v2.0.1

• docs: surface breaking changes in release notes and backfill the changelog (#44)

v2.0.0

BREAKING CHANGES

• oxlint must be >=1.79.0. None of the new rule names exist before that version, so an older oxlint hard-errors on this preset's react/react-native/next/expo variants the same way current oxlint hard-errored on the old react/react-compiler name.

oxlint 1.79 split the nursery react/react-compiler rule into 24 category-specific rules and dropped the old name outright, so oxlint now hard-errors parsing a config that still sets it. magic-oxlint-config@3.0.0 replaces it with oxlint's own "recommended" set: error-boundaries, globals, immutability, incompatible-library, preserve-manual-memoization, purity, refs, set-state-in-effect, set-state-in-render, static-components, unsupported-syntax, use-memo, void-use-memo. Same coverage the old rule gave, under the names oxlint ships today.

Migration: bump magic-oxlint-config to ^3.0.0 and oxlint to >=1.79.0, then delete any local delete config.rules["react/react-compiler"] workaround.

• fix(oxlint-config)!: replace the removed react/react-compiler rule (#43)

v1.19.9

• fix(security): force patched js-yaml (#42)

v1.19.8

• fix(security): bump next to 16.3.3

v1.19.7

• fix(security): force patched fast-uri (#40)

v1.19.6

The release publishes magic-oxlint-config@2.0.6. The repo release is
v1.19.6, and v1 moves onto it.

Reusable workflows use their running commit

Reusable workflows now resolve sibling composite actions through GitHub's $/
syntax. A caller pinned to a Magic tag or SHA gets the workflow and its actions
from the same commit. Validation rejects stale self-references, @ref suffixes,
and path traversal. The syntax is available on GitHub.com; self-hosted runners
need version 2.336.0 or newer.

pnpm/action-setup moves to v5. Turborepo caches now persist the workspace's
.turbo directory with GitHub's pinned first-party cache action, using
platform, repository, job, and commit-scoped keys.

Renovate updates stay visible during quarantine

Renovate now opens dependency and vulnerability-alert PRs immediately. The
14-day release-age check still blocks them until the quarantine clears. The
Dependency Dashboard and PR list now show the same pending work.

Fumadocs and zbsearch now move in one reviewed group. The OXC group is split
into matching oxlint and oxfmt toolchains, with each Magic config moving beside
the binary it targets. These groups keep the 14-day quarantine and never
automerge. Related major and minor upgrades now share one PR.

oxlint 1.78 peer floor

magic-oxlint-config@2.0.5 added one-var: off, but oxlint versions before
1.78 reject that rule name even when it is disabled. Version 2.0.6 raises the
oxlint peer floor to 1.78, matching the first compatible binary.

v1.19.5

• fix(oxlint-config): preserve separate variable declarations (#35)

v1.19.4

• fix(codemods): reject unsafe linked sources (#34)

v1.19.3

• fix(security): isolate Maestro workspaces from labels (#33)
• fix(security): update nanoid to 3.3.18 [skip release] (#32)
• fix(security): update DOMPurify to 3.4.13 [skip release] (#31)

v1.19.2

• fix(security): harden readme and theme writes (#30)