d8093.

7 measured rounds per revision; one discarded warm-up round. Medians ± median absolute deviation; lower is better.

Operation	main	PR	Change	Assessment
Full index (4,096 messages)	154.373 ± 2.523 ms	155.130 ± 1.645 ms	0.5%	Within noise
Index unchanged files	23.382 ± 0.396 ms	23.782 ± 0.179 ms	1.7%	Within noise
Index one appended session	29.757 ± 1.059 ms	29.443 ± 0.191 ms	-1.1%	Within noise
Index unchanged (8 sessions)	5.244 ± 0.243 ms	5.259 ± 0.051 ms	0.3%	Within noise
Index unchanged (128 sessions)	61.340 ± 0.545 ms	60.096 ± 1.292 ms	-2.0%	Within noise
Index unchanged (2,048 sessions)	916.402 ± 2.347 ms	908.412 ± 7.320 ms	-0.9%	Within noise
Native grep: initialization + first query	71.380 ± 0.181 ms	71.741 ± 0.211 ms	0.5%	Within noise
Native grep: warm query	11.549 ± 0.291 ms	11.540 ± 0.172 ms	-0.1%	Within noise
Native grep: no match	0.193 ± 0.008 ms	0.191 ± 0.006 ms	-0.7%	Within noise
Streaming grep: plain	11.211 ± 0.075 ms	10.968 ± 0.112 ms	-2.2%	Within noise
Streaming grep: regex	11.192 ± 0.267 ms	10.639 ± 0.172 ms	-4.9%	Within noise
Streaming grep: fuzzy	10.761 ± 0.262 ms	10.920 ± 0.068 ms	1.5%	Within noise
Streaming grep: no match	19.833 ± 0.239 ms	19.349 ± 0.113 ms	-2.4%	Within noise
FTS: open index	7.349 ± 0.023 ms	7.367 ± 0.030 ms	0.3%	Within noise
FTS: reopen index per query	8.786 ± 0.020 ms	8.725 ± 0.048 ms	-0.7%	Within noise
Semantic build: fake engine (4,097 messages)	338.099 ± 4.788 ms	339.661 ± 4.021 ms	0.5%	Within noise
Vector search: SQLite	8.336 ± 0.174 ms	7.579 ± 0.183 ms	-9.1%	Within noise
Vector search: SQLite, selective filter	2.485 ± 0.022 ms	3.078 ± 0.055 ms	23.9%	Slower
Vector search: SQLite, selective filter (16,384 vectors)	2.651 ± 0.098 ms	2.879 ± 0.036 ms	8.6%	Within noise
Vector search: cosine, selective filter	0.846 ± 0.009 ms	0.678 ± 0.052 ms	-19.8%	Faster
Rank fusion (2 × 100 hits)	0.044 ± 0.003 ms	0.045 ± 0.006 ms	2.9%	Within noise

A change is flagged only when it exceeds 10% and three times the larger median absolute deviation. This is a noise heuristic, not a statistical significance test. Timing changes are informational. New correctness failures and execution errors fail the job; identical assertion failures in every main and PR round remain visible without blocking the PR.

Runtime: Bun 1.4.0, linux x64, AMD EPYC 7763 64-Core Processor. Same runner, serial execution, alternating revision order. Suite: f7f0a0530c34.

Fixtures: 32 sessions × 128 messages (~2 MiB), unchanged incremental-index proxies at 8/128/2,048 one-message sessions, 4,096 vectors × 384 dimensions, and a 16,384-vector selective-filter case. Native cold includes finder initialization; filesystem caches are not flushed. Vector retrieval excludes model loading and embedding generation.
Vector retrieval remains exact: SQL predicates reduce the distance input set and LIMIT bounds materialized results, but scalar distance still scans every filtered vector. Approximate vec0/ANN retrieval is deferred pending separate maintainer approval.

Tail latency (p95 of round averages)

Operation	main p95	PR p95
Full index (4,096 messages)	158.827 ms	160.268 ms
Index unchanged files	24.211 ms	24.617 ms
Index one appended session	31.201 ms	32.007 ms
Index unchanged (8 sessions)	5.703 ms	5.531 ms
Index unchanged (128 sessions)	63.078 ms	64.805 ms
Index unchanged (2,048 sessions)	939.053 ms	918.358 ms
Native grep: initialization + first query	71.625 ms	71.952 ms
Native grep: warm query	12.646 ms	12.174 ms
Native grep: no match	0.501 ms	0.199 ms
Streaming grep: plain	11.593 ms	11.351 ms
Streaming grep: regex	11.459 ms	10.980 ms
Streaming grep: fuzzy	11.532 ms	11.221 ms
Streaming grep: no match	20.247 ms	20.069 ms
FTS: open index	7.373 ms	7.557 ms
FTS: reopen index per query	8.918 ms	8.848 ms
Semantic build: fake engine (4,097 messages)	342.887 ms	346.911 ms
Vector search: SQLite	9.759 ms	7.762 ms
Vector search: SQLite, selective filter	2.535 ms	3.335 ms
Vector search: SQLite, selective filter (16,384 vectors)	2.749 ms	2.943 ms
Vector search: cosine, selective filter	0.962 ms	0.766 ms
Rank fusion (2 × 100 hits)	0.048 ms	0.055 ms

Raw samples and per-case failures are available in the workflow artifact.

Workflow run and raw results

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.